PCNSA Exam Questions and Answers

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Address object

Address object directly defines a specific IP address.

Tag

Address group

Region

Why: To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

NAT address pool

NAT address pool specifies the translated IP addresses.

External dynamic list

Service group

IPsec Crypto profile

Why: A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Use a region object instead

Create a dynamic address group with a tag-based filter

Use an FQDN object in the address group; the firewall resolves it automatically

FQDN objects automatically resolve and update IPs.

Manually add all possible IP addresses to an address group

Why: Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Application object

Application objects define specific applications like web-browsing.

Application filter

Application group

Service object

Why: Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Which TWO statements about External Dynamic Lists (EDLs) are true?

EDLs can be used in security policy source and destination fields.

EDLs can be used as address objects in policies.

EDLs have a fixed refresh interval that cannot be changed.

EDLs must be manually updated by an administrator.

EDLs support both IP addresses and URLs.

EDLs can contain IPs, URLs, or domains.

EDLs allow the administrator to add individual IPs directly via the GUI.

Why: External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

The application 'web-browsing' does not cover port 8080 traffic.

App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.

The rule order is incorrect; a previous rule is denying the traffic.

The destination address object 10.10.0.0/16 is incorrect.

The source zone 'GP' should be 'untrust'.

Why: The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Want more Managing Objects practice?

All Policy Evaluation and Management questions

Domain 2: Policy Evaluation and Management

28% of exam · 6 sample questions below

A security administrator is troubleshooting a policy misconfiguration. The firewall is configured with a security rule that allows traffic from the 'Engineering' zone to the 'Servers' zone. However, traffic from an Engineering user to a server in the 'DMZ' zone is being denied. What is the most likely cause?

The rule only allows traffic from Engineering to Servers zone, not DMZ.

The rule explicitly allows Engineering to Servers; traffic to DMZ is not covered and is denied by default.

The rule is configured as an intrazone rule.

The rule is disabled in the rulebase.

SSL decryption is blocking the traffic.

Why: The security rule explicitly permits traffic from the 'Engineering' zone to the 'Servers' zone. Traffic destined to the 'DMZ' zone is a different zone, so the rule does not apply. By default, Palo Alto Networks firewalls enforce a deny-all policy for any traffic that does not match an explicit allow rule, which is why the traffic is denied.

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.

This allows selective bypassing of threat inspection for video traffic while inspecting the rest.

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Why: It uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

The source IP is negated in the rule.

The rule is placed at the top of the rulebase and overridden by a later rule.

The rule is positioned below an allow rule that matches the same traffic.

First match wins, so the allow rule matches before the block rule.

The rule is disabled in the rulebase.

Why: The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

An organization has a security policy that requires all outbound HTTP traffic from the 'Corporate' zone to the 'Internet' zone to be inspected by the URL Filtering profile. However, the administrator notices that some users can still access blocked categories. What is the most likely cause?

The firewall is configured to use DNS sinkholing, which bypasses URL filtering.

The rule is placed too low in the rulebase and a higher rule allows traffic without URL filtering.

The rule uses a source zone of 'Corporate' but the users are in a different zone.

The URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories.

An alert action logs but allows traffic; it does not block.

Why: If the URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories, the firewall will log the violation but still allow the traffic to pass. This means users can access blocked categories even though the rule is correctly applied, as the profile does not enforce a blocking action.

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.

User-ID integration allows scalable user-based policies.

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Why: It uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Enable logging on all rules to ensure complete audit trails.

Use zone-based policies instead of IP-based policies whenever possible.

Zone-based policies are more scalable and easier to manage.

Sort rules alphabetically by name to simplify rulebase navigation.

Disable unused rules rather than deleting them to preserve rule order for future use.

Disabling keeps the rule in the rulebase without affecting traffic.

Use service objects based on TCP/UDP ports to define application traffic.

