PCNSA Practice Test 13 — 15 Questions

Question 1

A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.. The core issue is that inbound decryption is incorrectly applied to traffic from internal clients to the internal server, causing double decryption when the server subsequently initiates outbound connections. By ensuring the inbound decryption rule only applies to traffic from external sources (i.e., source zone is untrust), internal-to-internal traffic bypasses inbound decryption, eliminating the double-decryption loop. This aligns with best practices where inbound decryption is scoped to traffic originating outside the network.

Answer

Create a decryption exclusion rule for traffic between internal clients and the internal server.

Answer

Disable outbound decryption for the subnet of the internal server.

Answer

Use a no-decrypt rule for traffic from the internal server's IP to the internet.

Question 2

Which two authentication methods can be used for administrative access to the firewall's web interface? (Choose two.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is correct because it enables single sign-on (SSO) for administrative access to the firewall's web interface, allowing integration with external identity providers (IdPs) such as Okta or Azure AD. The local database is correct because it is the default authentication method, where administrators are created and stored locally on the firewall, and credentials are verified against the internal user database. Both methods are natively supported in PAN-OS for web interface (GUI) access.

Answer

NTLM

Answer

OAuth

Answer

Kerberos

Question 3

Refer to the exhibit. An administrator sees this output and notices that App-ID is not identifying applications. What is the most likely cause?

Accepted Answer

The application database is not yet loaded.. The output shows that App-ID is not identifying applications, which typically occurs when the application database has not finished loading after a reboot or initial startup. During this period, the firewall cannot perform application-based classification, so all traffic is treated as unknown until the database is fully loaded. This is a known behavior in PAN-OS, where the application database loads asynchronously after the system boots.

Answer

The security rules are misconfigured.

Answer

The firewall needs a license for App-ID.

Answer

App-ID is disabled.

Question 4

A medium-sized enterprise has deployed a Palo Alto Networks firewall in a branch office. They use App-ID to control access to cloud applications. Recently, they migrated from on-premises Exchange to Office 365. They have a security rule that allows 'office365-base' for all users. However, users report that they cannot access their Office 365 email via Outlook client, although web access works fine. The firewall logs show that the traffic is being allowed as 'office365-base' but no other Office 365 sub-applications are seen. The IT team suspects that App-ID is not fully identifying the Outlook client traffic. What should they do to resolve this issue?

Accepted Answer

Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.. The 'office365-base' App-ID only provides basic identification for Office 365 traffic, but Outlook client traffic requires more specific sub-applications like 'office365-outlook' and 'office365-exchange' to be explicitly allowed in the security rule. Without these sub-applications, the firewall may allow the traffic as 'office365-base' but fail to fully identify and permit the Outlook client's proprietary protocols, such as MAPI over HTTP or RPC over HTTPS, which are necessary for email functionality.

Answer

Enable SSL decryption to allow App-ID to identify the Outlook traffic.

Answer

Create a new rule that allows 'outlook' application specifically.

Answer

Change the rule to allow 'office365-base' and set Action to 'allow' with a QoS policy.

Question 5

A mid-sized enterprise has deployed a Palo Alto Networks firewall with SSL Forward Proxy decryption for outbound traffic. The firewall uses a CA-signed certificate from a public CA, and the certificate is installed on all corporate-managed endpoints. Recently, the security team noticed that a few users are unable to access a specific external SaaS application (app.example.com) over HTTPS. Other users can access it without issues. The firewall logs show that for these users, the session is being decrypted and no threat is detected. The application uses a valid certificate from a public CA. The affected users are in the same IP subnet and use the same browser version. Which is the most likely cause?

Accepted Answer

The firewall's CA certificate is not installed or trusted on the affected users' endpoints.. SSL Forward Proxy decryption requires the firewall to generate a new certificate on-the-fly for the destination server, signed by the firewall's own CA certificate. If the CA certificate is not trusted on the affected users' endpoints, the browser will display a certificate warning or block the connection entirely, even though the decryption policy is applied and no threats are detected. Since other users in the same subnet can access the application, the issue is isolated to the trust store on the affected machines, not the network or decryption policy.

Answer

The decryption policy is set to 'No Decrypt' for the affected users' source IP range.

Answer

The firewall is performing SSH proxy instead of SSL decryption for those users.

Answer

The SaaS application's certificate has expired for those users due to time zone differences.

Question 6

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

Accepted Answer

Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.. Dynamic address groups with tag-based or name-based filters automatically include all matching objects, eliminating manual updates when new sites are added. By using a filter like 'Site-*-Networks', the group dynamically incorporates any address group whose name matches the pattern, reducing administrative overhead. This approach aligns with the PCNSA objective of using dynamic objects to simplify policy management in a scalable environment.

Answer

Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.

Answer

Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.

Answer

Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.

