PCNSA Practice Test 19 — 15 Questions

Question 1

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The log forwarding profile is not configured to forward logs for denied sessions.. The most likely cause is that the log forwarding profile is not configured to forward logs for denied sessions. Even though the profile includes 'traffic' logs, it may have a filter that excludes logs with a deny action. Option A is incorrect because the profile does include traffic logs; denied traffic logs are a subset of traffic logs, but the profile's filter might exclude deny actions. Option B is incorrect because deny sessions do complete (they are dropped) and logging at session end still generates a log. Option D is incorrect because the SIEM is receiving syslog messages for allowed traffic, so the syslog configuration is fine.

Answer

The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Answer

The firewall is logging only at session end and the deny sessions are not completing.

Answer

The SIEM is not configured to receive syslog messages for deny actions.

Question 2

A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?

Accepted Answer

Create a single address object with IP subnet 192.168.10.0/24.. Directly uses the subnet as an address object, which is efficient for a contiguous subnet. Option D uses a dynamic address group with tags, allowing flexible grouping without manual updates. Option A creates an address group with individual objects, which is less efficient for a subnet. Option B uses an IP range, which is less efficient than CIDR notation. Option E refers to a non-existent feature.

Answer

Create an address group and add individual address objects for each server IP.

Answer

Create a single address object with IP range 192.168.10.1-192.168.10.254.

Answer

Create a predefined address object from the global cache.

Question 3

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Accepted Answer

The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.. The most likely cause is that the new subnet 10.10.20.0/24 is routed through a different virtual router (VR) than the VR used by the Internal zone's interface. In Palo Alto firewalls, security rules are zone-based, and the zone is determined by the ingress interface. If the traffic from the new subnet enters via an interface in a different VR, the zone may not be 'Internal', so the rule allowing SSH from Internal to DMZ does not apply. Option C correctly identifies this scenario.

Answer

The application is not correctly identified because the SSH server uses a non-standard port.

Answer

There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.

Answer

The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.

Question 4

Which TWO types of address objects can be used in a security policy? (Choose two.)

Accepted Answer

IP Netmask. IP Netmask and IP Range are both types of address objects that define specific IP addresses or groups of IP addresses. Security policies in Palo Alto Networks firewalls use these address objects to match source and destination IP addresses in traffic, enabling granular control over which hosts or networks are allowed or denied.

Answer

Application

Answer

Tag

Answer

Service

Question 5

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Accepted Answer

A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.. In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Answer

The traffic is using TLS 1.3 which is not supported by the firewall.

Answer

The firewall's encryption algorithm settings do not match the server's cipher suite.

Answer

The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

Question 6

Users report that some internal services are not accessible when connected via VPN, but they work when on the local network. The firewall has a policy allowing all traffic from the VPN zone to the internal zone. What should the administrator check first?

Accepted Answer

Check if there are NAT rules that affect the VPN zone traffic, such as missing reverse NAT.. When users can access internal services locally but not via VPN, a common issue is missing reverse NAT rules. Even if a security policy allows traffic from VPN to internal, the return traffic might not have the correct NAT translation to route back to the VPN client. Checking NAT rules, especially reverse NAT (destination NAT return), is the first step. Option A is incorrect because SSL decryption typically affects encrypted traffic inspection, not basic connectivity. Option C is incorrect because zone protection profiles are designed to protect against attacks, not to block legitimate traffic that works locally. Option D is incorrect because the policy order is irrelevant if the policy already matches and allows the traffic; the issue is likely at the NAT layer.

Answer

Check if SSL decryption is breaking the traffic.

Answer

Check if the zone protection profile is dropping traffic.

Answer

Check if the security policy rule order is correct.

Question 7

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Accepted Answer

The application 'web-browsing' does not cover port 8080 traffic.. The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Answer

The rule order is incorrect; a previous rule is denying the traffic.

Answer

The destination address object 10.10.0.0/16 is incorrect.

Answer

The source zone 'GP' should be 'untrust'.

Question 8

During a security audit, it is discovered that some users are bypassing the company's web proxy by using HTTPS to external websites. The firewall is configured to allow 'web-browsing' application. What is the best way to enforce proxy usage for all HTTP/HTTPS traffic?

