PCNSA Practice Test 15 — 15 Questions

Question 1

Which TWO logs are most useful for troubleshooting SSL decryption issues? (Select exactly two.)

Accepted Answer

System log. The System log (B) records decryption-related events, such as certificate validation failures, handshake errors, and unsupported cipher suites, which are critical for diagnosing SSL decryption issues. The Traffic log (D) shows whether traffic was decrypted or bypassed, including the 'Decrypted' flag and details about the SSL/TLS handshake, allowing you to verify decryption policy application.

Answer

GlobalProtect log

Answer

Threat log

Answer

URL Filtering log

Question 2

A user reports that they are unable to download executable files from the internet. The firewall security rule allows the application. What should the administrator check first?

Accepted Answer

The file blocking profile for the rule.. The user cannot download executable files, which is a specific file type. The file blocking profile is the Content-ID feature that controls file transfer based on type, regardless of the application being allowed. Since the security rule permits the application, the administrator should first check the file blocking profile attached to that rule to see if it blocks 'executable' files.

Answer

The SSL decryption policy.

Answer

The vulnerability protection profile.

Answer

The URL filtering category for 'executables'.

Question 3

A company uses Panorama to manage multiple firewalls. After pushing a template change, one firewall fails to commit with error 'invalid certificate path'. What is the most likely cause?

Accepted Answer

The template includes a certificate that has no trusted root on that firewall. When a template push includes a certificate (e.g., for SSL decryption or authentication) that references a Certificate Authority (CA) not trusted by the target firewall, the commit fails with 'invalid certificate path'. The firewall cannot validate the certificate chain because the root or intermediate CA certificate is missing from its trusted store, causing the commit to abort.

Answer

The firewall's management IP changed

Answer

Template commit requires reconnection

Answer

The firewall's certificate has expired

Answer

Panorama's certificate is mismatched

Question 4

An administrator needs to implement a policy where traffic from the 'Sales' zone to the 'Finance' zone is allowed only for the 'ms-office365' application, but traffic from 'Sales' to 'Finance' using any other application must be denied. Which rule design meets this requirement efficiently?

Accepted Answer

Create a rule that allows ms-office365 from Sales to Finance, and place a deny all rule after it.. In Palo Alto firewalls, security rules are either allow or deny, not both. To allow only 'ms-office365' and deny all other traffic from Sales to Finance, you create an allow rule for that application, followed by a deny-all rule for the same source/destination. This ensures efficiency by allowing the specific traffic first, then blocking everything else. Option A is incorrect as it uses a deny-all first, then tries to allow with an application default deny, which is not a valid concept and would require an explicit allow rule. Option B is incorrect because allowing all traffic and then denying the specific application defeats the purpose. Option D is invalid because a single rule cannot contain both allow and deny actions.

Answer

Create a rule that denies all traffic from Sales to Finance, and then an application default deny rule that allows ms-office365.

Answer

Create a rule that allows all traffic from Sales to Finance, then a rule that denies ms-office365.

Answer

Create one rule that allows ms-office365 and denies all other traffic from Sales to Finance.

Question 5

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Accepted Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.. The best approach is to use User-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule. This ensures that the deny rule is evaluated first, blocking social media for HR while allowing all other traffic. User-ID enables user-specific policies, and rule order is critical in Palo Alto Networks firewalls.

Answer

Create an allow rule for all users, then a deny rule for HR with application social-media.

Answer

Create a deny rule for the HR user group with application social-media before the allow rule.

Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.

Question 6

A small business has a Palo Alto Networks firewall with a single security policy rule that allows all traffic from the 'Trust' zone to the 'Untrust' zone. The business recently experienced a malware infection originating from an internal host that communicated with known malicious IP addresses. The administrator wants to implement a security policy to block traffic to these malicious IP destinations. The administrator has a list of 500 malicious IP addresses that may change frequently. What is the most efficient way to create a policy to block traffic to these IPs?

Accepted Answer

Create an External Dynamic List (EDL) of the malicious IPs and reference it in a security rule as destination address, with action deny, placed above the allow rule.. An External Dynamic List (EDL) is the most efficient way to block a frequently changing list of 500 malicious IPs because the firewall automatically pulls updates from an external source (e.g., a text file on a web server), eliminating manual updates. The EDL is referenced as a destination address in a deny rule placed above the allow rule.

Answer

Create a security rule with an address group containing the 500 IPs as destination, action deny, placed above the allow rule.

Answer

Create a security rule with source zone Trust, destination zone Untrust, source address list containing the 500 IPs, action deny.

Answer

Create a security rule with source zone Trust, destination zone Untrust, destination address list containing the 500 IPs as separate address objects, action deny, placed above the allow rule.