Why: Zone-based policies reduce complexity and improve scalability by grouping interfaces into security zones, allowing policies to be applied based on traffic direction (e.g., from Trust to Untrust) rather than individual IP addresses. This aligns with Palo Alto Networks' best practice of using zones to simplify rule management and enhance security posture, as IP-based policies become unmanageable in dynamic environments.

Want more Policy Evaluation and Management practice?

All Securing Traffic questions

Domain 3: Securing Traffic

10% of exam · 6 sample questions below

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

The security policy uses an incorrect service object that doesn't match the application.

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.

Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.

Why: When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

DNS Security profile

DNS Security is designed to detect and block DNS tunneling.

Vulnerability Protection profile

URL Filtering profile

Anti-Spyware profile

Why: DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

A zone protection profile is blocking ICMP packets.

The virtual router does not have a default route to the external network.

Without a route, the firewall cannot forward packets to the destination.

The decryption policy is blocking the traffic because it is not decrypted.

The NAT policy is missing for the outbound traffic.

Why: The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Source Zone, Destination Zone, Application, and User

Source Zone, Destination Zone, Application, and Service

Source Zone, Destination Zone, Service, and Action

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action

These are the minimum required fields in a security policy rule.

Why: A security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.

Destination NAT translates the public IP to the private IP, and the policy allows the traffic.

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Why: To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Enable DNS Security on the outbound DNS traffic.

DNS Security detects tunneling attempts.

Configure DNS policies to block requests to unknown domains.

This restricts DNS to known domains only.

Allow all TCP traffic on port 53.

Enable logging on all DNS traffic for analysis.

Block all UDP traffic on port 53.

Why: DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Want more Securing Traffic practice?

All Device Management and Services questions

Domain 4: Device Management and Services

22% of exam · 6 sample questions below

A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?

Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10

Traffic logs show the action (allow/deny/drop) for each session, and filtering by IPs narrows down the specific session.

Search Threat logs for the destination IP

Search Config logs for any rule changes

Search System logs for the user's IP

Why: Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

HA1 interface

VLAN interface

Ethernet 1/1

MGT (Management) interface

The MGT interface is a dedicated management port that can be assigned an IP on a separate VLAN for out-of-band management.

Why: The MGT (Management) interface is a dedicated physical port on Palo Alto Networks firewalls designed specifically for out-of-band management traffic. It operates on a separate routing table and does not participate in production data forwarding, ensuring complete isolation of management traffic from production traffic as required by the scenario.

During a firewall upgrade from PAN-OS 9.1 to 10.0, the administrator receives an error that the upgrade cannot proceed because there is a pending commit. The administrator checks the commit status and sees that a commit was initiated but has not completed. What is the best course of action?

Reboot the firewall to clear the pending commit

Run 'commit force yes' from the CLI to force the commit

Forcing the commit will complete or abort the pending commit, clearing the block.

Wait for the commit to complete automatically

Cancel the upgrade and restart

Why: The 'commit force yes' command overrides a stuck or incomplete commit by forcing the commit operation to proceed, which clears the pending commit state and allows the upgrade to continue. In PAN-OS, a pending commit blocks administrative operations like upgrades, and forcing the commit is the safest way to resolve this without disrupting the firewall's operational state.

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

Export Traffic logs to CSV and analyze in Excel

Use the Top Applications report in the Reports tab

Use the ACC (Application Command Center) and filter by user group and time range

ACC provides a customizable dashboard with historical data by application and user group.

Use the Monitor tab's Session Browser with a filter for the user group

Why: The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

The VLAN interface needs an IP address configured

The VLAN interface must be assigned to a virtual router

The firewall needs a commit to apply the changes

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed

For a VLAN interface to be up, the parent Ethernet interface must be in layer 2 mode and the VLAN tag must be in the allowed list.

Why: For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Configure HA1 and HA2 interfaces with appropriate IPs

Enable Config Sync on the HA General tab

Enable Session Setup and State Synchronization under HA configuration

These settings enable the synchronization of session state information between HA peers.

