PCNSA Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom application that matches TCP port 8080 and add it to rule1.. The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.

Answer

Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.

Answer

Remove the service restriction from rule1.

Answer

Change the application in rule1 to 'any' to match all applications.

Question 2

A company uses Panorama to manage multiple firewalls. After pushing a template change, one firewall fails to commit with error 'invalid certificate path'. What is the most likely cause?

Accepted Answer

The template includes a certificate that has no trusted root on that firewall. When a template push includes a certificate (e.g., for SSL decryption or authentication) that references a Certificate Authority (CA) not trusted by the target firewall, the commit fails with 'invalid certificate path'. The firewall cannot validate the certificate chain because the root or intermediate CA certificate is missing from its trusted store, causing the commit to abort.

Answer

The firewall's management IP changed

Answer

Template commit requires reconnection

Answer

The firewall's certificate has expired

Answer

Panorama's certificate is mismatched

Question 3

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Accepted Answer

Set the firewall priority to determine the active role.. In an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Answer

Assign the same IP address to both firewalls for the data interface.

Answer

Sync the running configuration to the passive firewall.

Question 4

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

Accepted Answer

The service group should not include service-https. The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Answer

The application web-browsing should not be in the rule

Answer

The rule action should be deny

Answer

The source IP should be an address group

Question 5

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. The application uses a proprietary protocol on TCP port 8080. What is the most efficient way to ensure correct identification without disabling App-ID?

Accepted Answer

Create a custom App-ID signature for the proprietary protocol.. Creating a custom App-ID signature allows the firewall to correctly identify the proprietary protocol by its unique traffic patterns, such as packet payload signatures or behavioral characteristics, without disabling App-ID. This is the most efficient method as it leverages App-ID's existing classification engine to distinguish the custom application from web-browsing, even though it uses TCP port 8080.

Answer

Use Application Override with the custom application and specify port 8080.

Answer

Disable App-ID for that security rule to allow all traffic on port 8080.

Answer

Create a custom service object for TCP 8080 and add it to a security policy.

Question 6

What is the purpose of the 'Telemetry' feature in PAN-OS?

Accepted Answer

To send anonymous device health and usage data to Palo Alto Networks. The Telemetry feature in PAN-OS sends anonymous device health and usage data to Palo Alto Networks to help improve product development and threat detection. This data includes information such as system resource utilization, feature usage statistics, and aggregate threat information, but does not include sensitive or personally identifiable information. It is an opt-in feature that enhances Palo Alto Networks' ability to provide proactive support and security updates.

Answer

To send logs to Panorama

Answer

To enable DNS proxy

Answer

To configure User-ID agent

Question 7

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Use zone-based policies instead of IP-based policies whenever possible.. Zone-based policies reduce complexity and improve scalability by grouping interfaces into security zones, allowing policies to be applied based on traffic direction (e.g., from Trust to Untrust) rather than individual IP addresses. This aligns with Palo Alto Networks' best practice of using zones to simplify rule management and enhance security posture, as IP-based policies become unmanageable in dynamic environments.

Answer

Enable logging on all rules to ensure complete audit trails.

Answer

Sort rules alphabetically by name to simplify rulebase navigation.

Answer

Use service objects based on TCP/UDP ports to define application traffic.

Question 8

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. The internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.

Question 9

An administrator needs to quickly back up the device configuration to facilitate restoration after a hardware failure. Which method ensures the most reliable restoration?

Accepted Answer

Use the CLI command 'save named-config-snapshot' and store the file externally. The 'save named-config-snapshot' command creates a complete, versioned snapshot of the device's configuration that can be stored externally and restored independently of the running or startup configuration. This method ensures the most reliable restoration after hardware failure because the snapshot file is a self-contained backup that includes all configuration elements, unlike a simple running-config export which may miss dynamic or runtime-only settings.

Answer

Export the running configuration to a USB drive

Answer

Save the running configuration via CLI

Answer

Generate a tech support file

Question 10

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

Accepted Answer

Create rules with the most specific conditions first. Best practice is to create security policy rules with the most specific conditions first. This ensures that specific traffic is matched before more general rules, reducing the risk of unintended matches. Option A is incorrect because using 'any' for source and destination zones is not a best practice; it should be avoided to maintain granularity. Option C is incorrect because mixing inbound and outbound rules in the same rulebase section can lead to confusion and is not recommended; rules should be grouped logically. Option D is incorrect because specific rules should be placed above general rules, not the other way around.

Answer

Use 'any' for source and destination zones to save time

Answer

Mix inbound and outbound rules in the same rulebase section

Answer

Place general rules above specific rules

Question 11

A security team wants to inspect traffic to and from a critical application server. They configure an inbound decryption rule to decrypt traffic destined to the server's IP address. After deploying, they find that traffic is not being decrypted. What is the first step to troubleshoot?

Accepted Answer

Check the decryption policy rule order and ensure it is before any no-decrypt rules.. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If a 'no-decrypt' rule appears before the inbound decryption rule, traffic matching the server's IP will be handled by the no-decrypt rule and will not be decrypted. Therefore, verifying rule order is the first troubleshooting step.

Answer

Confirm that the decryption profile is set to 'decrypt' and that the forward proxy option is enabled.

Answer

Verify that the server's certificate is installed on the firewall.

Answer

Ensure that the firewall has a valid certificate for inbound inspection.

Question 12

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Accepted Answer

Pattern matching (signatures). App-ID uses pattern matching (signatures) to identify applications by analyzing the unique byte sequences or payload patterns within network traffic. These signatures are derived from the application's protocol behavior and can detect applications even when they use non-standard ports or encryption.

Answer

URL filtering

Answer

Source port number

Answer

Source IP address

Question 13

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Accepted Answer

Apply the log forwarding profile to a security policy rule.. A log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Answer

Set the syslog server to use TCP port 514.

Answer

Specify the syslog facility code in the log forwarding profile.

Question 14

A firewall is configured with multiple Virtual Systems (vsys). An admin wants to assign a custom admin role that can manage only specific vsys. Which role type supports this?

Accepted Answer

Virtual System Admin. The Virtual System Admin role is specifically designed to grant administrative access to one or more Virtual Systems (vsys) within a Palo Alto Networks firewall. This role type allows the admin to manage only the assigned vsys, with no visibility or control over other vsys or the shared firewall configuration, which directly matches the requirement in the question.

Answer

Panorama Admin

Answer

Read Only Admin

Answer

Superadmin

Answer

Device Admin

Question 15

Which THREE are valid methods to test security policy effectiveness before deployment?

Accepted Answer

Check rule hit counts after applying the policy to a small subset of users.. A, D, and E are correct. Rule hit counts after applying the policy to a subset of users (A) provides real-world feedback. Deploying the policy in a lab environment and reviewing traffic logs (D) allows controlled testing. The Policy Tester tool (E) simulates traffic to validate policy behavior. B is wrong because disabling the policy does not test effectiveness; it simply removes enforcement. C is wrong because packet capture is a troubleshooting tool, not a method to test policy effectiveness before deployment.

Answer

Disable the policy and monitor traffic.

Answer

Use packet capture (PCAP) to analyze traffic.