PCNSA Practice Test 15 — 15 Questions

Question 1

Which TWO factors affect the order in which security rules are evaluated?

Accepted Answer

Whether the rule is intra-zone or inter-zone.. Correct: C and D. Security rules are evaluated in a specific order: first, intra-zone rules are evaluated separately from inter-zone rules, and within each zone type, rules are evaluated from top to bottom based on their position in the rulebase. Therefore, both the rule's zone type (intra-zone vs inter-zone) and its position (top-down) affect evaluation order. A is incorrect because the application does not determine evaluation order; it is a match criterion. B is incorrect because rule hit count is a statistic, not a factor in ordering. E is incorrect because the action (allow or deny) does not affect the order of evaluation.

Answer

Application used in the rule.

Answer

Rule hit count.

Answer

Rule action (allow or deny).

Question 2

A company has deployed PA-220 firewalls at 50 branch offices, each connected to the corporate headquarters via IPSec VPN tunnels. Recently, users have reported slow file transfers across the VPN, especially for large files. The network team has checked link utilization and found that the VPN tunnel bandwidth is under 20% utilized, and CPU on the firewalls is around 40%. The security policies are basic, with no threat prevention profiles applied to the VPN traffic. The team suspects the issue is related to VPN performance. After reviewing the configuration, they notice that the VPN tunnels are configured with default settings. Which of the following actions would most likely improve VPN throughput without requiring hardware upgrades or changing the security level?

Accepted Answer

Enable hardware acceleration for the VPN tunnel on the branch firewalls.. The PA-220 firewall includes hardware acceleration for IPsec VPN processing, but this feature is not enabled by default. Enabling hardware acceleration offloads cryptographic operations to dedicated hardware, significantly improving throughput for large file transfers without requiring hardware upgrades or reducing security. Since the VPN tunnel bandwidth is underutilized and CPU is moderate, the bottleneck is likely software-based encryption, which hardware acceleration directly addresses.

Answer

Upgrade the branch office firewalls to PA-800 series appliances.

Answer

Change the VPN IPSec cipher suite to use AES-256-GCM for stronger encryption.

Answer

Increase the MTU on the VPN tunnel interface to 1500 bytes to reduce fragmentation.

Question 3

A firewall is configured to send logs to an external syslog server. Some logs are missing, but other logs are arriving. Which step should be taken to troubleshoot this issue?

Accepted Answer

Verify the log forwarding profile to ensure the missing log types are included.. The most common reason for missing logs when others arrive is that the log forwarding profile on the firewall does not include the specific log types (e.g., traffic, threat, system) that are missing. The firewall sends logs based on the configured forwarding profile, and if a log type is not selected in the profile, it will not be forwarded to the external syslog server. Verifying the profile ensures that the missing log types are enabled for forwarding.

Answer

Restart the syslog server to clear any buffer issues.

Answer

Enable packet capture on the firewall to verify the logs are sent.

Answer

Disable logging on the firewall to reset the log queue.

Question 4

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

Accepted Answer

The FTP application requires additional configuration for passive mode. FTP uses two separate channels: a control channel (TCP 21) and a data channel. In passive mode, the client initiates both connections, but the data channel uses a random high port negotiated via the control channel. The Palo Alto Networks firewall's application decoder for FTP must inspect the control channel to dynamically open pinholes for the data channel; without this, the data connection is blocked even if the control channel is allowed. Option D is correct because the administrator likely created a rule for application 'ftp' but did not ensure that the FTP application's passive mode data connections are properly handled, which requires the firewall to perform application-level inspection and create temporary security policy openings for the negotiated data ports.

Answer

The destination IP is not covered by a NAT policy

Answer

Logging is not enabled on the rule

Answer

The rule is set to deny instead of allow

Question 5

A network administrator needs to ensure that firewall-generated traffic (e.g., NTP queries, DNS lookups, Panorama communications) uses a specific source IP address from a loopback interface. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a service route configuration for each service type.. Service routes allow you to specify which source IP address the firewall uses for traffic it generates itself, such as NTP, DNS, and Panorama communications. Option C is correct because the actual configuration is performed under Device > Setup > Services > Service Route Configuration, where you can assign a specific source IP (e.g., from a loopback interface) for each service type. This ensures that firewall-originated traffic uses a consistent, routable source address independent of the egress interface.

Answer

Define a static route on the firewall directing traffic to the loopback.

Answer

Configure the management interface IP as the source for all services.

Answer

Enable 'Use Loopback as Source' under Network > Interfaces > Loopback.

Question 6

An administrator upgrades a firewall from PAN-OS 9.1 to 10.0, but a subsequent commit fails. Which log should the administrator examine first to find the cause of the failure?

Accepted Answer

Config log. The config log records all configuration changes and commit attempts. When a commit fails after an upgrade, the config log provides details about configuration validation errors, dependency issues, or incompatible settings that caused the failure. Therefore, the administrator should examine the config log first to identify the root cause.

Answer

System log

Answer

Traffic log

Answer

Threat log

Question 7

A network administrator is configuring a new security policy to allow specific inbound traffic to a web server. The policy must be as specific as possible to minimize risk. Which configuration approach is correct?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, and service application-default.. Using 'service application-default' restricts traffic to the default port for the application identified by App-ID, providing both application and port specificity. This approach minimizes risk by ensuring only the intended application's default port is allowed. Options B and D use broad port-based services that permit any application on that port, increasing risk. Option C uses App-ID but only for web-browsing (HTTP), omitting ssl for HTTPS, thus blocking secure web traffic—a critical oversight for a web server serving HTTPS.

