PCNSA Practice Test 12 — 15 Questions

Question 1

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings. FTP uses separate control (TCP 21) and data channels, and the firewall must inspect both to enforce security policies. Enabling 'FTP Alg' in the Application Override settings allows the Palo Alto Networks firewall to dynamically open pinholes for the data channel and perform deep inspection of FTP commands, ensuring proper stateful handling of active and passive modes.

Answer

Create a rule with service 'tcp-21' and application 'any'

Answer

Create a rule with application 'ftp' and disable Application Override

Answer

Create a rule with application 'ftp' and service 'application-default'

Question 2

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. The best way to share security policies across firewalls with different interface configurations is to use a single device group containing both firewalls. Device groups are designed to manage security policies centrally, while templates handle device-specific settings like interface configurations. Option B is correct because it allows policy consistency without duplicating effort. Option A (separate device groups) would require manual duplication. Option C (templates) is incorrect because templates are for device-level configuration, not security policies. Option D (Shared policy with overrides) is not a standard or efficient approach for this scenario.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.

Question 3

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Accepted Answer

Change the 'ssl-protocol-settings' max-version to 'tls1-3'.. The decryption profile specifies max-version as tls1-2, which prevents decryption of TLS 1.3 traffic. Updating the max-version to tls1-3 allows decryption of TLS 1.3 sessions.

Answer

Change the min-version to 'tls1-3'.

Answer

Add a new rule for TLS 1.3 traffic.

Answer

Enable 'decrypt-unknown-protocol' to capture all traffic.

Question 4

An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?

Accepted Answer

The traffic was decrypted because it matched a decryption policy.. The traffic log entries indicate that the session to 192.168.1.1 was decrypted, as shown by the decryption flag or action field (e.g., 'decrypt'). This occurs when the traffic matches a decryption policy configured on the firewall, typically for SSL/TLS inspection. The destination being internal (192.168.1.1) and the application being SSL are not sufficient conditions for decryption; a matching decryption rule is required.

Answer

The traffic was decrypted because the application is SSL.

Answer

The traffic was not decrypted because it matched a no-decrypt policy.

Answer

The traffic was not decrypted because the destination is external.

Question 5

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Accepted Answer

Create a security policy rule that allows traffic from the internal zone to the external zone. In a virtual wire deployment (which operates at Layer 2), traffic inspection is still governed by security policy rules. A rule allowing traffic from the internal zone to the external zone ensures that all outbound traffic is evaluated and inspected by the firewall. Security policies are the primary mechanism for controlling and logging traffic, regardless of the deployment mode.

Answer

Define a NAT policy to translate internal IPs to the external interface

Answer

Enable SSL decryption on the firewall

Answer

Configure a virtual wire between the internal and external interfaces

Question 6

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 7

Which TWO statements about App-ID are correct? (Choose two.)

Accepted Answer

App-ID can identify applications even if they use standard ports for other services.. App-ID uses multiple identification mechanisms—including application signatures, SSL/TLS fingerprinting, and behavioral analysis—to identify applications regardless of the port they use. This means an application like SSH running on TCP 443 (typically used for HTTPS) will still be correctly identified as SSH, not as web-browsing traffic.

Answer

App-ID is only effective for well-known commercial applications.

Answer

App-ID primarily identifies applications based on port numbers.

Answer

App-ID requires at least 10 packets to identify an application.

Question 8

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Accepted Answer

A root CA certificate installed in the trusted root store on client devices.. Options A, D, and E are correct. A root CA certificate installed on client devices is required so clients trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt. A decryption profile specifies the forward proxy certificate (CA certificate) used by the firewall. Option B is incorrect because the firewall does not need the private key of each destination server; it generates its own certificate for the session. Option C is incorrect because the server certificate is not required on clients for forward proxy decryption.

Answer

The private key of each destination server.

Answer

The server certificate for each destination server.

Question 9

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 10

A small business has a Palo Alto Networks firewall with a single security policy rule that allows all traffic from the 'Trust' zone to the 'Untrust' zone. The business recently experienced a malware infection originating from an internal host that communicated with known malicious IP addresses. The administrator wants to implement a security policy to block traffic to these malicious IP destinations. The administrator has a list of 500 malicious IP addresses that may change frequently. What is the most efficient way to create a policy to block traffic to these IPs?

Accepted Answer

Create an External Dynamic List (EDL) of the malicious IPs and reference it in a security rule as destination address, with action deny, placed above the allow rule.. External Dynamic Lists (EDLs) are designed to manage large, frequently updated lists of IP addresses. They integrate with security rules and can be updated automatically, minimizing administrative overhead.

Answer

Create a security rule with an address group containing the 500 IPs as destination, action deny, placed above the allow rule.

Answer

Create a security rule with source zone Trust, destination zone Untrust, source address list containing the 500 IPs, action deny.

