PCNSA Practice Test 18 — 15 Questions

Question 1

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule is placed after an allow rule that matches the traffic.. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Answer

BitTorrent is not part of the peer-to-peer application category.

Answer

The security rule is using an application group instead of an application filter.

Answer

The firewall does not have the latest App-ID update and cannot identify BitTorrent.

Question 2

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 3

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 4

After making configuration changes, an administrator clicks 'Commit' but the changes are not applied. What is the most likely cause?

Accepted Answer

Configuration validation errors exist. When an administrator clicks 'Commit' but the changes are not applied, the most likely cause is that configuration validation errors exist. The Palo Alto Networks firewall performs a validation check before committing; if any errors are found (e.g., invalid IP addresses, missing required fields, or conflicting rules), the commit is blocked and an error message is displayed. This ensures that only syntactically and semantically correct configurations are applied to the running state.

Answer

The commit is scheduled for a later time

Answer

The commit was canceled by another admin

Answer

The firewall is in multi-vsys mode and only the current vsys is committed

Question 5

An administrator wants to synchronize the firewall's clock with a central NTP server. Where is this configured?

Accepted Answer

Under Device > Setup > Services, NTP tab. NTP (Network Time Protocol) client configuration on a Palo Alto Networks firewall is performed under Device > Setup > Services, where the NTP tab allows you to specify primary and secondary NTP servers. This synchronizes the firewall's system clock, which is critical for accurate log timestamps, certificate validation, and security policy enforcement. The firewall acts as an NTP client, sending periodic NTP requests (typically using UDP port 123) to the configured servers.

Answer

Under Objects > Regions

Answer

Under Device > Licenses

Answer

Under Network > Interfaces, Management Interface

Question 6

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Accepted Answer

No Decrypt (bypass decryption). The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer

Error due to rule conflict

Answer

Block

Answer

Decrypt

Question 7

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Accepted Answer

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.. To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Answer

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Answer

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Answer

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Question 8

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. The best way to share security policies across firewalls with different interface configurations is to use a single device group containing both firewalls. Device groups are designed to manage security policies centrally, while templates handle device-specific settings like interface configurations. Option B is correct because it allows policy consistency without duplicating effort. Option A (separate device groups) would require manual duplication. Option C (templates) is incorrect because templates are for device-level configuration, not security policies. Option D (Shared policy with overrides) is not a standard or efficient approach for this scenario.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.

Question 9

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Application-ID allows granular control over applications, not just ports. Option B is a decryption policy and does not control application access. Option C is a security policy with service only, which restricts based on port/protocol, not application. Option D is policy-based forwarding, used for path selection, not for blocking applications.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 10

A network administrator needs to restrict which source IP addresses can access the firewall's web management interface. Which feature should be configured?

Accepted Answer

Management Profile. Management Profile. A Management Profile is a firewall configuration object that defines which services (e.g., HTTPS, SSH, ping) are allowed on a specific interface and, critically, which source IP addresses or subnets can access those services. By binding a Management Profile to an interface, the administrator can restrict web management access to only trusted source IPs, such as a management subnet. This is the intended and most secure method for controlling management plane access on Palo Alto Networks firewalls.

Answer

Access Control List on the data plane

Answer

Interface management settings

Answer

Security policy rule for management traffic

Question 11

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

Accepted Answer

Use a dedicated management interface and restrict access to trusted IP addresses.. Using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.

Answer

Enable the default admin account with a strong password.

Answer

Allow HTTP access to the management interface for ease of use.

Answer

Enable SNMP with read-write community strings for monitoring.

Question 12

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Accepted Answer

Create a decryption policy with action 'no-decrypt' for traffic to financial sites, and a catch-all decryption policy with action 'decrypt' for all other traffic.. It uses a specific 'no-decrypt' action in a decryption policy for financial sites, which explicitly excludes them from SSL/TLS decryption. A catch-all policy with 'decrypt' then ensures all other internal user traffic is decrypted. This approach directly aligns with the forward proxy requirement to decrypt all traffic except the specified financial sites.

Answer

Create a decryption policy and use the 'exclude cache' option for financial sites.

Answer

Create a security policy that allows financial sites without decryption; then create a decryption policy with action 'no-decrypt' for those sites.

Answer

Create a decryption policy with action 'decrypt' and a source zone of internal; then create a decryption exemption for financial URLs.

Question 13

Which THREE actions can be performed in a decryption policy? (Choose three.)

Accepted Answer

No-decrypt. In a Palo Alto Networks decryption policy, the three supported actions are No-decrypt (C), Block (D), and Decrypt (E). No-decrypt (C) is correct because it lets traffic bypass decryption, which is used for traffic that cannot or should not be decrypted, such as pinned or unsupported cipher suites. Block (D) is correct because the policy can drop sessions outright, for example to enforce that certain categories or applications must be decrypted or denied. Decrypt (E) is correct because it is the core action that applies SSL/TLS decryption to matching sessions. App-ID (A) is not an action but a matching criterion/classification used in the policy rule, and Allow (B) is a security policy action, not a decryption policy action.

Answer

App-ID

Answer

Allow

Question 14

A security team wants to inspect traffic to and from a critical application server. They configure an inbound decryption rule to decrypt traffic destined to the server's IP address. After deploying, they find that traffic is not being decrypted. What is the first step to troubleshoot?

Accepted Answer

Check the decryption policy rule order and ensure it is before any no-decrypt rules.. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If a 'no-decrypt' rule appears before the inbound decryption rule, traffic matching the server's IP will be handled by the no-decrypt rule and will not be decrypted. Therefore, verifying rule order is the first troubleshooting step.

Answer

Confirm that the decryption profile is set to 'decrypt' and that the forward proxy option is enabled.

Answer

Verify that the server's certificate is installed on the firewall.

Answer

Ensure that the firewall has a valid certificate for inbound inspection.

Question 15

Which THREE actions can improve firewall performance by reducing CPU load? (Choose three.)

Accepted Answer

Enable hardware acceleration for packet processing. Option A is correct because offloading packet processing to dedicated hardware (ASICs, FPGAs, or NIC-based acceleration) removes per-packet inspection work from the general-purpose CPU, directly lowering CPU load. Option C is correct because logging every allowed session forces the firewall to generate, format, and write log entries for high-volume traffic, so reducing log verbosity for permitted flows cuts that CPU and I/O overhead. Option D is correct because unused security profiles (antivirus, anti-spyware, vulnerability protection, URL filtering, etc.) still consume CPU cycles when applied to traffic, so disabling profiles that are not needed frees processing capacity. Option B does not belong because reactive API-driven policy updates affect management automation and change responsiveness, not steady-state packet-processing CPU load. Option E does not belong because enabling SSL decryption for all traffic is extremely CPU-intensive (TLS handshake and bulk decryption), which increases rather than reduces CPU load.

Answer

Use reactive policy updates via API

Answer

Enable SSL decryption for all traffic