Answer

Create a security policy with source any, destination DMZ, and service http.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, and application web-browsing.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, and service http.

Question 8

A company requires automatic daily backups of the firewall configuration. Which method should be used?

Accepted Answer

Schedule a configuration backup under Device > Setup > Operations. The PAN-OS web interface provides a built-in scheduler under Device > Setup > Operations that allows administrators to automate daily configuration backups without external scripts or manual intervention. This method is the simplest and most reliable way to ensure consistent backups, as it leverages the firewall's native scheduling capability.

Answer

Backup the config using TFTP from the CLI

Answer

Write a script using the PAN-OS API to copy the running config

Answer

Use the 'Export Device State' feature manually

Question 9

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. The 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 10

A company wants to ensure that all internet-bound HTTP traffic is decrypted for inspection before being forwarded to the next-generation firewall for policy enforcement. Which deployment method should be used?

Accepted Answer

Explicit proxy with SSL Forward Proxy decryption. B is correct because an explicit proxy deployment requires clients to be configured to send HTTP traffic to the firewall's proxy IP, which allows the firewall to terminate the client connection, perform SSL Forward Proxy decryption using a forward trust certificate, and then re-encrypt the traffic for inspection before forwarding it to the next-generation firewall for policy enforcement. This method ensures that all internet-bound HTTP traffic is decrypted for inspection, as the firewall acts as an intermediary between the client and the destination server.

Answer

Virtual wire mode with SSL Forward Proxy

Answer

Transparent proxy with a forward trust certificate

Answer

Layer 3 mode with a policy-based forwarding rule

Question 11

An administrator wants to ensure that a specific security policy rule is applied before all other rules. What should be configured?

Accepted Answer

Move the rule to the top of the rulebase. In Palo Alto Networks firewalls, security policy rules are evaluated in a top-down order, and the first matching rule is applied. Moving a rule to the top of the rulebase ensures it is evaluated before all other rules, guaranteeing it takes precedence regardless of its priority number. Priority numbers (1-65535) are used for ordering within the rulebase, but the physical position in the list determines evaluation order; setting priority to 1 does not automatically place the rule at the top if other rules with lower numbers exist.

Answer

Set the rule's priority to 1

Answer

Use a schedule

Answer

Enable 'Optimize' on the rule

Question 12

An administrator notices that the firewall's web interface is accessible via HTTPS but shows an expired certificate warning. The firewall's management certificate was issued by an internal CA and has a validity of two years. The administrator checks the certificate and sees it expired yesterday. The administrator generates a new self-signed certificate through the firewall's GUI. After generating, the administrator assigns the new certificate to the HTTPS management interface. Despite this, the firewall still presents the old expired certificate when accessed. What is the most likely cause?

Accepted Answer

The new certificate was not committed.. In Palo Alto Networks firewalls, changes to management interface settings, including certificate assignments, require a commit operation to become active. Generating and assigning the new certificate through the GUI only stages the change; without a commit, the firewall continues to use the previously committed configuration, which still references the expired certificate. This is why the old certificate persists despite the assignment.

Answer

The firewall must be restarted for the change to take effect.

Answer

The old certificate is still bound to a different service.

Answer

The browser has cached the old certificate.

Question 13

A company has two Palo Alto Networks firewalls in active/passive HA. The passive firewall failed and was replaced with a new unit. The network administrator initiates a configuration sync from the active to the new passive. After the sync, the passive unit shows as 'Active' instead of 'Passive'. What is the most likely cause?

Accepted Answer

The active firewall's HA settings were missing the new device's serial number.. In an active/passive HA pair, the active firewall maintains a list of allowed peer serial numbers. If the new passive unit's serial number is not included in the active firewall's HA configuration, the active will not recognize the passive as a valid peer. Consequently, the passive unit, lacking a proper HA heartbeat from the active, will assume the active role (become 'Active') due to a loss of the HA link or misidentification, as it defaults to active state when it cannot establish a proper HA relationship.

Answer

The HA link is misconfigured on both units.

Answer

The passive unit's HA configuration was set to 'Stateful Inspection' instead of 'Passive'.

Answer

The passive unit had a different version of Panorama template.

Question 14

A network administrator is configuring a Palo Alto Networks firewall in a datacenter. Which TWO traffic types can be inspected by the firewall's Threat Prevention subscription? (Choose two.)

Accepted Answer

Web traffic (HTTP/HTTPS). The Threat Prevention subscription on Palo Alto Networks firewalls is designed to inspect web traffic (HTTP/HTTPS) using signatures for exploits, malware, command-and-control, and phishing, and email traffic (SMTP, POP3, IMAP) for malicious attachments, links, and spam. It does not include inspection for FTP, VoIP (SIP, H.323), or database protocols (SQL, Oracle) by default; those traffic types require other security profiles such as Application Security, Data Filtering, or specific decryption policies. Therefore, the correct answers are B and D.

Answer

FTP traffic (File Transfer Protocol)

Answer

VoIP traffic (SIP, H.323)

Answer

Database traffic (SQL, Oracle)

Question 15

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Accepted Answer

Deploy Panorama and manage all VM-Series firewalls from a single console. Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Answer

Configure each VM-Series firewall independently

Answer

Rely on cloud-native security groups instead of VM-Series

Answer

Use a single security policy applied to all firewalls via an API script