PCNSA Practice Test 20 — 15 Questions

Question 1

Which THREE actions can improve firewall performance by reducing CPU load? (Choose three.)

Accepted Answer

Enable hardware acceleration for packet processing. Options A, C, D are correct. Enabling hardware acceleration offloads packet processing from the CPU, reducing load. Reducing log verbosity for allowed traffic lowers I/O and processing overhead. Disabling unused security profiles frees up resources. Option B is incorrect because reactive policy updates via API can introduce additional processing, not reduce CPU load. Option E is incorrect because enabling SSL decryption for all traffic significantly increases CPU load due to encryption/decryption overhead.

Answer

Use reactive policy updates via API

Answer

Enable SSL decryption for all traffic

Question 2

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Accepted Answer

Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.. Creating a security rule with the source zone (external), source IP, any destination, and action deny, placed at the top of the rulebase, is the simplest and most direct method to block all traffic from a specific IP. Option B (Zone Protection profile) is designed for flood protection and not for blocking specific IPs. Option C omits the source zone, which could allow traffic from other zones and is not as precise. Option D (DoS protection policy) is intended for rate limiting and anomaly detection, not for simply blocking a single IP address.

Answer

Use a Zone Protection profile to block the IP.

Answer

Create a security rule with source IP address and action deny.

Answer

Use a DoS protection policy to block the IP.

Question 3

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

Accepted Answer

User-ID mapping to ensure the user is correctly identified.. The issue is user-specific (only one user cannot access, others can). This suggests a problem with user identification or authentication. User-ID mapping ensures the user is correctly identified so that security rules tied to specific users (rather than just IP addresses) are applied properly. Checking User-ID mapping is the first logical step.

Answer

The application override configuration.

Answer

The security rule for the user's source zone.

Answer

The FTP server's health.

Question 4

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Accepted Answer

Antivirus. Options A, C, and E are correct. Antivirus blocks known malware, Anti-Spyware blocks spyware and grayware, and Vulnerability Protection blocks exploit attempts. Together, these three profile types provide comprehensive protection against malware. URL Filtering controls access based on categories, and File Blocking blocks specific file types, but they are not primarily malware-blocking profiles.

Answer

URL Filtering

Answer

File Blocking

Question 5

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Accepted Answer

Captive Portal. Options A and E are correct. Captive Portal authenticates users directly by requiring them to log in, and User-ID Agent collects user-to-IP mappings from directory services like Active Directory. Option B (Kerberos Authentication) is a protocol used for authentication but not a dedicated User-ID method. Option C (LDAP Synchronization) is a method for synchronizing directory data, not for identifying users in real time. Option D (XML API) is an interface for configuration, not a standard User-ID identification method.

Answer

Kerberos Authentication

Answer

LDAP Synchronization

Answer

XML API

Question 6

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Accepted Answer

The profiles are set to 'alert' instead of 'block' for the critical threat categories.. If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight. Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Answer

The antivirus signatures are outdated.

Answer

The security profiles are not attached to any security rule.

Answer

The profile groups are applied in the wrong order.

Question 7

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Accepted Answer

A previous rule with a broader match is denying the traffic before reaching the permit rule.. In a firewall rulebase, rules are evaluated from top to bottom. If a previous rule with a broader match denies the traffic, it will be blocked before reaching the permit rule lower in the list. Option B is incorrect because the implicit deny is only at the end of the rulebase; there is no implicit deny earlier. Options A and D are unrelated to the scenario: asymmetric routing from destination NAT and misconfigured application override do not cause denial when a matching permit rule exists.

Answer

The destination NAT is causing asymmetric routing.

Answer

The rule is too far down in the rulebase and a previous implicit deny is blocking.

Answer

The application override is misconfigured.

Question 8

What does a 'shadowed' rule mean in the context of policy evaluation?