Configure Path Monitoring to detect link failures

Why: Session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Want more Device Management and Services practice?

All App-ID and Content-ID questions

Domain 5: App-ID and Content-ID

10% of exam · 6 sample questions below

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

The firewall is not connected to the cloud for App-ID updates.

The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.

Google Drive has multiple sub-apps; uploads are a different app-ID.

Decryption is not enabled for Google Drive traffic.

An application override is configured for Google Drive.

Why: App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

Ensure the application uses a standard port.

Ensure SSL decryption is enabled for the application.

Check if the application override is applied to the correct rule.

Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.

If traffic is blocked by an earlier rule, App-ID never processes it.

Why: App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Use URL Filtering to block BitTorrent.

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.

App-ID identifies BitTorrent across any port.

Use Data Filtering to block BitTorrent traffic.

Block the commonly used ports for BitTorrent.

Why: Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

The application 'webapp' is not allowed due to an application override.

SSL decryption is not enabled.

A file blocking profile is blocking the upload.

File blocking is part of Content-ID and can prevent uploads.

App-ID is not identifying the application correctly.

Why: A file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

The firewall has not received the latest App-ID update.

SSL decryption is not configured.

The traffic lacks enough signatures to identify the sub-application.

If only partial identification is possible, it shows as the parent app.

A security rule is blocking the sub-application.

Why: App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.

What is the primary benefit of using Content-ID in a security policy?

It blocks malicious URLs.

It prioritizes traffic for specific applications.

It enables threat prevention and file blocking on allowed applications.

Content-ID inspects content after App-ID allows the application.

It identifies applications regardless of port.

Why: Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Want more App-ID and Content-ID practice?

All Decryption and Monitoring questions

Domain 6: Decryption and Monitoring

10% of exam · 6 sample questions below

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.

This allows trusted certificates to pass without decryption, reducing overhead while still validating certificates.

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Why: Setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

The decryption policy uses 'No Decrypt' for the internal application's URL category.

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

The firewall's CA certificate is not installed in the trusted root store on user endpoints.

Without trust, browsers show certificate errors and block the connection.

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Why: SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

URL Filtering logs

Threat logs

Tunnel Inspection logs

Tunnel Inspection logs record decryption decisions, including 'No Decrypt' actions.

Traffic logs

Why: Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

The firewall will present the server's self-signed certificate to the client, causing a warning.

Since the certificate is untrusted, the firewall displays a warning to the client.

The firewall will block the connection and generate an alert.

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Why: When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Dashboard

The Dashboard includes decryption widgets for real-time monitoring.

Policy Optimizer

Log Viewer

Reports

Why: The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.

This skips decryption for finance sites.

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Why: SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Want more Decryption and Monitoring practice?

Browse all PCNSA questions Take a timed practice test

Frequently asked questions

How many questions are on the PCNSA exam?

The PCNSA exam has 80 questions and must be completed in 80 minutes. The passing score is 700/1000.

What types of questions appear on the PCNSA exam?

Scenario-based questions covering exam objectives with detailed answer explanations.

How are PCNSA questions organised by domain?

The exam covers 6 domains: Managing Objects, Policy Evaluation and Management, Securing Traffic, Device Management and Services, App-ID and Content-ID, Decryption and Monitoring. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual PCNSA exam questions?

No. These are original exam-style practice questions written against the official Palo Alto Networks PCNSA exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 80 PCNSA questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

Palo Alto Networks · Free Practice Questions · Last reviewed May 2026

PCNSA Exam Questions and Answers

36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

80 exam questions

80 min time limit

Pass: 700/1000 / 1000

6 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

1. Managing Objects 2. Policy Evaluation and Management 3. Securing Traffic 4. Device Management and Services 5. App-ID and Content-ID 6. Decryption and Monitoring

Domain 1: Managing Objects

20% of exam · 6 sample questions below

All Managing Objects questions

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Address object

Address object directly defines a specific IP address.

Tag

Address group

Region

NAT address pool

NAT address pool specifies the translated IP addresses.

