PCNSA Practice Test 19 — 15 Questions

Question 1

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

Accepted Answer

Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.. App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Answer

Ensure the application uses a standard port.

Answer

Ensure SSL decryption is enabled for the application.

Answer

Check if the application override is applied to the correct rule.

Question 2

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Accepted Answer

It applies an interface management profile.. The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Answer

It applies a security rule.

Answer

It applies a QoS profile.

Answer

It applies a Zone Protection profile.

Question 3

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

Accepted Answer

Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.. The traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Answer

Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.

Answer

Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.

Answer

Modify the rule to use application 'any' to allow all applications.

Question 4

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

Accepted Answer

The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.. App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Answer

The firewall needs to have Application Override enabled for the custom signature to work.

Answer

The firewall must be restarted to apply the new custom signature.

Answer

The signature must be imported from the Palo Alto Networks application database.

Question 5

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

Accepted Answer

File Blocking profile. The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Answer

Data Filtering profile

Answer

Application filter in security rule

Answer

URL Filtering profile

Question 6

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

Accepted Answer

Tags are case-sensitive. Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Answer

The address objects are not in the same zone

Answer

The group needs a commit after tagging

Answer

Tags are not case-sensitive

Question 7

An administrator notices that the firewall's web interface is accessible via HTTPS but shows an expired certificate warning. The firewall's management certificate was issued by an internal CA and has a validity of two years. The administrator checks the certificate and sees it expired yesterday. The administrator generates a new self-signed certificate through the firewall's GUI. After generating, the administrator assigns the new certificate to the HTTPS management interface. Despite this, the firewall still presents the old expired certificate when accessed. What is the most likely cause?

Accepted Answer

The new certificate was not committed.. In Palo Alto Networks firewalls, changes to management interface settings, including certificate assignments, require a commit operation to become active. Generating and assigning the new certificate through the GUI only stages the change; without a commit, the firewall continues to use the previously committed configuration, which still references the expired certificate. This is why the old certificate persists despite the assignment.

Answer

The firewall must be restarted for the change to take effect.

Answer

The old certificate is still bound to a different service.

Answer

The browser has cached the old certificate.

Question 8

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 9

Which object type is used to group multiple service objects together for use in a security policy?

Accepted Answer

Service group. A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Answer

Schedule

Answer

Tag

Answer

Address group

Question 10

An administrator needs to deploy a Palo Alto Networks firewall in a location where the network infrastructure does not support routing. The firewall must be transparent to the existing network. Which deployment mode should be used?

Accepted Answer

Virtual wire. Virtual wire mode allows the firewall to be deployed transparently without requiring any routing configuration, as it operates at Layer 2 by binding two interfaces together and forwarding traffic based on MAC addresses. This mode is ideal when the existing network infrastructure does not support routing and the firewall must be invisible to the network, as it does not participate in routing protocols or require IP addresses on the connected interfaces.

Answer

HA mode

Answer

Layer 3

Answer

Tap mode

Question 11

A firewall is configured to send logs to an external syslog server. Some logs are missing, but other logs are arriving. Which step should be taken to troubleshoot this issue?

Accepted Answer

Verify the log forwarding profile to ensure the missing log types are included.. The most common reason for missing logs when others arrive is that the log forwarding profile on the firewall does not include the specific log types (e.g., traffic, threat, system) that are missing. The firewall sends logs based on the configured forwarding profile, and if a log type is not selected in the profile, it will not be forwarded to the external syslog server. Verifying the profile ensures that the missing log types are enabled for forwarding.

Answer

Restart the syslog server to clear any buffer issues.

Answer

Enable packet capture on the firewall to verify the logs are sent.

Answer

Disable logging on the firewall to reset the log queue.

Question 12

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

Accepted Answer

Ensure the application is identified by App-ID and that the correct application name is used.. In Palo Alto Networks App-ID-based security policy, the firewall matches traffic against the application signature, not just port/protocol. If a cloud application is allowed in the rule but traffic is still blocked, the most likely cause is that the firewall is identifying the traffic as a different App-ID (e.g., 'unknown-tcp', 'ssl', or a dependent application) than the one named in the rule. The administrator should first verify the actual App-ID being detected via the Traffic logs or Application Command Center and ensure the rule references that exact application name.

Answer

Verify the source and destination zones are correct.

Answer

Confirm that the action is set to allow.

Answer

Check the order of security rules.

Question 13

A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?

Accepted Answer

IP Netmask. For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.

Answer

FQDN

Answer

IP Wildcard Mask

Answer

IP Range

Question 14

A firewall administrator notices that traffic from an internal user is being decrypted, but the user's browser shows a certificate warning. The firewall uses a CA certificate issued by the company's internal PKI. What is the most likely reason for the browser warning?

Accepted Answer

The firewall's root CA certificate is not installed in the user's browser trusted root store.. The browser warning indicates that the firewall's decrypted traffic is being signed with a certificate that the browser does not trust. When a firewall performs SSL/TLS decryption using a CA certificate from the company's internal PKI, the browser will only trust the decrypted connections if the root CA certificate of that PKI is installed in the browser's trusted root certificate store. Without this trust anchor, the browser cannot validate the certificate chain presented by the firewall, resulting in a certificate warning.

Answer

The decryption policy has the action 'decrypt' but no certificate profile.

Answer

The user's browser does not support TLS 1.2.

Answer

The server certificate is revoked.

Question 15

An administrator needs to decrypt HTTPS traffic from external users to the company's web servers. Which decryption policy should the administrator configure?

Accepted Answer

SSL Inbound Inspection. D is correct because SSL Inbound Inspection is specifically designed to decrypt inbound HTTPS traffic destined for company-owned web servers. The firewall acts as a destination proxy, terminating the client's TLS connection and re-encrypting traffic to the server, allowing inspection of the decrypted payload for threats.

Answer

Configure a security policy to block HTTPS

Answer

SSL Forward Proxy

Answer

No decryption is needed because the firewall can inspect HTTPS without decryption