Accepted Answer

A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.. A shadowed rule is one that is never evaluated because a previous rule with the same or broader match already matches the traffic. This occurs when a rule is redundant due to an earlier rule covering the same or a superset of conditions. Option B is incorrect because a rule at the bottom is still evaluated if no earlier rule matches. Option C is incorrect because a disabled rule is not the same as a shadowed rule. Option D is incorrect because a rule without an action would still be evaluated but would likely result in an error or default action, not shadowing.

Answer

A rule that is never hit because it is at the bottom of the rulebase.

Answer

A rule that is disabled.

Answer

A rule that matches traffic but has no action configured.

Question 9

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Application-ID allows granular control over applications, not just ports. Option B is a decryption policy and does not control application access. Option C is a security policy with service only, which restricts based on port/protocol, not application. Option D is policy-based forwarding, used for path selection, not for blocking applications.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 10

A security administrator is troubleshooting a rule that appears to be matching correctly but is not allowing traffic. The rule uses source zone 'Trust' and destination zone 'Untrust', and the action is 'allow'. The traffic source is in the 'DMZ' zone. What is the most likely reason the traffic is denied?

Accepted Answer

The source zone of the rule does not match the traffic's ingress zone.. The rule is configured with source zone 'Trust', but the traffic originates from the 'DMZ' zone. Since zones must match for a rule to apply, the rule does not match the traffic, so it is denied by the implicit deny rule. Options A, B, and D are incorrect: Security profiles (A) only apply after a rule matches; application identification (B) is not related to zone mismatch; and rule order (D) is irrelevant because the rule does not match due to zone mismatch.

Answer

Security profiles are blocking the traffic.

Answer

The application is not identified.

Answer

The rule is placed after a deny rule.

Question 11

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

Accepted Answer

The rule is disabled in the rulebase.. If a security policy rule is disabled in the rulebase, it will not be evaluated or enforced, even if it matches the traffic. The firewall will skip the rule entirely, meaning no logging or inspection occurs for traffic that would have matched it. This directly explains why the traffic is not being inspected or logged despite the rule appearing to be configured.

Answer

The rule is placed below an earlier rule that also matches the traffic.

Answer

The firewall's license for the threat prevention subscription has expired.

Answer

The firewall is in an active/passive HA pair and the passive unit is handling traffic.

Question 12

Refer to the exhibit. A network engineer executes the "show system info" command and sees the above output. Based on the model and PAN-OS version, which of the following is true about this firewall?

Accepted Answer

It supports maximum sessions of 5 million.. The output shows a PA-5250 firewall running PAN-OS 9.1.3. The PA-5250 is a high-end chassis-based platform that supports up to 5 million concurrent sessions, making option D correct. This session limit is a hardware specification of the PA-5200 series, not determined by the PAN-OS version alone.

Answer

It has redundant power supplies.

Answer

It supports a maximum of 10 virtual systems.

Answer

It can be upgraded to PAN-OS 11.0 directly without an intermediate version.

Question 13

A security architect is evaluating the VM-Series firewall for a private cloud deployment. Which three features are specific to the VM-Series that differentiate it from physical Palo Alto firewalls? (Choose three.)

Accepted Answer

Support for VMware NSX integration. VMware NSX integration is a VM-Series-specific capability that allows the virtual firewall to be managed as part of the NSX fabric, using NSX Service Insertion and distributed firewall rules. This integration is not available on physical Palo Alto Networks firewalls, which rely on hardware-based network interfaces and cannot be inserted into a software-defined network overlay.

Answer

Hardware-based flow acceleration

Answer

Dedicated SSL decryption ASIC

Question 14

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. The firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 15

Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?

Accepted Answer

The filter syntax is invalid; 'andd' should be 'and'.. The dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.

Answer

The address object must be a member of a static address group to be included in a dynamic group.

Answer

The security rule must specify the source zone explicitly.

Answer

The dynamic address group filter uses 'andd' which is a valid operator in older PAN-OS versions.

Answer

The dynamic address group only updates its membership after a system reboot.