PCNSA Practice Test 18 — 15 Questions

Question 1

A company uses a Palo Alto Networks firewall to control outbound access. They have created custom application filters to block social media and streaming. However, they need to allow a specific corporate YouTube channel for training videos. The administrator creates an application group "Corporate-YouTube" containing the "youtube-base" application, and adds a security rule to allow traffic from internal users to the application group. Despite this, users still cannot access the corporate YouTube channel. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's URL filtering profile is blocking the category before application identification can occur.. The most likely reason is that the URL filtering profile is blocking the YouTube category before the firewall can identify the application. Palo Alto Networks firewalls process URL filtering before application identification in the security policy evaluation order. Even though the application group 'Corporate-YouTube' is allowed, the URL filtering profile (which is applied to the rule or as a default) will block the request if the URL category (e.g., 'streaming-media' or 'social-networking') is denied, preventing the traffic from reaching the application identification stage.

Answer

The application group is not correctly associated with the security policy.

Answer

The application "youtube-base" is not recognized by the firewall.

Answer

The security rule allowing the application group is placed after a deny rule that blocks the "streaming" category.

Question 2

A company has a Palo Alto Networks firewall in a data center, connecting internal users (zone: Internal) to the internet (zone: Untrust). Recently, users report that they cannot access the corporate HR portal hosted on a server in the DMZ (zone: DMZ, IP 10.10.10.10) using HTTPS. The firewall has a security policy that allows traffic from Internal to DMZ with application web-browsing and service https-ssl. The policy is in place and committed. The administrator verifies that the web server is running and reachable from within the DMZ. From the firewall, a ping from the management interface to the server is successful. However, when a user tries to access https://10.10.10.10, the connection times out. Traffic logs show no sessions logged for that traffic. What is the most likely cause?

Accepted Answer

The policy is missing the source zone; the traffic is being blocked by an implicit deny rule before any policy match.. Since there are no sessions in the traffic log, the traffic is being dropped by the implicit deny rule, meaning no security policy matched. The most likely reason is that the policy's source zone is not set to Internal; if it were set to another zone (e.g., Untrust), the traffic from Internal would not match. Option B would likely produce sessions if matched by another policy. Option C would show sessions but no return traffic. Option D is incorrect because SSL decryption is not required for HTTPS to be allowed through the firewall.

Answer

There is a routing issue preventing return traffic from reaching the firewall.

Answer

The policy has the wrong destination zone; the server is actually in the Internal zone.

Answer

The firewall is not configured to perform SSL decryption; thus HTTPS traffic is being blocked.

Question 3

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Accepted Answer

Use a script that logs in via SSH and runs 'save config to scp/tftp'. The firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Answer

Use the CLI command 'request system backup config schedule'

Answer

Set a recurring cron job via the firewall's built-in cron

Question 4

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Accepted Answer

Host Information Profile (HIP). The correct answers are Host Information Profile (HIP) and Client certificates. HIP checks device compliance (e.g., OS, antivirus, disk encryption) to ensure only compliant devices connect. Client certificates authenticate the device itself, providing an additional layer of security. Gateway configuration is basic connectivity, pre-logon is for always-on VPN, and App-IP mapping is irrelevant to device compliance.

Answer

Gateway configuration

Answer

App-IP mapping

Answer

Pre-logon

Question 5

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

Accepted Answer

It is a security rule that allows the session.. Based on the exhibit, the session output shows that the rule 'Allow_Outbound' matched and allowed the session. This rule is a security rule because it permits traffic. Options B, C, and D are incorrect: QoS rules prioritize traffic, NAT rules translate IP addresses, and decryption rules decrypt traffic. The session was allowed, indicating a security rule.

Answer

It is a QoS rule that prioritizes the traffic.

Answer

It is a NAT rule that translates the source IP.

Answer

It is a decryption rule that decrypts the traffic.

Question 6

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. The rule specifies application 'web-browsing', but the traffic may be classified as a different application (e.g., 'ssl' or 'http-proxy'), causing a mismatch. Even though the traffic uses port 80, the firewall identifies applications by signature, not just port. Option A is not necessary; the application does not need to be 'any' to match. Option C is false; the log setting does not affect whether the rule is hit. Option D is incorrect; a broad destination address (any) is not an issue.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 7

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Accepted Answer

Rule 2: deny-all-from-trust-to-untrust (deny). The traffic is HTTPS, which uses the SSL application, not HTTP. Rule 1 only matches HTTP, so it does not match. Rule 2 is a deny-all rule that applies to all traffic from the trust zone to the untrust zone, so it matches and denies the HTTPS traffic. Rule 3 only matches DNS, and the implicit deny is not reached because Rule 2 explicitly denies the traffic. Therefore, the correct rule is Rule 2 (deny-all-from-trust-to-untrust).

