PCNSA practice examsIn development
Palo Alto Networks Certified Network Security Administrator
Administering a next generation firewall: the candidate and running configuration model, objects that keep a rule base maintainable, how policy is actually evaluated against NAT, and the App-ID, User-ID and Content-ID that make it more than a port filter.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Device management and services | 22% |
| Managing objects | 20% |
| Policy evaluation and management | 28% |
| Securing traffic | 30% |
Two sample questions
1. What does the policy optimizer help you find?
- Rules that appear twice in the rulebase
- Rules with no log forwarding profile
- Rules that reference a deleted object
- Rules still written by port rather than application — correct
Why: It also shows which applications a port-based rule has actually carried.
2. What does Save do that Commit does not?
- Keeps the candidate configuration without activating it — correct
- Activates the candidate configuration on the data plane
- Copies the running configuration to the management server
- Exports the configuration as a file for an auditor to read
Why: The candidate holds edits that are not yet in force, and only a commit makes them the running configuration. Saving protects work in progress across a session or a reboot.
The real PCNSA exam
| Length | 80 minutes |
|---|---|
| Questions | 50 |
| Pass mark | Not published by Palo Alto Networks |
| Price | $155 USD |
| Recommended before you sit it | None. Familiarity with networking fundamentals is assumed. |
| Valid for | 2 years |
Exam facts as published by Palo Alto Networks; always check the vendor’s page before you book.
Study PCNSA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.