PCNSA Practice Test 12 — 15 Questions

Question 1

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The profiles are set to 'alert' instead of 'block' for the critical threat categories.. If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight. Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Answer

The antivirus signatures are outdated.

Answer

The security profiles are not attached to any security rule.

Answer

The profile groups are applied in the wrong order.

Question 2

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 3

A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?

Accepted Answer

The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.. Zone protection profiles with Flood Protection enabled apply rate-based thresholds (SYN, UDP, ICMP, etc.) at the ingress of a zone. If thresholds are set too low, legitimate traffic that exceeds those rates is dropped before security policy evaluation, which explains why an allow-all outbound policy still results in denied traffic. This is the most likely cause given the scenario.

Answer

The security policy is set to deny due to an implicit deny rule.

Answer

The security policy has a logging profile attached that is blocking traffic.

Answer

The security policy has a schedule configured that is currently outside the allowed time.

Question 4

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

Accepted Answer

Verify the SNMP community string and allowed management IPs in the SNMP server profile. The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Answer

Check that the SNMP manager supports SNMPv3

Answer

Verify that the firewall's management IP is reachable from the SNMP manager

Answer

Ensure the SNMP manager is running on the same subnet as the firewall

Question 5

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. The internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.

Question 6

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.. It creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.

Answer

Modify the existing decrypt rule to decrypt all categories except those two.

Answer

Disable decryption entirely for all student traffic.

Answer

Create a security policy rule to allow traffic to those URL categories without inspection.

Question 7

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Accepted Answer

Application object. Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Answer

Application filter

Answer

Application group

Answer

Service object

Question 8

A security administrator wants to block traffic from a specific country using the firewall. How can this be achieved with minimal administrative overhead?

Accepted Answer

Create a security rule with a source region of the specified country.. Palo Alto Networks firewalls include a built-in Geolocation database that maps IP addresses to countries. By creating a security rule with the source region set to the specific country, the firewall automatically applies the block without requiring manual IP management or external feeds, minimizing administrative overhead.

Answer

Configure an External Dynamic List (EDL) and reference it in a rule.

Answer

Manually add all IP subnets from that country to a block rule.

Answer

Disable routing to that country through the firewall.

Question 9

Which TWO of the following are true about App-ID? (Choose two.)

Accepted Answer

App-ID identifies applications regardless of port.. Option B is correct because App-ID performs application identification independent of the TCP/UDP port in use, so an application running on a non-standard port is still recognized rather than being assumed from its port number. Option C is correct because App-ID combines multiple identification techniques — application signatures, protocol decoding, and behavioral/heuristic analysis — to accurately classify traffic, including evasive applications. Option A is incorrect because App-ID supports custom application signatures, allowing administrators to define and identify proprietary or internal applications. Option D is incorrect because App-ID is explicitly not limited to standard ports; port-independent identification is a core design goal of App-ID.

Answer

App-ID cannot identify custom applications.

Answer

App-ID can only identify applications on standard ports.

Question 10

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

Accepted Answer

Use the Policy Optimizer tool to view rule hit counts.. The Policy Optimizer tool in Palo Alto Networks firewalls provides rule hit counts, allowing administrators to quickly identify which security rules are not being used. Option A, 'show rulebase', displays the rulebase but does not show hit counts. Option B, checking commit logs, reveals recent changes but not usage frequency. Option C, sorting rules by rule number, does not indicate whether rules are used.

Answer

Use the 'show rulebase' command.

Answer

Check the commit logs for recent changes.

Answer

Sort rules by rule number in descending order.

Question 11

Which TWO management methods allow CLI access to a Palo Alto Networks firewall?

Accepted Answer

SSH. SSH (Secure Shell) is a standard management method that provides encrypted CLI access to Palo Alto Networks firewalls, allowing administrators to execute commands securely over a network. The serial console port on the firewall provides direct, out-of-band CLI access for initial configuration or troubleshooting when network connectivity is unavailable.

Answer

HTTPS

Answer

HTTP

Answer

Telnet

Question 12

A company uses Panorama to manage multiple device groups. They want to push a set of global security policies to all firewalls. Where should the administrator configure these policies in Panorama?

Accepted Answer

As pre-rules in the 'shared' device group. In Panorama, the 'shared' device group is designed for policies that must apply globally across all managed firewalls. Configuring security policies as pre-rules in the shared device group ensures they are evaluated before any device-group-specific rules, providing a consistent global baseline that cannot be overridden by local rules.

Answer

As pre-rules in each regional device group

Answer

In the default rule base of each device group

Answer

As post-rules in the 'shared' device group

Question 13

A firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which action should be taken?

Accepted Answer

Create a decryption bypass for traffic to high-bandwidth sites with low security risk.. Creating a decryption bypass for traffic to high-bandwidth, low-risk sites reduces the CPU load from SSL decryption by exempting that traffic from decryption, while still allowing decryption for higher-risk traffic. This targeted approach maintains security posture without completely disabling decryption, aligning with best practices for managing decryption resources on Palo Alto Networks firewalls.

Answer

Use decryption mirroring to offload decryption to a dedicated appliance.

Answer

Change decryption policy to 'no-decrypt' for all traffic.

Answer

Enable SSL/TLS protocol settings to disable weak ciphers.

Question 14

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Dynamic IP and Port (DIPP) with source NAT is the correct choice because it translates multiple internal IP addresses to a pool of public IP addresses while also translating source ports, allowing many internal users to share a small public IP pool. This is the standard Palo Alto Networks configuration for outbound internet access from internal users.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 15

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Accepted Answer

Create a more specific decryption policy to only decrypt necessary traffic.. The firewall is decrypting unnecessary traffic (social media sites) in addition to critical medical cloud services. By refining the decryption policy to exclude non-essential traffic, the administrator reduces the CPU load from SSL/TLS handshake and encryption processing, directly addressing the spike without requiring hardware changes. This aligns with Palo Alto Networks best practices of minimizing decryption scope to only traffic that requires inspection.

Answer

Increase the decryption session timeout value.

Answer

Replace the firewall with a higher-end model.

Answer

Enable SSL acceleration hardware offloading.