External dynamic list

Service group

IPsec Crypto profile

Use a region object instead

Create a dynamic address group with a tag-based filter

Use an FQDN object in the address group; the firewall resolves it automatically

FQDN objects automatically resolve and update IPs.

Manually add all possible IP addresses to an address group

Application object

Application objects define specific applications like web-browsing.

Application filter

Application group

Service object

Which TWO statements about External Dynamic Lists (EDLs) are true?

EDLs can be used in security policy source and destination fields.

EDLs can be used as address objects in policies.

EDLs have a fixed refresh interval that cannot be changed.

EDLs must be manually updated by an administrator.

EDLs support both IP addresses and URLs.

EDLs can contain IPs, URLs, or domains.

EDLs allow the administrator to add individual IPs directly via the GUI.

The application 'web-browsing' does not cover port 8080 traffic.

App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.

The rule order is incorrect; a previous rule is denying the traffic.

The destination address object 10.10.0.0/16 is incorrect.

The source zone 'GP' should be 'untrust'.

Want more Managing Objects practice?

All Policy Evaluation and Management questions

Domain 2: Policy Evaluation and Management

28% of exam · 6 sample questions below

The rule only allows traffic from Engineering to Servers zone, not DMZ.

The rule explicitly allows Engineering to Servers; traffic to DMZ is not covered and is denied by default.

The rule is configured as an intrazone rule.

The rule is disabled in the rulebase.

SSL decryption is blocking the traffic.

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.

This allows selective bypassing of threat inspection for video traffic while inspecting the rest.

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

The source IP is negated in the rule.

The rule is placed at the top of the rulebase and overridden by a later rule.

The rule is positioned below an allow rule that matches the same traffic.

First match wins, so the allow rule matches before the block rule.

The rule is disabled in the rulebase.

The firewall is configured to use DNS sinkholing, which bypasses URL filtering.

The rule is placed too low in the rulebase and a higher rule allows traffic without URL filtering.

The rule uses a source zone of 'Corporate' but the users are in a different zone.

The URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories.

An alert action logs but allows traffic; it does not block.

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

User-ID integration allows scalable user-based policies.

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Enable logging on all rules to ensure complete audit trails.

Use zone-based policies instead of IP-based policies whenever possible.

Zone-based policies are more scalable and easier to manage.

Sort rules alphabetically by name to simplify rulebase navigation.

Disable unused rules rather than deleting them to preserve rule order for future use.

Disabling keeps the rule in the rulebase without affecting traffic.

Use service objects based on TCP/UDP ports to define application traffic.

Want more Policy Evaluation and Management practice?

All Securing Traffic questions

Domain 3: Securing Traffic

10% of exam · 6 sample questions below

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

The security policy uses an incorrect service object that doesn't match the application.

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.

Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

DNS Security profile

DNS Security is designed to detect and block DNS tunneling.

Vulnerability Protection profile

URL Filtering profile

Anti-Spyware profile

A zone protection profile is blocking ICMP packets.

The virtual router does not have a default route to the external network.

Without a route, the firewall cannot forward packets to the destination.

The decryption policy is blocking the traffic because it is not decrypted.

The NAT policy is missing for the outbound traffic.

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Source Zone, Destination Zone, Application, and User

Source Zone, Destination Zone, Application, and Service

Source Zone, Destination Zone, Service, and Action

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action

These are the minimum required fields in a security policy rule.

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.

Destination NAT translates the public IP to the private IP, and the policy allows the traffic.

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Enable DNS Security on the outbound DNS traffic.

DNS Security detects tunneling attempts.

Configure DNS policies to block requests to unknown domains.

This restricts DNS to known domains only.

Allow all TCP traffic on port 53.

Enable logging on all DNS traffic for analysis.

Block all UDP traffic on port 53.

Want more Securing Traffic practice?

