PCNSA Practice Test 14 — 15 Questions

Question 1

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's CA certificate is not installed in the trusted root store on user endpoints.. SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Answer

The decryption policy uses 'No Decrypt' for the internal application's URL category.

Answer

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

Answer

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Question 2

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Define separate security zones for Engineering and Finance.. Option B is correct because defining separate security zones for Engineering and Finance is the foundational step for segmenting internal traffic; zones are the logical containers that security rules reference, so distinct zones allow you to control and inspect traffic flowing between the two departments. Option E is correct because, once inter-zone rules exist between the Engineering and Finance zones, attaching Threat Prevention profiles (which bundle Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering) to those rules enforces the required threat inspection on that east-west traffic. Option A is incorrect because NAT policies only translate addresses for routing or hiding purposes and do not segment traffic or apply threat prevention. Option C is incorrect because a single security zone for all internal traffic collapses the segmentation boundary, preventing distinct inter-zone policy enforcement. Option D is incorrect because QoS policies manage bandwidth and prioritization, not segmentation or threat prevention.

Answer

Configure NAT policies to translate internal addresses.

Answer

Create a single security zone for all internal traffic.

Answer

Enable QoS policies between the zones.

Question 3

During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?

Accepted Answer

Create an Application Override rule for FTP on the required source and destination addresses.. The most effective method is to create an Application Override rule for FTP, which forces App-ID to identify traffic as FTP based on source/destination addresses, regardless of port. Option A is wrong because updating databases does not change detection on non-standard ports; App-ID relies on port-based signatures unless overridden. Option B is wrong because disabling App-ID removes all application inspection. Option C is wrong because adding a non-standard port to the FTP service definition does not automatically enable App-ID identification; service definitions are used for policy enforcement, not for application identification. Option D is correct because an Application Override rule explicitly tells the firewall to treat traffic that matches the source and destination addresses as the specified application, bypassing port-based detection.

Answer

Update the App-ID and threat databases to the latest version.

Answer

Set the security policy to 'allow' without App-ID to ensure FTP works.

Answer

Add the non-standard port to the FTP service definition.

Question 4

A company wants to block file uploads of PDFs to the internet via HTTP. Which Content-ID profile should be configured?

Accepted Answer

File Blocking Profile. The File Blocking Profile is specifically designed to block file transfers based on file type, such as PDF, over protocols like HTTP. This profile uses Content-ID to inspect the file content and enforce blocking policies for uploads or downloads, making it the appropriate choice to prevent PDF uploads to the internet.

Answer

Vulnerability Protection Profile

Answer

URL Filtering Profile

Answer

Virus Profile

Question 5

A security architect is planning a deployment for a multi-tenant data center where each tenant requires isolated security policies and separate administrators. Which Palo Alto Networks architecture best meets these requirements?

Accepted Answer

Deploy a single firewall with multiple virtual systems (vsys).. Virtual systems (vsys) allow a single Palo Alto Networks firewall to be partitioned into multiple logical firewalls, each with its own independent security policies, administrators, and virtual routers. This provides complete tenant isolation and separate administrative domains without requiring additional physical hardware, making it the ideal architecture for a multi-tenant data center.

Answer

Deploy a single firewall with multiple virtual routers and separate zone definitions.

Answer

Use a single firewall with a single management profile and role-based access control.

Answer

Deploy multiple physical firewalls, one per tenant.

Question 6

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Accepted Answer

Use an FQDN object in the address group; the firewall resolves it automatically. Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Answer

Use a region object instead

Answer

Create a dynamic address group with a tag-based filter

Answer

Manually add all possible IP addresses to an address group

Question 7

What does a 'shadowed' rule mean in the context of policy evaluation?

Accepted Answer

A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.. A shadowed rule is one that is never evaluated because a previous rule with the same or broader match already matches the traffic. This occurs when a rule is redundant due to an earlier rule covering the same or a superset of conditions. Option B is incorrect because a rule at the bottom is still evaluated if no earlier rule matches. Option C is incorrect because a disabled rule is not the same as a shadowed rule. Option D is incorrect because a rule without an action would still be evaluated but would likely result in an error or default action, not shadowing.

Answer

A rule that is never hit because it is at the bottom of the rulebase.

Answer

A rule that is disabled.

Answer

A rule that matches traffic but has no action configured.

Question 8

Which THREE actions can a Security policy rule perform on traffic?

