PCNSA Practice Test 17 — 15 Questions

Question 1

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

Accepted Answer

Session synchronization. Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Answer

Stateful failover

Answer

Packet buffer

Answer

Session Timer adjustment

Question 2

A network administrator needs to configure certificate-based authentication for administrative access to the firewall's web interface. Which two actions are required?

Accepted Answer

Import a CA-signed certificate for the firewall.. For certificate-based authentication of administrative access to the firewall's web interface, you must import a CA-signed certificate for the firewall (Option D) because the browser must trust the certificate presented by the firewall during the TLS handshake. Additionally, you must assign that certificate to the HTTPS management interface (Option E) so the firewall uses it for TLS sessions on the management web interface.

Answer

Generate a self-signed server certificate on the firewall.

Answer

Create a local user with a certificate profile.

Answer

Import a CRL from the issuing CA.

Question 3

An administrator wants to allow ping (ICMP) and SSH access on a data interface (e.g., ethernet1/1) for troubleshooting. Which configuration is required?

Accepted Answer

Configure an interface management profile on ethernet1/1. Interface management profiles control which management services (ping, SSH, HTTP, etc.) are permitted on a data interface.

Answer

Enable 'Management' profile on the VLAN interface

Answer

Create a security policy allowing ICMP and SSH inbound

Answer

Enable the service route for ping and SSH

Question 4

Which THREE are required for Panorama to manage a firewall? (Select three)

Accepted Answer

Certificate-based mutual authentication (or pre-shared key). Option C is correct because Panorama and managed firewalls must establish a secure, authenticated connection using either certificate-based mutual authentication or a pre-shared key. This ensures that only authorized firewalls can register with Panorama and receive configuration updates, preventing unauthorized devices from joining the management domain.

Answer

A valid Panorama license

Answer

Panorama plugin installed on the firewall

Question 5

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Accepted Answer

Set the firewall priority to determine the active role.. Option A is correct because in an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Answer

Assign the same IP address to both firewalls for the data interface.

Answer

Sync the running configuration to the passive firewall.

Question 6

A company has two Palo Alto Networks firewalls in active/passive HA. The passive firewall failed and was replaced with a new unit. The network administrator initiates a configuration sync from the active to the new passive. After the sync, the passive unit shows as 'Active' instead of 'Passive'. What is the most likely cause?

Accepted Answer

The active firewall's HA settings were missing the new device's serial number.. Option C is correct because in an active/passive HA pair, the active firewall maintains a list of allowed peer serial numbers. If the new passive unit's serial number is not included in the active firewall's HA configuration, the active will not recognize the passive as a valid peer. Consequently, the passive unit, lacking a proper HA heartbeat from the active, will assume the active role (become 'Active') due to a loss of the HA link or misidentification, as it defaults to active state when it cannot establish a proper HA relationship.

Answer

The HA link is misconfigured on both units.

Answer

The passive unit's HA configuration was set to 'Stateful Inspection' instead of 'Passive'.

Answer

The passive unit had a different version of Panorama template.

Question 7

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 8

An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?

Accepted Answer

RDP. TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.

Answer

FTP

Answer

SSH

Answer

Telnet

Question 9

An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?

Accepted Answer

The service group includes only UDP service objects. Option A is correct because the service group must include both TCP and UDP service objects to match DNS traffic on both protocols. If the service group contains only UDP service objects, the security policy will not match TCP DNS traffic (TCP port 53), causing the rule to fail for TCP-based DNS queries or zone transfers. In Palo Alto Networks firewalls, service groups aggregate service objects, and each object defines a specific protocol and port; missing the TCP object means the rule cannot match TCP traffic.

Answer

The rule requires a separate application object

Answer

The security policy action is set to deny

Answer

The service group is incorrectly configured

Question 10

An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?

Accepted Answer

Facebook uses a different application not in the group. Option C is correct because Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.

Answer

The rule has no source zone

Answer

The rule's action is set to allow but the application group is configured incorrectly

Answer

The application group includes 'ssl' which is not an application

Question 11

An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?

Accepted Answer

Use separate virtual systems (vsys) for each tenant.. Option D is correct because virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.

Answer

Use prefix-based naming conventions for address objects.

Answer

Use separate device groups in Panorama.

Answer

Use tags to isolate objects per tenant.

Question 12

Which TWO of the following are valid types of address objects in Palo Alto Networks? (Choose two.)

Accepted Answer

IP Range. IP Range and IP Netmask are both valid address object types in Palo Alto Networks. An IP Range object defines a contiguous set of IP addresses using a start and end address (e.g., 192.168.1.1-192.168.1.254), while an IP Netmask object uses a subnet mask notation (e.g., 192.168.1.0/24) to represent a network or host range. These are the two primary IPv4 address object types supported natively in PAN-OS.

Answer

FQDN

Answer

MAC Address

Answer

URL Category

Question 13

A network administrator manages a Palo Alto Networks firewall in a datacenter. They have configured dynamic address groups (DAGs) to automatically include servers based on tags. The tags are assigned via User-ID from Active Directory. The administrator notices that some servers that should be in the DAG are not appearing, while others are correctly added. The firewall is configured to receive User-ID information from a domain controller via the PAN-OS Agent. The tags are correctly assigned in Active Directory. What should the administrator verify first?

Accepted Answer

The dynamic address group's filter expression is correct and uses the tag.. The most common cause when tags are correctly assigned in Active Directory but servers are missing from a dynamic address group (DAG) is an incorrect filter expression on the DAG itself. The DAG uses a tag-based filter (e.g., 'tag1' or 'tag1 AND tag2') to match registered IP-address-to-tag mappings; if the filter syntax or tag name does not exactly match what is being registered via User-ID, the servers will not be included. The administrator should verify the DAG's filter expression first before investigating other components.

Answer

The firewall's User-ID agent is configured to fetch tags from the correct domain.

Answer

The firewall's license for User-ID is active.

Answer

The security policies using the DAG are committed.

Question 14

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Accepted Answer

Deploy Panorama and manage all VM-Series firewalls from a single console. Option D is correct because Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Answer

Configure each VM-Series firewall independently

Answer

Rely on cloud-native security groups instead of VM-Series

Answer

Use a single security policy applied to all firewalls via an API script

Question 15

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

Accepted Answer

Create rules with the most specific conditions first. Placing more specific rules above general rules ensures that specific traffic is matched first, preventing unintended matches. Option A is wrong because disabling logging on all rules reduces visibility. Option C is wrong because using any/any rules is discouraged. Option D is wrong because security rules should ideally be grouped by zone, not mixed.

Answer

Use 'any' for source and destination zones to save time

Answer

Mix inbound and outbound rules in the same rulebase section

Answer

Place general rules above specific rules