Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 28

Which two statements are true for the DNS Security service introduced in PAN-OS version 9.0? (Choose two.)

Answer options

• A. It is automatically enabled and configured.
• B. It eliminates the need for dynamic DNS updates.
• C. It functions like PAN-DB and requires activation through the app portal.
• D. It removes the 100K limit for DNS entries for the downloaded DNS updates.

Correct answer: B, C

Explanation

Option B is correct as the DNS Security service indeed eliminates the need for dynamic DNS updates. Option C is also correct because the service operates like PAN-DB and requires activation through the app portal. Options A and D are incorrect; the service is not automatically enabled and configured, and the 100K limit is not related to the DNS Security service.