Question 7

A firewall uses an external SMTP server for email alerts. The SMTP server is reachable via a specific virtual router and interface. What must be configured to ensure the firewall uses the correct path to reach the SMTP server?

Accepted Answer

Configure a service route for SMTP.. Service routes in Palo Alto Networks firewalls explicitly define the source interface and virtual router used for outbound management traffic, such as SMTP email alerts. By configuring a service route for SMTP, the firewall ensures that email alerts are sent via the specified virtual router and interface, overriding the default management plane routing behavior.

Answer

Ensure the SMTP server is in the same zone as the management interface.

Answer

Configure an SNMP trap destination.

Answer

Add a static route for the SMTP server.

Question 8

Which THREE Content-ID components typically require a separate license or subscription?

Accepted Answer

SSL Decryption. SSL Decryption (A) is correct because decrypting TLS/SSL traffic on Palo Alto Networks firewalls requires a dedicated SSL Forward Proxy/Inbound Inspection license to enable the decryption policy and certificate management features. WildFire (C) is correct because WildFire cloud sandboxing and its associated threat intelligence subscriptions are sold as a separate license from the base Content-ID bundle. URL Filtering with PAN-DB (D) is correct because the PAN-DB URL filtering database subscription is licensed separately and is not included in the base Content-ID package. File Blocking (B) is not correct because it is a standard Content-ID feature included with the base subscription, and Data Filtering (E) is not correct because it is included with the URL Filtering (PAN-DB) subscription rather than requiring its own separate subscription.

Answer

File Blocking

Answer

Data Filtering

Question 9

Based on the exhibit, what is the most likely cause if the firewall is dropping new connections but existing sessions continue to work?

Accepted Answer

The firewall has reached its session limit.. When a Palo Alto Networks firewall reaches its maximum session capacity (defined by the platform model and license), it will drop new connection attempts while maintaining existing sessions that are already in the session table. This behavior is by design to preserve established traffic. The session limit is a hard resource constraint, not a performance degradation, so existing flows continue uninterrupted until they age out or are terminated.

Answer

The management interface IP (192.168.1.1) is conflicting with another device.

Answer

The firewall is low on CPU memory.

Answer

The software version 10.1.3 is buggy.

Question 10

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Accepted Answer

Inbound Inspection Decryption. Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Answer

Decryption Mirror

Answer

Outbound (Forward Proxy) Decryption

Answer

SSH Proxy

Question 11

A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?

Accepted Answer

The firewall's decryption certificate is not signed by the installed root CA.. In forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.

Answer

The decryption profile is set to block sessions with untrusted certificates.

Answer

The firewall is performing inbound inspection instead of forward proxy.

Answer

No decryption profile is attached to the decryption rule.

Question 12

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. In Palo Alto Networks security rules, the Log at Session Start option generates a log entry when the session is first established, which satisfies the requirement to log only when a session is established. This captures the connection initiation without logging at session end.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 13

An organization has multiple virtual routers on a single firewall. Traffic between two virtual routers must be inspected by security policies. How should this be configured?

Accepted Answer

Place each virtual router's interfaces into different zones, then create inter-zone security rules.. Inter-zone security rules are required to enforce security policies on traffic between different virtual routers. Each virtual router's interfaces must be assigned to distinct zones, and inter-zone rules inspect traffic crossing from one zone to another, ensuring the firewall applies security controls (e.g., App-ID, User-ID) to the traffic between the virtual routers.

Answer

Configure static routes between the virtual routers.

Answer

Enable inter-virtual router routing under the global settings.

Answer

Apply security policies that match the virtual router as a source or destination.

Question 14

Which THREE log types can be forwarded to a syslog server?

Accepted Answer

Threat logs. B is correct because threat logs capture security-related events such as intrusion attempts, malware detection, and vulnerability exploits, which are critical for security monitoring. The Palo Alto Networks firewall can forward these logs to a syslog server (e.g., using UDP 514 or TCP 6514) for centralized analysis and alerting. This is a standard feature in PAN-OS for integrating with SIEM systems.

Answer

Packet capture logs

Answer

Configuration logs

Question 15

An administrator is troubleshooting why an application is being identified as 'incomplete' in the traffic log. What does this indicate?

Accepted Answer

The session was terminated before App-ID could complete.. When App-ID cannot complete its analysis before the session terminates, the traffic log marks the application as 'incomplete'. This typically happens with short-lived sessions or when the firewall receives insufficient data packets to match a signature or decode the protocol. The correct answer is B because App-ID requires multiple packets or a full handshake to definitively identify the application.

Answer

The application is using a non-standard port.

Answer

The firewall could not determine the application.

Answer

The application is unknown to the firewall.