Accepted Answer

Drop. A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Answer

Reset

Answer

Block

Question 9

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

Accepted Answer

Data Filtering Profile. Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Answer

URL Filtering Profile

Answer

Application Override

Answer

File Blocking Profile

Question 10

A company uses Active Directory for user authentication. They want to enforce security policies based on user identity. What is the required first step to enable User-ID on the Palo Alto Networks firewall?

Accepted Answer

Configure a server monitoring profile to connect to the domain controller.. To enable User-ID, the firewall must learn user-to-IP mappings from a directory source. The first required step is configuring a server monitoring profile (LDAP or Kerberos) that connects to the domain controller so the firewall can query security event logs and map users to IP addresses. Without this monitoring connection, no User-ID data exists to enforce policy.

Answer

Add an LDAP server profile to authenticate users.

Answer

Deploy GlobalProtect agents on all endpoints.

Answer

Enable captive portal on the internal zone.

Question 11

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Accepted Answer

Set the firewall priority to determine the active role.. In an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Answer

Assign the same IP address to both firewalls for the data interface.

Answer

Sync the running configuration to the passive firewall.

Question 12

An administrator needs to access the firewall's CLI via SSH, but the default SSH port (22) is blocked by the corporate firewall. Which configuration allows SSH on a non-standard port?

Accepted Answer

Device > Setup > Management > Port for SSH. The firewall's SSH port is configured under Device > Setup > Management > Port for SSH. This setting allows the administrator to change the default TCP port 22 to any non-standard port, enabling SSH access when the corporate firewall blocks the default port. The management interface settings control all inbound management protocols, including SSH, HTTPS, and ping.

Answer

Device > Setup > Services > SSH Port

Answer

Device > Setup > Management > Port for HTTP/HTTPS

Answer

Device > Administration > SSH Port

Answer

Device > Setup > Operations > SSH

Question 13

Which TWO statements are true regarding App-ID and Content-ID? (Choose two.)

Accepted Answer

Content-ID provides capabilities such as File Blocking, Data Filtering, and URL Filtering.. Option A is correct because Content-ID is the Palo Alto Networks security subscription service that delivers threat prevention and content inspection capabilities, including File Blocking, Data Filtering, and URL Filtering, which examine the payload and content of allowed traffic. Option B is correct because App-ID classifies traffic by identifying the application based on its unique characteristics and behavior, not merely on TCP/UDP port or protocol, so it can recognize applications even when they run on non-standard ports or tunnel over other protocols. Option C is incorrect because Content-ID inspects many traffic types beyond web (HTTP/HTTPS), such as SMTP, FTP, SMB, and other application streams, not only web traffic. Option D is incorrect because App-ID can identify many encrypted applications through heuristics, TLS metadata, and certificate information without full SSL decryption, though decryption is needed for deeper inspection. Option E is incorrect because Content-ID depends on App-ID to first identify and classify the application so the appropriate content and threat profiles can be applied; without App-ID, Content-ID scanning is not properly contextualized or enforced.

Answer

Content-ID only works for web traffic.

Answer

App-ID requires SSL decryption to identify encrypted applications.

Answer

Content-ID can function without App-ID enabled.

Question 14

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

Accepted Answer

Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).. It implements a least-privilege security model using Palo Alto Networks zones and granular application- and port-based rules. By creating separate zones (Web, App, DB) and explicitly allowing only the necessary protocols (e.g., HTTP/HTTPS from the internet to Web, specific ports from Web to App, and specific ports from App to DB), the firewall enforces strict segmentation and minimizes the attack surface. This design leverages the zone-based security paradigm of PAN-OS to control inter-zone traffic precisely, aligning with the principle of zero trust.

Answer

Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.

Answer

Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.

Answer

Place all servers in the same zone and use rules to allow traffic between them.

Question 15

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Accepted Answer

A root CA certificate installed in the trusted root store on client devices.. Option A is correct because SSL forward proxy decryption works by having the firewall/proxy re-sign the destination server's certificate with its own CA; clients must trust that CA, so the root CA certificate must be installed in the trusted root store on client devices. Option D is correct because a decryption policy rule is what actually matches the outbound traffic (by source, destination, URL category, service, etc.) and instructs the proxy to decrypt it rather than bypass it. Option E is correct because a decryption profile defines the forward proxy certificate (the CA certificate and key) used to generate the impersonated server certificates and enforces related SSL settings. Option B is not required because the proxy does not need the destination servers' private keys; it establishes its own separate TLS sessions with the client and the server. Option C is not required because the proxy obtains the destination server's certificate dynamically during the handshake and generates a substitute certificate signed by its own CA, rather than needing a pre-provisioned copy of each server certificate.

Answer

The private key of each destination server.

Answer

The server certificate for each destination server.