Answer

Create a security rule with source zone Trust, destination zone Untrust, destination address list containing the 500 IPs as separate address objects, action deny, placed above the allow rule.

Question 11

A security engineer wants to block downloading of executable files over HTTP and HTTPS, but allow all other web traffic. Which Content-ID feature should be configured to achieve this granular control?

Accepted Answer

Set up a File Blocking Profile and apply it to the security rule for web-browsing.. A File Blocking Profile is specifically designed to block the transfer of files based on file type (e.g., PE executables) over any allowed application, such as web-browsing. By applying this profile to a security rule that permits HTTP and HTTPS traffic, you can block executable downloads while allowing all other web content. This leverages Content-ID's file-type identification, which inspects the actual file content (magic bytes) rather than relying on extensions or application signatures.

Answer

Use an Application Override to identify executables.

Answer

Create a Data Filtering Profile to block executable file types.

Answer

Configure a URL Filtering Profile to block executables.

Question 12

A company has a pair of PA-5220 firewalls configured in an active/passive high-availability (HA) cluster. The devices are managed via Panorama, which also manages other firewalls. The security team reports that after a recent commit on Panorama, the passive firewall in the HA pair stops responding to management pings. The active firewall continues to pass traffic and is manageable. Upon investigation, the passive firewall shows the following on its console: 'Management plane is down.' The administrator suspects the passive firewall might have received a configuration that disables the management interface. What should the administrator do to restore management access to the passive firewall without affecting production traffic?

Accepted Answer

Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.. When the passive firewall's management plane is down and it is unresponsive to management pings, console access is the only way to interact with it. Password recovery mode allows the administrator to reset the management interface configuration without affecting the active firewall or production traffic, as the passive firewall is not forwarding data traffic in an active/passive HA cluster.

Answer

From the active firewall CLI, run 'request high-availability sync-to-remote running-config'.

Answer

Disconnect the HA link and reset the passive firewall to factory defaults.

Answer

Reboot the passive firewall to load the previous running configuration.

Question 13

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Accepted Answer

The decryption rule is configured with the forward proxy method.. Inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule. Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Answer

The firewall does not support wildcard certificates for inbound decryption.

Answer

The web server is not properly configured to handle decrypted traffic.

Answer

The decryption profile is set to 'Block sessions with untrusted certificates'.

Question 14

A company has deployed a pair of PA-5250 firewalls in an Active/Passive HA configuration. The management network uses a separate subnet with addresses 10.0.0.0/24. The active firewall's management IP is 10.0.0.1, passive is 10.0.0.2. They have a virtual router configured with static routes. The HA configuration uses HA1 (backplane) for heartbeat and HA2 for session sync. After a power failure, both firewalls reboot. The active firewall comes up first and becomes active. The passive firewall later joins, but fails to become passive; it remains in 'non-functional' state. The administrator observes the following:
- HA1 link is up on both firewalls.
- HA2 link shows 'waiting for HA2 link' on the active.
- The passive firewall's management IP is reachable.
- The active firewall shows 'peer unreachable' in HA status.
What is the most likely cause?

Accepted Answer

The HA2 cable is faulty or misconfigured. The active firewall shows 'waiting for HA2 link' and 'peer unreachable' despite HA1 being up and the passive management IP being reachable. This indicates that the HA2 link, which is responsible for session synchronization and state propagation, is not functioning. Since HA2 is required for the passive firewall to transition to a passive state, a faulty or misconfigured HA2 cable prevents the passive firewall from becoming operational, leaving it in a 'non-functional' state.

Answer

The management interface on the passive is misconfigured

Answer

The HA1 configuration is missing the peer's management IP

Answer

The passive firewall has a different PAN-OS version

Question 15

A network administrator is tasked with implementing a policy that allows traffic from the 'Sales' zone to the 'Internet' zone only for web-browsing (application: web-browsing) and blocks all other traffic. The administrator creates a rule at the top of the security policy with source zone Sales, destination zone Internet, application web-browsing, action allow. Below that, a rule with source zone Sales, destination zone Internet, application any, action deny. After committing, users in Sales can browse the web normally. However, the administrator discovers that some users are able to use applications like YouTube and Facebook which use web-browsing as part of their app-id. The administrator wants to ensure that only HTTP/HTTPS traffic for general web browsing is allowed, not other web-based applications. What should the administrator do?

Accepted Answer

Use URL filtering to block the social networking and streaming media categories.. Using URL filtering to block social media categories is effective and does not interfere with general web browsing. Changing the allow rule's application to HTTP/HTTPS would still allow Facebook and YouTube because they use HTTPS. Custom application filters or deny rules are less precise or affect allowed traffic.

Answer

Change the allow rule's application to include only HTTP and HTTPS.

Answer

Add a custom application filter to block social media applications.

Answer

Change the deny rule to block social media applications.