PCNSA Practice Test 17 — 15 Questions

Question 1

Which three components are part of the Palo Alto Networks Next-Generation Firewall architecture? (Choose three.)

Accepted Answer

Application ID engine. The Application ID engine is a core component of Palo Alto Networks Next-Generation Firewall architecture because it performs deep packet inspection to identify applications regardless of port, protocol, or encryption. This allows the firewall to apply security policies based on the application identity rather than traditional port-based rules, enabling granular control over traffic.

Answer

Policy optimizer

Answer

GlobalProtect VPN

Question 2

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access

Question 3

Match each Palo Alto Networks service to its typical use.

Accepted Answer

Panorama: Centralized management and reporting for multiple firewalls. Panorama is used for centralized management and reporting of multiple firewalls. WildFire provides cloud-based malware analysis and prevention. Common confusions include swapping these services or confusing them with AutoFocus.

Answer

Panorama: Cloud-based threat intelligence

Answer

WildFire: Centralized management for firewalls

Question 4

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

Accepted Answer

Configure the firewall to send logs to a separate log collector. Offloading logs to a separate log collector reduces the firewall's dataplane CPU overhead associated with local log processing and storage. The firewall can then focus on core packet inspection and forwarding tasks, maintaining security posture while alleviating CPU pressure.

Answer

Disable logging for all security rules

Answer

Upgrade to a higher-end firewall model

Answer

Reduce the number of security policies

Question 5

An administrator needs to decrypt HTTPS traffic from external users to the company's web servers. Which decryption policy should the administrator configure?

Accepted Answer

SSL Inbound Inspection. D is correct because SSL Inbound Inspection is specifically designed to decrypt inbound HTTPS traffic destined for company-owned web servers. The firewall acts as a destination proxy, terminating the client's TLS connection and re-encrypting traffic to the server, allowing inspection of the decrypted payload for threats.

Answer

Configure a security policy to block HTTPS

Answer

SSL Forward Proxy

Answer

No decryption is needed because the firewall can inspect HTTPS without decryption

Question 6

An organization is experiencing high CPU utilization on the firewall dataplane, causing latency in packet processing. The administrator notices that a large number of small packets are being processed by a specific security rule that allows any service. What is the best first step to reduce CPU load without impacting legitimate traffic?

Accepted Answer

Create a QoS policy to limit bandwidth for that traffic class. Applying a QoS policy to limit bandwidth for the traffic class causing high CPU utilization will throttle the rate at which small packets are processed, reducing the dataplane load without dropping legitimate traffic. QoS allows the firewall to prioritize or rate-limit specific traffic classes, which directly addresses the high volume of small packets without altering security rules or session behavior.

Answer

Remove the rule and create a more specific rule with a narrower service

Answer

Apply a DoS protection profile with a session rate threshold

Answer

Increase the session timeout to avoid creating new sessions

Question 7

Which TWO of the following are stages in the packet processing flow on a Palo Alto Networks firewall?

Accepted Answer

Security policy lookup. Security policy lookup is a core stage in the Palo Alto Networks firewall packet processing flow. After the packet is decoded and identified, the firewall performs a security policy lookup to determine whether to allow or deny the traffic based on the configured rules. This is a mandatory step for all traffic traversing the firewall.

Answer

Encryption of the packet

Answer

Log generation

Answer

Routing table lookup

Question 8

Based on the exhibit, what action did the firewall take on this traffic?

Accepted Answer

Allowed the traffic.. The exhibit shows a traffic log entry with the action 'allow' (or a green checkmark indicating a permit), meaning the firewall evaluated the traffic against security policies and determined it matched a rule set to allow. The session was established and forwarded without being blocked or reset, confirming the correct answer is C.

Answer

Reset the connection.

Answer

Blocked the URL.

Answer

Denied the traffic.

Question 9

A network administrator wants to ensure that if the primary firewall fails, a secondary firewall takes over without any manual intervention. Which high availability feature is essential for this automatic failover?

Accepted Answer

Heartbeat monitoring. Heartbeat monitoring is the essential feature for automatic failover because it allows the secondary firewall to detect the primary firewall's failure through continuous health checks. When the heartbeat is lost, the secondary firewall automatically assumes the active role without manual intervention, ensuring high availability.