All Device Management and Services questions

Domain 4: Device Management and Services

22% of exam · 6 sample questions below

Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10

Traffic logs show the action (allow/deny/drop) for each session, and filtering by IPs narrows down the specific session.

Search Threat logs for the destination IP

Search Config logs for any rule changes

Search System logs for the user's IP

HA1 interface

VLAN interface

Ethernet 1/1

MGT (Management) interface

The MGT interface is a dedicated management port that can be assigned an IP on a separate VLAN for out-of-band management.

Reboot the firewall to clear the pending commit

Run 'commit force yes' from the CLI to force the commit

Forcing the commit will complete or abort the pending commit, clearing the block.

Wait for the commit to complete automatically

Cancel the upgrade and restart

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

Export Traffic logs to CSV and analyze in Excel

Use the Top Applications report in the Reports tab

Use the ACC (Application Command Center) and filter by user group and time range

ACC provides a customizable dashboard with historical data by application and user group.

Use the Monitor tab's Session Browser with a filter for the user group

The VLAN interface needs an IP address configured

The VLAN interface must be assigned to a virtual router

The firewall needs a commit to apply the changes

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed

For a VLAN interface to be up, the parent Ethernet interface must be in layer 2 mode and the VLAN tag must be in the allowed list.

Configure HA1 and HA2 interfaces with appropriate IPs

Enable Config Sync on the HA General tab

Enable Session Setup and State Synchronization under HA configuration

These settings enable the synchronization of session state information between HA peers.

Configure Path Monitoring to detect link failures

Want more Device Management and Services practice?

All App-ID and Content-ID questions

Domain 5: App-ID and Content-ID

10% of exam · 6 sample questions below

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

The firewall is not connected to the cloud for App-ID updates.

The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.

Google Drive has multiple sub-apps; uploads are a different app-ID.

Decryption is not enabled for Google Drive traffic.

An application override is configured for Google Drive.

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

Ensure the application uses a standard port.

Ensure SSL decryption is enabled for the application.

Check if the application override is applied to the correct rule.

Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.

If traffic is blocked by an earlier rule, App-ID never processes it.

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Use URL Filtering to block BitTorrent.

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.

App-ID identifies BitTorrent across any port.

Use Data Filtering to block BitTorrent traffic.

Block the commonly used ports for BitTorrent.

The application 'webapp' is not allowed due to an application override.

SSL decryption is not enabled.

A file blocking profile is blocking the upload.

File blocking is part of Content-ID and can prevent uploads.

App-ID is not identifying the application correctly.

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

The firewall has not received the latest App-ID update.

SSL decryption is not configured.

The traffic lacks enough signatures to identify the sub-application.

If only partial identification is possible, it shows as the parent app.

A security rule is blocking the sub-application.

What is the primary benefit of using Content-ID in a security policy?

It blocks malicious URLs.

It prioritizes traffic for specific applications.

It enables threat prevention and file blocking on allowed applications.

Content-ID inspects content after App-ID allows the application.

It identifies applications regardless of port.

Want more App-ID and Content-ID practice?

All Decryption and Monitoring questions

Domain 6: Decryption and Monitoring

10% of exam · 6 sample questions below

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.

This allows trusted certificates to pass without decryption, reducing overhead while still validating certificates.

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

The decryption policy uses 'No Decrypt' for the internal application's URL category.

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

The firewall's CA certificate is not installed in the trusted root store on user endpoints.

Without trust, browsers show certificate errors and block the connection.

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

URL Filtering logs

Threat logs

Tunnel Inspection logs

Tunnel Inspection logs record decryption decisions, including 'No Decrypt' actions.

Traffic logs

The firewall will present the server's self-signed certificate to the client, causing a warning.

Since the certificate is untrusted, the firewall displays a warning to the client.

The firewall will block the connection and generate an alert.

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Dashboard

The Dashboard includes decryption widgets for real-time monitoring.

Policy Optimizer

Log Viewer

Reports

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.

This skips decryption for finance sites.

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Want more Decryption and Monitoring practice?