PCNSA Practice Test 20 — 15 Questions

Question 1

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Palo Alto Networks next-generation firewalls identify applications rather than just ports, so a single security policy using the application set 'web-browsing' (HTTP) and 'ssl' (HTTPS) with action allow accomplishes the requirement in one rule. This leverages App-ID to permit only the intended web traffic from Untrust to DMZ while implicitly denying everything else via the default interzone deny. Using applications instead of services is the most efficient and secure approach.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 2

Which THREE are valid components of Content-ID? (Choose three.)

Accepted Answer

URL Filtering. Content-ID is Palo Alto Networks' integrated threat and content inspection engine, and its valid components include URL Filtering (C), which classifies and controls web traffic by URL category; File Blocking (D), which detects and blocks file transfers based on file type and direction; and Data Filtering (E), which inspects traffic for sensitive data patterns such as credit card or Social Security numbers. These three are all profile types configured under Content-ID and applied in security policy to inspect allowed traffic. Application Filters (A) and Application Override (B) are not Content-ID components: Application Filters are used within App-ID to dynamically group applications by characteristics (category, subcategory, technology, risk, etc.), and Application Override is a policy rule that forces specific traffic to be identified as a specified application, bypassing standard App-ID inspection. Both belong to the App-ID/policy framework rather than the Content-ID inspection engine.

Answer

Application Filters

Answer

Application Override

Question 3

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Option C is correct because privacy and compliance regulations (such as PCI-DSS, HIPAA, and GDPR) prohibit or restrict the interception of traffic to financial and healthcare sites, so these destinations should be added to the SSL Forward Proxy decryption exclusion list to avoid legal and privacy violations. Option E is correct because SSL Forward Proxy decryption requires the firewall to re-sign the server certificate with its own CA; for clients to trust this re-signed certificate and avoid certificate errors, the firewall's forward-trust CA certificate must be installed in the trusted root store of all client devices. Option A is not a best practice because using a self-signed certificate for decryption causes trust errors on clients and does not provide a manageable, trusted CA chain. Option B is not a best practice because decrypting all internal server-to-server traffic is unnecessary, adds significant processing overhead, and can break applications that use certificate pinning or mutual TLS. Option D is not a best practice because decrypting all outbound traffic regardless of destination ignores privacy, compliance, and performance considerations, and traffic to sensitive categories should be excluded.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 4

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080

Question 5

Which TWO are best practices for securing management access to a Palo Alto firewall? (Select two)

Accepted Answer

Use a dedicated management subnet. Using a dedicated management subnet (out-of-band management) isolates management traffic from production data traffic, reducing the attack surface and ensuring management access remains available even if the data plane is compromised. This is a foundational security best practice for any network device, including Palo Alto firewalls.

Answer

Use HTTPS with self-signed certificates

Answer

Use SNMP v1 for monitoring

Answer

Disable ping on the management interface

Question 6

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Accepted Answer

A previous rule with a broader match is denying the traffic before reaching the permit rule.. In a firewall rulebase, rules are evaluated from top to bottom. If a previous rule with a broader match denies the traffic, it will be blocked before reaching the permit rule lower in the list. Option B is incorrect because the implicit deny is only at the end of the rulebase; there is no implicit deny earlier. Options A and D are unrelated to the scenario: asymmetric routing from destination NAT and misconfigured application override do not cause denial when a matching permit rule exists.

Answer

The destination NAT is causing asymmetric routing.

Answer

The rule is too far down in the rulebase and a previous implicit deny is blocking.

Answer

The application override is misconfigured.

Question 7

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Accepted Answer

The route via 10.0.0.2 on ethernet1/3. The firewall selects the route with the lowest administrative distance (AD) for forwarding traffic to 10.0.1.1. In this scenario, the route via 10.0.0.2 on ethernet1/3 has an AD of 10 (typically OSPF), which is lower than the AD of 20 (static route) and 110 (RIP). Therefore, it is the preferred route.

Answer

The route via 10.0.0.3 on ethernet1/4

Answer

The route via 10.0.0.4 on ethernet1/5

Answer

All three routes are used in ECMP

Question 8

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

Accepted Answer

The rule order is incorrect; the allow rule is below the 'Deny All' rule.. In Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Answer

The application 'web-browsing' is not being properly identified by App-ID.

Answer

The source address object for the allow rule is misconfigured with a wrong subnet mask.

Answer

The User-ID agent is overriding the allow rule and triggering a block action.

Question 9

A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?

Accepted Answer

Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10. Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.

Answer

Search Threat logs for the destination IP

Answer

Search Config logs for any rule changes

Answer

Search System logs for the user's IP

Question 10

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Accepted Answer

Captive Portal. Options A and E are correct. Captive Portal authenticates users directly by requiring them to log in, and User-ID Agent collects user-to-IP mappings from directory services like Active Directory. Option B (Kerberos Authentication) is a protocol used for authentication but not a dedicated User-ID method. Option C (LDAP Synchronization) is a method for synchronizing directory data, not for identifying users in real time. Option D (XML API) is an interface for configuration, not a standard User-ID identification method.

Answer

Kerberos Authentication

Answer

LDAP Synchronization

Answer

XML API

Question 11

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

Accepted Answer

rule3.. Rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Answer

rule2.

Answer

rule1.

Answer

None, because rule1 and rule2 have specific applications.

Question 12

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Accepted Answer

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.. It uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

Answer

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Answer

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Answer

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Question 13

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Accepted Answer

Privacy regulations. Privacy regulations such as GDPR, HIPAA, or PCI DSS often restrict the decryption of traffic containing personally identifiable information (PII) or protected health information (PHI). Decrypting such traffic without proper safeguards can lead to legal penalties and data breach exposure. Palo Alto Networks firewalls can apply decryption policies that exclude traffic to specific URL categories or IP ranges to remain compliant with these regulations.

Answer

The cost of SSL certificates

Answer

User productivity

Question 14

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny

Question 15

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

Accepted Answer

Create rules with the most specific conditions first. Best practice is to create security policy rules with the most specific conditions first. This ensures that specific traffic is matched before more general rules, reducing the risk of unintended matches. Option A is incorrect because using 'any' for source and destination zones is not a best practice; it should be avoided to maintain granularity. Option C is incorrect because mixing inbound and outbound rules in the same rulebase section can lead to confusion and is not recommended; rules should be grouped logically. Option D is incorrect because specific rules should be placed above general rules, not the other way around.

Answer

Use 'any' for source and destination zones to save time

Answer

Mix inbound and outbound rules in the same rulebase section

Answer

Place general rules above specific rules