Accepted Answer

Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.. By blocking the 'web-browsing' application for regular users and allowing only the proxy server to use it, you enforce that all HTTP/HTTPS traffic must go through the proxy. SSL decryption (A) helps inspect encrypted traffic but does not force proxy usage. Content-ID (C) is not used to block entire categories like web traffic; it focuses on threat signatures. URL filtering (D) can block or allow specific URLs but does not enforce proxy routing; users could still bypass the proxy using different URLs or IP addresses.

Answer

Enable SSL decryption and block traffic that is not decrypted.

Answer

Configure Content-ID to block all web traffic.

Answer

Use URL filtering to block all URLs except those from the proxy.

Question 9

Which THREE are valid components of Content-ID? (Choose three.)

Accepted Answer

URL Filtering. Content-ID includes URL Filtering, File Blocking, and Data Filtering. Application Filters and Application Override are components of App-ID, not Content-ID. Therefore, the correct answers are C, D, and E.

Answer

Application Filters

Answer

Application Override

Question 10

A network administrator observes that a user is able to access a cloud storage application even though a security rule explicitly blocks that application. Other application blocks work correctly. What is the most likely cause?

Accepted Answer

The user is accessing the application over HTTPS on a common web port, and App-ID cannot correctly identify the application.. App-ID relies on multiple identification mechanisms, including protocol decoding, application signatures, and SSL decryption. When a cloud storage application is accessed over HTTPS on a common web port (e.g., 443), App-ID may fail to correctly identify the application if the traffic is encrypted and no SSL decryption policy is applied, or if the application uses a technique like 'port hopping' or 'tunneling over HTTP/HTTPS'. This causes the security rule explicitly blocking the application to be ineffective, as the traffic is instead matched against a different application signature (e.g., 'web-browsing') that is allowed.

Answer

The security rule order is incorrect; a previous rule allows the application.

Answer

URL filtering is misconfigured and allowing the URL for the cloud storage.

Answer

A Content-ID profile is overriding the application block.

Question 11

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 12

During troubleshooting, an administrator needs to review firewall system events such as user logins, configuration changes, and commit failures. Which log type should be examined?

Accepted Answer

System logs. System logs in Palo Alto Networks firewalls capture administrative and system-level events, including user logins, configuration changes, and commit failures. These logs are generated by the management plane and are essential for auditing and troubleshooting device management activities.

Answer

Threat logs

Answer

Traffic logs

Answer

URL filtering logs

Question 13

Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?

Accepted Answer

Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.. Creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 with appropriate security profiles will permit the desired traffic without affecting other rules. Rule order matters in Palo Alto firewalls; a rule placed higher in the list is evaluated first. Option A would broaden rule1's source, potentially allowing unintended traffic. Option B would change rule2 to allow, which could permit traffic that should still be denied. Option D would move rule2 above rule1, but since rule2 is a deny rule, the traffic would still be denied. Thus, adding a new allow rule above the deny rule is the best approach.

Answer

Add 10.10.1.12 to rule1's source address.

Answer

Change rule2 to allow.

Answer

Move rule2 above rule1.

Question 14

Two Palo Alto Networks firewalls are deployed in an active/passive high availability pair. The passive firewall does not synchronize configuration changes. What is the most likely cause?

Accepted Answer

Configuration synchronization is not enabled.. Configuration synchronization must be enabled for the passive firewall to receive configuration changes from the active unit. Session synchronization is separate and does not affect config sync. Option A is incorrect because link monitoring controls failover based on interface status, not configuration synchronization; disabling it would not prevent config sync. Option B is incorrect because if the passive firewall were not configured as a peer, the HA pair would not form, but the scenario indicates the pair is deployed, so peer configuration exists. Option C is incorrect because the firewalls are already deployed as an active/passive pair, which requires them to be the same model; different models would prevent the pair from forming altogether.

Answer

Link monitoring is disabled.

Answer

The passive firewall is not configured as a peer.

Answer

The firewalls are different models.

Question 15

Which TWO are valid methods for authenticating administrative users on Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Local authentication using local user database. Options A, B, and E are correct. The Palo Alto Networks firewall supports local authentication using the local user database, RADIUS, and LDAP for authenticating administrative users. Option C is incorrect because TACACS (as opposed to TACACS+) is not supported; TACACS+ is supported. Option D is incorrect because SAML is primarily used for SSO and not a direct admin authentication method.

Answer

TACACS

Answer

SAML