Question 7

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

Accepted Answer

Install multiple User-ID agents in a redundancy group, each serving multiple sites.. Deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Answer

Install a single centralized User-ID agent that polls all domain controllers across sites.

Answer

Use the built-in User-ID agent on each firewall and point it to local domain controllers.

Answer

Install one User-ID agent at each site, each configured to communicate only with the local firewall.

Question 8

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.. In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry. The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Answer

OSPF is flapping and causing route instability.

Answer

A DDoS attack is overwhelming the management plane.

Answer

The firewall's licenses have expired, causing feature degradation.

Question 9

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

Accepted Answer

The vsys2 is not included in the device group on Panorama.. Panorama pushes configuration to firewalls based on device group membership. If vsys2 is not included in the device group assigned to the firewall, Panorama will not push the updated configuration to that virtual system, even if the firewall itself is reachable and other vsys are updated. The administrator verified the template stack assignment, but the device group inclusion is a separate prerequisite for configuration delivery.

Answer

The commit on Panorama failed for vsys2 due to a validation error.

Answer

The admin user does not have sufficient privileges to push configuration to vsys2.

Answer

The firewall's serial number is not registered correctly in Panorama for vsys2.

Question 10

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Accepted Answer

The rule is positioned below an allow rule that matches the same traffic.. The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

Answer

The source IP is negated in the rule.

Answer

The rule is placed at the top of the rulebase and overridden by a later rule.

Answer

The rule is disabled in the rulebase.

Question 11

Which TWO of the following are true about App-ID? (Choose two.)

Accepted Answer

App-ID identifies applications regardless of port.. App-ID is designed to identify applications based on their unique traffic behavior, not just port numbers. By using signatures, protocol decoding, and behavioral analysis, App-ID can accurately detect applications even when they are running on non-standard ports, such as SSH on TCP 2222 or HTTP on TCP 8080. This decoupling from port-based identification is a core strength of the Palo Alto Networks next-generation firewall.

Answer

App-ID cannot identify custom applications.

Answer

App-ID can only identify applications on standard ports.

Question 12

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Accepted Answer

Use an FQDN object in the address group; the firewall resolves it automatically. Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Answer

Use a region object instead

Answer

Create a dynamic address group with a tag-based filter

Answer

Manually add all possible IP addresses to an address group

Question 13

A company runs a pair of PA-5250 firewalls in active/passive HA controlling the production data center (10 Gbps traffic). The security team needs to upgrade from PAN-OS 10.0 to 10.2 to fix several critical CVEs. The team has a maintenance window of four hours. The lead engineer suggests performing the upgrade in the following order: 1. Download and install the upgrade on the passive firewall, 2. Commit after install, 3. Perform a non-disruptive failover to make the passive active, 4. Upgrade the new passive (former active), 5. Fail back to the original active. A junior engineer points out that the passive firewall takes 30 minutes to boot and join the HA pair after upgrade. The maintenance window is only four hours. What should the team do to ensure the upgrade completes within the window?

Accepted Answer

Pre-stage the software download on both firewalls before the maintenance window begins.. Pre-staging the software download on both firewalls before the maintenance window eliminates the time required for the download step, which can be significant over a WAN or slow management connection. This allows the team to focus the four-hour window solely on the installation, reboot, and HA synchronization steps, which are the time-critical components. Since the passive firewall takes 30 minutes to boot and join the HA pair, pre-staging ensures the download (which could take 30–60 minutes or more) does not consume valuable window time.

Answer

Upgrade both firewalls simultaneously during the window to save time.

Answer

Use the 'request high-availability sync-to-remote' command to speed up the upgrade.

Answer

Perform the upgrade as planned, but skip the final fail-back to save 15 minutes.

Question 14

A security administrator wants to block users from accessing social media websites during business hours. The firewall is connected to the internet and has a Security policy that allows general web browsing. What is the most efficient way to block social media?

Accepted Answer

Create a new Security policy rule with a URL Filtering profile that blocks the social-media category.. URL Filtering profiles are specifically designed to block entire categories of websites (like social media) based on URL categorization, which is the most efficient method for blocking access to social media sites. This approach leverages Palo Alto Networks' URL Filtering database, which categorizes millions of URLs, allowing the administrator to block the entire 'social-media' category with a single policy rule without needing to identify individual applications or destinations.

Answer

Create a new Security policy rule with an Application ID that blocks social-media applications.

Answer

Add a Custom Signature to the existing rule to block social media traffic.

Answer

Modify the existing web browsing rule to deny social media destinations.

Question 15

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Accepted Answer

Enable local authentication and configure RADIUS as the primary authentication method with local fallback.. It allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Answer

Create local accounts for all engineers and sync with AD manually.

Answer

Use Kerberos authentication only.

Answer

Configure only RADIUS authentication and disable local authentication.