PCNSA Practice Test 16 — 15 Questions

Question 1

A company has a single Palo Alto Networks firewall protecting its internet connection. The IT team wants to allow remote employees to access internal resources using GlobalProtect. They have already configured the portal and gateway on the firewall, and users can successfully connect and obtain an IP address from the IP pool assigned to the gateway. However, remote users report that they cannot access any internal servers after connecting. The firewall has security policies that allow traffic from the GlobalProtect gateway's IP pool to the internal servers. Which additional configuration step is most likely required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a static route on the internal router pointing the GlobalProtect IP pool subnet back to the firewall's internal interface.. The remote users can connect and obtain an IP address from the GlobalProtect gateway's IP pool, but the internal servers do not have a route back to that IP pool subnet. Without a static route on the internal router pointing the GlobalProtect IP pool subnet to the firewall's internal interface, return traffic from the internal servers is sent to the default gateway (the firewall's internal interface) only if the firewall is the default gateway for those servers; if not, the traffic is dropped or misrouted. This is the most common missing step when remote users can authenticate and get an IP but cannot reach internal resources.

Answer

Increase the GlobalProtect gateway's session timeout value.

Answer

Enable NAT on the GlobalProtect gateway to translate the remote user IP to the firewall's internal interface IP.

Answer

Install a client certificate on each remote user's device for authentication.

Question 2

A company is designing a high availability deployment and wants to minimize downtime. Which two configurations are required for session failover? (Choose two.)

Accepted Answer

Ensure both firewalls have identical security policies.. Session failover requires that the passive firewall can take over active sessions without interruption. Identical security policies (Option B) ensure that the same rules apply to traffic after failover, preventing asymmetric policy drops. Session synchronization (Option C) copies session state from the active to the passive firewall, so the passive unit has the exact session table needed to continue forwarding traffic seamlessly.

Answer

Set the HA mode to active/active.

Answer

Configure the same HA firewall link IP address on both firewalls.

Answer

Enable gratuitous ARP on the passive firewall.

Question 3

An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?

Accepted Answer

Create a Security policy rule that allows traffic between the virtual routers.. Traffic between virtual routers must be explicitly permitted by a Security policy rule. Even though virtual routers provide separate routing tables, the firewall still enforces policy enforcement points; without a Security rule allowing the traffic, it will be denied by default. This ensures that inter-virtual-router traffic is inspected and controlled by the firewall's security engine.

Answer

Install a virtual wire between the virtual routers.

Answer

Add static routes for the remote subnets in each virtual router.

Answer

Configure a default route in each virtual router pointing to the other.

Question 4

After enabling password complexity on a Palo Alto firewall, an administrator is unable to access the management web interface remotely. The administrator can still access the console locally. What is the most likely cause?

Accepted Answer

The administrator's account is locked due to too many failed login attempts.. The most likely cause is account lockout due to multiple failed login attempts from remote access. When an administrator attempts to access the web interface with incorrect credentials, the firewall locks the account after a configured number of failures. However, local console access may still work if the account lockout policy does not apply to console sessions or if the console uses a different authentication mechanism. Therefore, option B is the most plausible explanation.

Answer

Password complexity automatically disables HTTPS management.

Answer

The password does not meet the new complexity requirements, causing the commit to fail and revert the management configuration.

Answer

HTTPS management is automatically disabled when password complexity is enabled.

Question 5

A company has a Palo Alto Networks firewall in production. They recently configured a new security policy rule to allow outbound HTTPS traffic from the internal network (10.0.0.0/8) to the internet. The rule is placed after a block rule that denies all traffic from 10.0.0.0/8 to any external destination. After committing, users report that HTTPS access is still blocked. The administrator checks the firewall logs and sees that the traffic is being denied by the block rule. The administrator verifies the rule order: the new allow rule is at position 5, and the block rule is at position 3. The administrator also checks that the source zone (Trust) and destination zone (Untrust) are correct. What is the most likely cause of the issue?