Answer

Session synchronization

Answer

Floating IP addresses

Answer

Preemptive mode

Question 10

Refer to the exhibit. The firewall cannot reach the Internet. Based on the routing table, what is the most likely cause?

Accepted Answer

The default route is not active because the interface ethernet1/1 is down. The routing table shows a default route (0.0.0.0/0) configured with a next hop of 10.1.1.1 via interface ethernet1/1, but the route is not active (no 'C' flag for candidate). In Palo Alto Networks firewalls, a static route is only installed into the forwarding table if the specified egress interface is administratively up and operationally active. Since ethernet1/1 is down, the route cannot be used, and the firewall has no path to the Internet.

Answer

The next hop 10.1.1.1 is not reachable

Answer

There is no default route configured

Answer

The route table is empty because the virtual-router is misconfigured

Question 11

Which TWO actions are recommended for monitoring decrypted traffic on a Palo Alto Networks firewall?

Accepted Answer

Create an ACC filter for decrypted sessions.. The ACC (Application Command Center) filter for decrypted sessions allows you to visualize and monitor decrypted traffic in real time, providing insights into applications, threats, and URLs within those sessions. Option D is correct because enabling logging on decryption policies ensures that decrypted session details are recorded in the decryption log, which is essential for auditing and troubleshooting decrypted traffic.

Answer

Disable decryption during peak hours.

Answer

Use the 'decryption' log type.

Answer

Export decrypted traffic to a log collector.

Question 12

A large financial institution runs a PA-5250 firewall in a virtual wire mode between two core switches. The firewall is configured with multiple virtual wire sub-interfaces to segregate traffic for different VLANs. Recently, the security team noticed that multicast traffic from a critical trading application is not being forwarded across the virtual wire link. The firewall has multicast policies enabled, and the trading application uses IGMPv3. The administrator has verified that the firewall's multicast policy allows the traffic and that the IGMP snooping is enabled on the adjacent switches. However, the multicast stream does not reach the receivers on the other side. Which step should the administrator take to resolve this issue?

Accepted Answer

Enable IGMP snooping on the virtual wire sub-interfaces of the firewall.. In a virtual wire deployment, the firewall does not participate in Layer 2 protocols like IGMP snooping by default. Even if multicast policies are enabled, the firewall must explicitly perform IGMP snooping on its virtual wire sub-interfaces to track multicast group memberships and forward the traffic correctly. Enabling IGMP snooping on the sub-interfaces allows the firewall to intercept IGMPv3 membership reports and build the necessary forwarding state for the multicast stream.

Answer

Increase the multicast traffic bandwidth limit in the QoS policy.

Answer

Change the virtual wire mode to layer 3 mode and configure PIM.

Answer

Configure a static multicast MAC address mapping on the firewall.

Question 13

Refer to the exhibit. A network administrator sees this output from a Palo Alto Networks firewall. What does the 'System mode: virtual' indicate about this firewall?

Accepted Answer

It is a VM series firewall running on a hypervisor.. The 'System mode: virtual' output indicates the firewall is a VM-Series instance running on a hypervisor such as VMware ESXi, KVM, or Hyper-V. This mode is distinct from physical appliances and cloud-native instances, as it leverages virtualized hardware resources while maintaining full PAN-OS functionality.

Answer

It is a physical firewall configured in high availability active-active mode.

Answer

It is a Panorama management server.

Answer

It is a cloud-based firewall instance (e.g., AWS, Azure).

Question 14

Based on the exhibit, what is the most likely cause if the firewall is dropping new connections but existing sessions continue to work?

Accepted Answer

The firewall has reached its session limit.. When a Palo Alto Networks firewall reaches its maximum session capacity (defined by the platform model and license), it will drop new connection attempts while maintaining existing sessions that are already in the session table. This behavior is by design to preserve established traffic. The session limit is a hard resource constraint, not a performance degradation, so existing flows continue uninterrupted until they age out or are terminated.

Answer

The management interface IP (192.168.1.1) is conflicting with another device.

Answer

The firewall is low on CPU memory.

Answer

The software version 10.1.3 is buggy.

Question 15

A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?

Accepted Answer

Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.. The firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.

Answer

Configure User-ID and enable User-ID mapping for the web traffic.

Answer

Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.

Answer

Create custom App-ID signatures for the web servers.