PCNSA Practice Test 13 — 15 Questions

Question 1

A firewall is configured with multiple Virtual Systems (vsys). An admin wants to assign a custom admin role that can manage only specific vsys. Which role type supports this?

Accepted Answer

Virtual System Admin. The Virtual System Admin role is specifically designed to grant administrative access to one or more Virtual Systems (vsys) within a Palo Alto Networks firewall. This role type allows the admin to manage only the assigned vsys, with no visibility or control over other vsys or the shared firewall configuration, which directly matches the requirement in the question.

Answer

Panorama Admin

Answer

Read Only Admin

Answer

Superadmin

Answer

Device Admin

Question 2

An administrator wants to allow ping (ICMP) and SSH access on a data interface (e.g., ethernet1/1) for troubleshooting. Which configuration is required?

Accepted Answer

Configure an interface management profile on ethernet1/1. Interface management profiles control which management services (ping, SSH, HTTP, etc.) are permitted on a data interface.

Answer

Enable 'Management' profile on the VLAN interface

Answer

Create a security policy allowing ICMP and SSH inbound

Answer

Enable the service route for ping and SSH

Question 3

After a firewall upgrade, the system clock shows a time that is five minutes behind the actual time, even though NTP is synchronized. What is the most likely cause?

Accepted Answer

The timezone offset is incorrectly set.. When NTP is synchronized but the system clock is offset by a fixed amount (e.g., five minutes), the most likely cause is an incorrect timezone offset. NTP synchronizes the UTC time, and the firewall then applies the configured timezone offset to display the local time. If the offset is wrong, the displayed time will be consistently off by that offset value, even though NTP shows synchronization.

Answer

The firewall is using a stratum 2 server that is inaccurate.

Answer

NTP authentication is not configured.

Answer

The NTP admin state is enabled but the service route is misconfigured.

Question 4

A company has a PA-5250 firewall with 10 Gbps threat prevention throughput. They are planning to enable SSL decryption for all traffic. What is the most likely impact on the firewall's throughput?

Accepted Answer

Throughput will decrease, typically by 30-50% depending on traffic.. SSL decryption requires the firewall to intercept, decrypt, inspect, and re-encrypt traffic. This process is computationally intensive, especially for high-throughput environments. Even with dedicated hardware, the PA-5250's threat prevention throughput is rated without decryption; enabling it typically reduces throughput by 30-50% due to the overhead of cryptographic operations and deep packet inspection on decrypted content.

Answer

Throughput will remain the same because the firewall uses dedicated hardware.

Answer

Throughput will increase due to offloading encryption to hardware.

Answer

Throughput will decrease only if decryption is applied to video traffic.

Question 5

Refer to the exhibit. The firewall is currently running PAN-OS 9.1.4. The administrator wants to upgrade to the latest available version shown. What should the administrator do first?

Accepted Answer

Download the PAN-OS 9.1.7 package from the support site. The firewall is running PAN-OS 9.1.4, and the latest available version shown is 9.1.7. Before any upgrade can be performed, the administrator must first download the PAN-OS 9.1.7 image from the Palo Alto Networks support site. This is a prerequisite step because the upgrade process requires the image file to be present on the firewall or accessible via a valid download path; the firewall cannot install a version it has not yet obtained.

Answer

Reset the firewall to factory defaults to ensure a clean upgrade

Answer

Reboot the firewall to apply pending updates

Answer

Directly install the PAN-OS 9.1.7 package

Question 6

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

Accepted Answer

MGT (Management) interface. The MGT (Management) interface is a dedicated physical port on Palo Alto Networks firewalls designed specifically for out-of-band management traffic. It operates on a separate routing table and does not participate in production data forwarding, ensuring complete isolation of management traffic from production traffic as required by the scenario.

