PCNSA Practice Test 12 — 15 Questions

Question 1

A security administrator notices that traffic from an internal user to a specific external web application is being blocked unexpectedly. The user's IP is 10.10.1.50 and the destination is 203.0.113.5 on port 443. The administrator has already verified that there is a security rule allowing the traffic. Which two logs should the administrator check first to diagnose the issue?

Accepted Answer

Check the Traffic log and the URL Filtering log.. Option A is correct because when a security rule explicitly allows traffic but the traffic is still blocked, the issue often lies in a secondary policy layer. The Traffic log will show whether the session was denied or allowed, and if allowed, the URL Filtering log can reveal that the destination URL was categorized as blocked by the URL filtering profile, even though the security rule permits the traffic. This is a common scenario where the security rule permits the session but a URL filtering profile applied to that rule blocks the specific web application.

Answer

Check the System log for configuration changes that might have added a rule.

Answer

Check the HIP Match log to see if the user's device lacks required security software.

Question 2

What is the primary benefit of using Content-ID in a security policy?

Accepted Answer

It enables threat prevention and file blocking on allowed applications.. Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Answer

It blocks malicious URLs.

Answer

It prioritizes traffic for specific applications.

Answer

It identifies applications regardless of port.

Question 3

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Accepted Answer

Rule 1 (allow-web). Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Answer

Rule 3 (allow-dns)

Answer

Rule 2 (block-malware)

Answer

No rule matches; traffic is denied by default.

Question 4

Refer to the exhibit. An administrator notices a high number of decryption failures. What is the most likely cause?

Accepted Answer

The firewall's certificate is not trusted by client devices.. When the firewall's certificate is not trusted by client devices, clients will reject the SSL handshake, resulting in decryption failures. This is a common issue in SSL Forward Proxy deployments where the firewall generates a certificate for each session, and clients must trust the firewall's CA certificate. Without this trust, clients display certificate warnings or fail to connect, leading to a high number of decryption failures.

Answer

The SSL session cache size is too small.

Answer

SSL Forward Proxy is not enabled.

Answer

Non-HTTP traffic is being decrypted.

Question 5

Refer to the exhibit. What does this log indicate?

Accepted Answer

An intrusion was detected and dropped.. The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Answer

A file transfer was blocked.

Answer

An intrusion was detected and allowed.

Answer

A URL filtering event occurred.

Question 6

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080

Question 7

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Accepted Answer

Tags can be applied to address objects. Option A is correct because tags are metadata labels that can be applied to address objects in Palo Alto Networks firewalls. This allows you to categorize objects flexibly, and dynamic address groups use these tags to automatically include or exclude objects based on tag membership.

Answer

A static address group can also use tags for matching

Answer

Tags are case-sensitive

Question 8

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny

Question 9

Which TWO types of address objects can be used in a security policy? (Choose two.)

Accepted Answer

IP Netmask. IP Netmask and IP Range are both types of address objects that define specific IP addresses or groups of IP addresses. Security policies in Palo Alto Networks firewalls use these address objects to match source and destination IP addresses in traffic, enabling granular control over which hosts or networks are allowed or denied.

Answer

Application

Answer

Tag

Answer

Service

Question 10

Which TWO are required to configure a Forward Proxy Decryption rule?

Accepted Answer

A Certificate. A certificate is required for a Forward Proxy Decryption rule because the firewall must generate and sign a certificate on-the-fly to impersonate the destination server to the client. Without a valid certificate (typically from an internal CA or a decryption-specific CA), the client browser will reject the connection with a certificate error. The certificate is used to establish a trusted TLS session between the client and the firewall, allowing the firewall to decrypt and inspect the traffic.

Answer

A Destination Zone

Answer

A Source Zone

Answer

A URL Category

Question 11

Refer to the exhibit. An administrator notes that traffic to Facebook is being denied. What is the most likely reason?

Accepted Answer

Facebook is not in the allowed applications list.. The exhibit shows a security policy rule with an 'allowed applications' list that does not include Facebook. Since App-ID identifies Facebook traffic by its application signature, any traffic matching this rule will be denied unless Facebook is explicitly allowed. Option D is correct because the absence of Facebook in the allowed applications list causes the firewall to block the traffic.

Answer

SSL decryption is not configured.

Answer

The profile group is blocking Facebook.

Answer

The rule order is incorrect.

Question 12

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Accepted Answer

Generate or import a CA certificate for the firewall. Option D is correct because SSL Forward Proxy decryption requires the firewall to act as a trusted intermediary. To do this, the firewall must generate or import a CA certificate that client browsers will trust, allowing it to dynamically generate and sign server certificates for decrypted sessions. Without this CA certificate, clients will receive untrusted certificate warnings, and decryption will fail.

Answer

Import the server's private key

Answer

Import the server certificate

Answer

Enable SSH decryption

Question 13

A security analyst is troubleshooting a decryption issue. Which TWO logs are most useful for identifying decryption failures? (Choose two.)

Accepted Answer

Traffic Logs. Traffic Logs (B) are most useful because they record the result of decryption actions, including whether decryption was applied and if it succeeded or failed, with specific error codes. Decryption Logs (E) are dedicated logs that capture detailed decryption events, such as handshake failures, certificate errors, or unsupported cipher suites, making them essential for troubleshooting decryption failures.

Answer

Config Logs

Answer

System Logs

Answer

Threat Logs

Question 14

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Accepted Answer

Privacy regulations. Option A is correct because privacy regulations such as GDPR, HIPAA, or PCI DSS often restrict the decryption of traffic containing personally identifiable information (PII) or protected health information (PHI). Decrypting such traffic without proper safeguards can lead to legal penalties and data breach exposure. Palo Alto Networks firewalls can apply decryption policies that exclude traffic to specific URL categories or IP ranges to remain compliant with these regulations.

Answer

The cost of SSL certificates

Answer

User productivity

Question 15

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

Accepted Answer

The firewall is not configured with the root CA certificate. When a firewall performs inbound inspection decryption, it re-encrypts traffic using the server's certificate. If the firewall does not have the root CA certificate that issued the server's certificate, the firewall cannot present a complete certificate chain to clients. Clients then see the certificate as untrusted because the issuing CA is not recognized, even though the server's certificate and private key are correctly imported.

Answer

The server's certificate is using an unsupported cipher

Answer

The decryption profile's 'Unsupported Modes' is set to 'Block'

Answer

The decryption policy is not matching the traffic