PCNSA Practice Test 11 — 15 Questions

Question 1

Match each firewall deployment mode to its description.

Question 2

Match each protocol to its default port used by Palo Alto Networks.

Question 3

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Accepted Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.. Option B is correct because it uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Answer

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Question 4

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Question 5

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Question 6

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. Option A is correct because the firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 7

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Accepted Answer

The internal interface (ethernet1/2) is administratively down. Option D is correct because the exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 8

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 9

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 10

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Accepted Answer

Check the Traffic log with the session's source IP and destination. Option D is correct because the Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Answer

Check the System log for related entries

Answer

Run a packet capture on the ingress interface

Answer

Check the global counters for dropped packets

Question 11

Match each Palo Alto Networks feature to its primary function.

Question 12

Match each Palo Alto Networks feature to its category.

Question 13

Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?

Accepted Answer

Rule 1 (Allow-Sales). Option D (Rule 1 – Allow-Sales) is correct because the user at 10.1.1.50 is in the Sales zone, and the destination 192.168.1.100 is in the Servers zone. The traffic log shows no entries, meaning the traffic is being matched and allowed by a rule before it can be logged. Rule 1 explicitly permits traffic from Sales to Servers on TCP port 443, so it matches this interzone traffic and allows it, generating a log entry only if logging is enabled on that rule.

Answer

Interzone-default

Answer

Intrazone-default

Answer

Rule 2 (Allow-HR)

Question 14

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

Accepted Answer

Dataplane resources are exhausted. The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Answer

The firewall has been recently rebooted

Answer

System CPU is too high

Answer

The session limit is being reached

Question 15

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. Option A is correct because External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.