PCNSA Practice Test 1 — 10 Questions

Question 1

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

Accepted Answer

File Blocking profile. The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Answer

Data Filtering profile

Answer

Application filter in security rule

Answer

URL Filtering profile

Question 2

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad. Option D allows all traffic.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 3

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 4

Refer to the exhibit. A security rule is configured with destination address group 'internal-servers'. A packet with destination IP 10.10.20.5 arrives. Will the rule match?

Accepted Answer

Yes, because 10.10.20.5 is within the range of server2.. 10.10.20.5 is within the IP range defined by server2 (10.10.20.1-10.10.20.10). Option B is wrong because address groups can contain multiple objects. Option C is wrong because the group does not include all internal addresses. Option D is wrong because destination can be a range or subnet.

Answer

No, because the destination must be a single IP address.

Answer

Yes, because the address group includes all internal addresses.

Answer

No, because the address group uses multiple objects.

Question 5

An administrator wants to require users in the Internal zone to authenticate via User-ID before accessing the Internet. Which policy configuration is necessary to enforce this requirement?

Accepted Answer

Configure a security rule with a user-id condition set to 'known-user' and action 'allow' with 'require authentication' selected.. To require authentication, the security rule must include a user-id condition with the 'require authentication' action.

Answer

Create an authentication policy that maps users to roles.

Answer

Configure a captive portal on the firewall to prompt for credentials.

Answer

Enable User-ID on the Internal zone under Zone properties.

Question 6

An administrator is reviewing the rulebase and finds a rule with a hit count of 0 over the past 30 days. What action should the administrator consider?

Accepted Answer

Consider removing the rule as it is not being used.. A rule with no hits is unused and can be cleaned up to improve policy performance. Option A is wrong because increasing logging won't help if the rule is not matching. Option C is wrong because moving the rule higher won't cause matches if the rule doesn't match traffic. Option D is wrong because disabling the rule is not as good as removal for cleanup.

Answer

Move the rule higher in the rulebase.

Answer

Increase the log setting to capture more data.

Answer

Disable the rule to see if any traffic matches.

Question 7

A security administrator notices that a newly added security rule, designed to allow SSH traffic from the engineering department to a Linux server, is not being matched. The rule is placed above an existing 'deny all' rule. What is the most likely cause?

Accepted Answer

The rule's source zone or address does not match the engineering department traffic.. If the zone or source address is misconfigured, the traffic will not match the intended rule and will be matched by later rules. Option A is wrong because rule ordering is correct (rule above deny all). Option C is wrong because hit count is irrelevant to the cause of no match. Option D is wrong because the rule is placed in the correct position.

Answer

The rule is placed below the deny all rule.

Answer

The rule has a low hit count.

Answer

The rule is placed after the deny all rule.

Question 8

A company wants to block all traffic from the Guest zone to the Corporate zone except DNS. What is the best practice for configuring the security policy?

Accepted Answer

Create an allow rule for DNS from Guest to Corporate, placed above a deny rule for any other traffic.. Best practice is to place the allow rule before the deny rule to ensure permitted traffic is not blocked by a broader deny rule.

Answer

Create a deny rule for any traffic from Guest to Corporate, placed above an allow rule for DNS.

Answer

Rely on the interzone default rule, which blocks all traffic, and add a rule to allow DNS.

Answer

Create a universal rule that applies to all zones with action 'allow' for DNS and 'deny' for everything else.

Question 9

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Accepted Answer

Dashboard. The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

Answer

Policy Optimizer

Answer

Log Viewer

Answer

Reports

Question 10

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

Accepted Answer

Suspend the passive firewall, then re-suspend it to trigger a full configuration synchronization.. Suspending and then re-suspending the passive firewall forces a full configuration synchronization from the active to the passive node. This is the most efficient method to resync after a software upgrade, as it triggers a complete config push without requiring a reboot or factory reset, preserving the HA state and minimizing disruption.

Answer

Restart both firewalls to automatically trigger a configuration sync.

Answer

Perform a factory reset on the passive firewall and re-join it to the HA pair.

Answer

Suspend the active firewall to make the passive take over, then restore the config.