Accepted Answer

The allow rule is placed below the block rule, so the block rule is evaluated first.. The Palo Alto Networks firewall evaluates security policy rules in sequential order from top to bottom. Since the block rule at position 3 is evaluated before the allow rule at position 5, traffic matching the block rule is denied immediately, and the allow rule is never reached. This is the most likely cause of the issue, as the rule order directly determines which rule is applied first.

Answer

There is a NAT policy that is interfering with the allow rule.

Answer

The allow rule has an incorrect application (e.g., ssl instead of web-browsing).

Answer

The allow rule has the wrong source address (e.g., 10.0.0.0/8 is correct).

Question 6

Which THREE log types can be forwarded to a syslog server?

Accepted Answer

Threat logs. B is correct because threat logs capture security-related events such as intrusion attempts, malware detection, and vulnerability exploits, which are critical for security monitoring. The Palo Alto Networks firewall can forward these logs to a syslog server (e.g., using UDP 514 or TCP 6514) for centralized analysis and alerting. This is a standard feature in PAN-OS for integrating with SIEM systems.

Answer

Packet capture logs

Answer

Configuration logs

Question 7

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 8

Match each security zone type to its characteristic.

Accepted Answer

Trust: Network zone for internal trusted users and resources.. In Palo Alto firewalls, typical security zones include Trust (internal), Untrust (external), DMZ (public services), and Management (firewall admin). Common confusions arise from swapping Trust and Untrust or misattributing DMZ characteristics.

Answer

Trust: Zone for publicly accessible servers.

Answer

Untrust: Zone for internal trusted networks.

Question 9

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

Accepted Answer

There is an allow rule above the deny rule that matches the traffic first.. Any deny rule placed after a matching allow rule will not be evaluated if the allow rule is hit first. Rule order is critical in PAN-OS. Option A is wrong because removing the rule is not the cause. Option B is wrong because policy is not optional. Option C is wrong because implicit deny exists but only if no rule matches.

Answer

The security policy is not enabled on the firewall.

Answer

The deny rule was removed from the configuration.

Answer

The traffic is matching the implicit deny rule at the end.

Question 10

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Accepted Answer

Rule 1 (allow-web). Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Answer

Rule 3 (allow-dns)

Answer

Rule 2 (block-malware)

Answer

No rule matches; traffic is denied by default.

Question 11

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. The firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 12

Which object type is used to group multiple service objects together for use in a security policy?

Accepted Answer

Service group. A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Answer

Schedule

Answer

Tag

Answer

Address group

Question 13

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

Accepted Answer

The filter should use double quotes instead of single quotes around the pattern.. In PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.

Answer

The filter should include a tag condition because dynamic groups require tags.

Answer

The dynamic address group cannot use name-based filters; it requires tags.

Answer

The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.

Question 14

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Accepted Answer

The route via 10.0.0.2 on ethernet1/3. The firewall selects the route with the lowest administrative distance (AD) for forwarding traffic to 10.0.1.1. In this scenario, the route via 10.0.0.2 on ethernet1/3 has an AD of 10 (typically OSPF), which is lower than the AD of 20 (static route) and 110 (RIP). Therefore, it is the preferred route.

Answer

The route via 10.0.0.3 on ethernet1/4

Answer

The route via 10.0.0.4 on ethernet1/5

Answer

All three routes are used in ECMP

Question 15

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure IKE gateway, then IPsec crypto profile, then tunnel interface, then static route to tunnel interface, then security policy allowing VPN traffic.. IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.

Answer

Configure IPsec crypto profile, then IKE gateway, then tunnel interface, then static route, then security policy.

Answer

Configure IKE gateway, then IPsec crypto profile, then static route, then tunnel interface, then security policy.

Answer

Configure security policy, then IKE gateway, then IPsec crypto profile, then tunnel interface, then static route.