PCNSA Practice Test 10 — 10 Questions

Question 1

A firewall is configured with decryption and a custom SSL/TLS service profile that has 'Block Expired Certificates' enabled. After renewing a server certificate, some users are unable to access the site. The server certificate is correctly installed. What could be the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's system clock is not synchronized. When 'Block Expired Certificates' is enabled in a custom SSL/TLS service profile, the firewall checks the validity period of the server certificate against its own system clock. If the firewall's clock is not synchronized (e.g., via NTP) and is set to a time outside the new certificate's validity window, the firewall will incorrectly treat the valid renewed certificate as expired and block the connection. This explains why users cannot access the site despite the server certificate being correctly installed.

Answer

The renewal caused a private key mismatch

Answer

The client's system clock is not synchronized

Answer

The decryption policy still points to the old certificate

Question 2

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 3

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

Accepted Answer

The server is using an unsupported cipher suite.. The output shows a large number of handshake failures, which typically occur during the SSL/TLS handshake when the client and server cannot agree on a common cipher suite. If the server only supports weak or outdated ciphers that the firewall's decryption policy does not allow, or if the firewall's SSL forward proxy engine does not support the server's chosen cipher, the handshake will fail. This is the most likely cause because cipher suite mismatch is a common source of handshake failures in decryption environments.

Answer

The firewall's CRL server is unreachable.

Answer

The decryption policy is not matching the traffic.

Answer

The firewall's certificate is not trusted by clients.

Question 4

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. A Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 5

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings

Question 6

A firewall administrator notices that after a power outage, the firewall boots up but fails to load the last committed configuration. What should the administrator do to recover the configuration?

Accepted Answer

Use the 'load config from' command via CLI to restore from the most recent saved config. The 'load config from' CLI command allows the administrator to load a previously saved configuration file (e.g., from the most recent backup) into the running configuration without affecting the startup configuration. After loading, the administrator must commit the configuration to make it persistent. This is the standard recovery method when the last committed configuration fails to load after a reboot, as the firewall retains saved configuration files in its filesystem.

Answer

Perform a factory reset

Answer

Load a config file from the previous backup

Answer

Reinstall the PAN-OS image

Question 7

An administrator notices repeated login failures from external IP 10.0.0.1 in the system logs. The admin wants to permanently block all traffic from that IP. Which approach is best practice?

Accepted Answer

Create a security policy to block the IP and commit. Creating a security policy to block the IP and committing it is the standard, persistent method to block all traffic from a specific external IP address in Palo Alto Networks firewalls. This approach uses the firewall's stateful inspection engine to deny traffic at the network layer, ensuring the block survives reboots and is enforced across all interfaces.

Answer

Use the admin lockout feature

Answer

Create a static route to null0 via CLI

Answer

Use a Zone Protection profile

Answer

Add the IP to a block list in the management profile

Question 8

A network administrator needs to restrict which source IP addresses can access the firewall's web management interface. Which feature should be configured?

Accepted Answer

Management Profile. Management Profile. A Management Profile is a firewall configuration object that defines which services (e.g., HTTPS, SSH, ping) are allowed on a specific interface and, critically, which source IP addresses or subnets can access those services. By binding a Management Profile to an interface, the administrator can restrict web management access to only trusted source IPs, such as a management subnet. This is the intended and most secure method for controlling management plane access on Palo Alto Networks firewalls.

Answer

Access Control List on the data plane

Answer

Interface management settings

Answer

Security policy rule for management traffic

Question 9

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 10

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Accepted Answer

It applies an interface management profile.. The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Answer

It applies a security rule.

Answer

It applies a QoS profile.

Answer

It applies a Zone Protection profile.