Answer

Rule 1: allow-http-from-trust-to-untrust (allow)

Answer

Rule 3: allow-dns-from-trust-to-untrust (allow)

Answer

No rule matches; implicit deny will block the traffic.

Question 8

A network administrator recently changed the admin password on a Palo Alto Networks firewall and logged out. The next day, the administrator attempts to log in via SSH but receives 'access denied' after three attempts. The administrator typically uses SSH from a management workstation. The firewall's management interface is still reachable via ping. The administrator suspects the account may be locked due to failed attempts. Since the administrator is not currently logged in, there is no way to unlock the account remotely. The administrator has physical access to the data center and can connect a laptop to the console port. What is the most efficient way to regain administrative access to the firewall?

Accepted Answer

Connect via the serial console and use the maintenance mode to reset the admin password.. The Palo Alto Networks firewall's serial console provides access to a maintenance mode that allows the administrator to reset the local admin password without needing to log in. This is the most efficient method when the account is locked due to failed SSH attempts and physical access is available, as it avoids a full reboot or factory reset.

Answer

Reboot the firewall and interrupt the boot process to reset the admin password.

Answer

Factory reset the firewall and restore the configuration from a backup.

Answer

Use the 'debug' command in the management interface to bypass the lockout.

Question 9

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. A virtual wire requires at least two interfaces to be added as members, which allows the firewall to transparently bridge traffic between them without any IP configuration. The virtual wire acts as a Layer 2 bump-in-the-wire, so interfaces are placed into the vwire to forward frames based on MAC addresses, not IP routing.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Question 10

Which two components are part of Content-ID? (Choose two.)

Accepted Answer

File Blocking. File Blocking (option B) is a core component of Content-ID that allows administrators to block or allow specific file types based on MIME type or file extension, regardless of the application or port used. Data Filtering (option C) is also part of Content-ID and enables inspection of data patterns (e.g., credit card numbers, SSNs) within application traffic to prevent data exfiltration. Both features operate after App-ID identifies the application, providing granular control over content within allowed sessions.

Answer

Application Override

Answer

URL Filtering

Question 11

Which TWO statements are true regarding App-ID and Content-ID? (Choose two.)

Accepted Answer

Content-ID provides capabilities such as File Blocking, Data Filtering, and URL Filtering.. Options A and B are correct. Option A is true because Content-ID includes File Blocking, Data Filtering, and URL Filtering. Option B is true because App-ID identifies applications regardless of port or protocol. Option C is false because Content-ID works for all traffic, not just web. Option D is false because App-ID can identify encrypted applications without SSL decryption using other methods like TLS fingerprinting. Option E is false because Content-ID depends on App-ID for application context; it cannot function without App-ID enabled.

Answer

Content-ID only works for web traffic.

Answer

App-ID requires SSL decryption to identify encrypted applications.

Answer

Content-ID can function without App-ID enabled.

Question 12

An administrator needs to check the system uptime of the firewall. Which CLI command should be used?

Accepted Answer

show system info. The 'show system info' command on Palo Alto Networks firewalls displays system information including the system uptime, model, software version, and serial number. This is the correct command to check the firewall's uptime as it directly provides the time since the last reboot.

Answer

show uptime

Answer

show system state

Answer

show system resources

Question 13

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

Accepted Answer

Use the ACC (Application Command Center) and filter by user group and time range. The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

Answer

Export Traffic logs to CSV and analyze in Excel

Answer

Use the Top Applications report in the Reports tab

Answer

Use the Monitor tab's Session Browser with a filter for the user group

Question 14

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Accepted Answer

SSL Decryption with a dedicated decryption broker.. The decryption broker feature allows offloading decryption to a dedicated appliance while maintaining visibility for the firewall. Option B, SSL Forward Proxy with decryption mirroring, mirrors decrypted traffic but does not offload decryption. Option C, decryption port mirroring, is not a standard feature for offloading. Option D, TLS 1.3 decryption, refers to supporting a protocol version, not a decryption offloading solution.

Answer

SSL Forward Proxy with decryption mirroring.

Answer

Decryption port mirroring.

Answer

TLS 1.3 decryption.

Question 15

Which THREE actions can be taken based on hit counts in security rules? (Select three.)

Accepted Answer

Identify unused rules for cleanup. Hit counts in security rules show how many times a rule has been matched. This data can be used to identify unused rules (A) for cleanup, prioritize rule optimization efforts (C) by focusing on heavily hit rules, and troubleshoot traffic mismatches (D) by analyzing which rules are matched by specific traffic patterns. Dynamic updates to rules (B) are not based on hit counts, and rule shadowing (E) is determined by rule ordering and overlap analysis, not hit counts.

Answer

Create dynamic updates to rules

Answer

Determine rule shadowing