Answer

HA1 interface

Answer

VLAN interface

Answer

Ethernet 1/1

Question 7

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

Accepted Answer

Use the ACC (Application Command Center) and filter by user group and time range. The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

Answer

Export Traffic logs to CSV and analyze in Excel

Answer

Use the Top Applications report in the Reports tab

Answer

Use the Monitor tab's Session Browser with a filter for the user group

Question 8

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

Accepted Answer

Session synchronization. Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Answer

Stateful failover

Answer

Packet buffer

Answer

Session Timer adjustment

Question 9

A network engineer needs to apply the same security policy to multiple firewalls. Which tool should be used to centralize policy management?

Accepted Answer

Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, enabling administrators to define, push, and enforce consistent security policies across multiple firewalls from a single interface. It aggregates logs and provides visibility into all managed firewalls, eliminating the need to configure each device individually.

Answer

PanOS Central

Answer

Web interface of each firewall

Answer

Command Line Interface (CLI)

Question 10

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Accepted Answer

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.. Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Answer

Use URL Filtering to block BitTorrent.

Answer

Use Data Filtering to block BitTorrent traffic.

Answer

Block the commonly used ports for BitTorrent.

Question 11

A security administrator wants to inspect decrypted traffic for threats. What is the minimum set of features required?

Accepted Answer

SSL Decryption and Threat Prevention. To inspect decrypted traffic for threats, you must first decrypt the traffic using SSL Decryption, which terminates the SSL/TLS session and allows the firewall to examine the plaintext payload. Then, Threat Prevention (which includes IPS, antivirus, and anti-spyware signatures) can analyze that decrypted content for malicious patterns. Without SSL Decryption, Threat Prevention only sees encrypted traffic and cannot inspect the payload; without Threat Prevention, SSL Decryption alone provides no threat detection. Therefore, both features are required.

Answer

Threat Prevention only

Answer

SSL Decryption only

Answer

SSL Decryption and URL Filtering

Question 12

Based on the exhibit, what action did the firewall take on this traffic?

Accepted Answer

Allowed the traffic.. The exhibit shows a traffic log entry with the action 'allow' (or a green checkmark indicating a permit), meaning the firewall evaluated the traffic against security policies and determined it matched a rule set to allow. The session was established and forwarded without being blocked or reset, confirming the correct answer is C.

Answer

Reset the connection.

Answer

Blocked the URL.

Answer

Denied the traffic.

Question 13

Two Palo Alto Networks firewalls are configured in an active/passive high-availability pair. During a failover event, the passive firewall becomes active but the session table is empty. What is the most likely cause?

Accepted Answer

Session synchronization is not configured. In an active/passive high-availability pair, session synchronization must be explicitly configured to replicate session state from the active firewall to the passive firewall. Without this configuration, the passive firewall has no session table when it becomes active, causing all existing connections to be dropped. This is the most direct cause of an empty session table after failover.

Answer

The preemptive mode is disabled

Answer

Heartbeat failure caused the failover to be incomplete

Answer

The sessions timed out during the failover

Question 14

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Accepted Answer

App-ID with SSL protocol detection. App-ID with SSL protocol detection allows the firewall to identify HTTPS applications by inspecting the Server Name Indication (SNI) field in the TLS handshake and the certificate common name, without decrypting the traffic. This enables application identification while preserving encryption, meeting the requirement to monitor HTTPS traffic without decryption.

Answer

SSL Decryption Mirror

Answer

SSL Forward Proxy

Answer

URL Filtering

Question 15

What is the primary benefit of using App-ID in a security policy instead of relying solely on port-based rules?

Accepted Answer

It allows enforcement based on application identity, even if the application uses non-standard ports.. Palo Alto Networks App-ID identifies applications by inspecting multiple attributes — protocol signatures, SSL/TLS decryption, behavioral heuristics, and payload patterns — rather than relying on TCP/UDP port numbers. This means a policy can permit or deny traffic based on the actual application (e.g., Facebook, BitTorrent, Salesforce) regardless of whether it runs on port 80, 443, or a non-standard port. This defeats evasion techniques like port hopping and lets administrators write precise, application-aware rules.

Answer

It increases firewall throughput.

Answer

It reduces the number of security rules needed.

Answer

It limits traffic to HTTP and HTTPS only.