PCNSA Practice Exam 2 — 20 Questions

Question 1

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The internal interface (ethernet1/2) is administratively down. The exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 2

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 3

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Accepted Answer

The traffic will be denied by the implicit deny rule because the application does not match.. The security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it. Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Answer

The traffic will be allowed if the user uses HTTP instead.

Answer

The traffic will be allowed because the rule has log-start enabled.

Answer

The traffic will be allowed because the source and destination zones match.

Question 4

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Policy Optimizer requires a valid support license to access the cloud-based service that analyzes rules. Options A, C, and D are not prerequisites; Policy Optimizer can analyze any rule regardless of security profiles, logging settings, or hit count rank.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 5

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Accepted Answer

Configure Panorama to collect logs.. Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Answer

Use the CLI command 'show log traffic'.

Answer

Use SNMP to retrieve logs.

Answer

View logs in the Monitor tab.

Question 6

A company deploys a Palo Alto Networks firewall in a cloud environment using the VM-Series. The firewall must scale to handle traffic spikes. Which architectural approach provides the best elasticity and management simplicity?

Accepted Answer

Use a VM-Series firewall with auto-scaling group and integration with Panorama.. Using a VM-Series firewall with an auto-scaling group and integration with Panorama provides the best elasticity and management simplicity. Auto-scaling dynamically adjusts the number of firewall instances based on traffic load, while Panorama centralizes configuration, policy management, and monitoring, eliminating the need for manual per-instance management. This approach aligns with cloud-native principles for scaling and operational efficiency.

Answer

Deploy multiple VM-Series firewalls in active/active HA with a virtual load balancer.

Answer

Use a single large VM-Series instance.

Answer

Combine physical and virtual firewalls with a shared configuration.

Question 7

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 8

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

Accepted Answer

The application filter must specify the parent application 'facebook' because 'facebook-base' is a sub-application.. In Panorama, application filters require the parent application name when filtering by sub-application. 'facebook-base' is a sub-application of 'facebook', so the correct filter should be '(app eq facebook) (subapp eq facebook-base)'. Option A correctly identifies that the filter must specify the parent application. Option B is incorrect because Panorama supports both scheduled and ad-hoc queries. Option C is incorrect because the report template does not need to be committed to a device group; reports are run independently. Option D is incorrect because log forwarding to Panorama is configured in the log forwarding profile, but the port is not the issue; the logs are already forwarded.

Answer

Panorama only supports scheduled reports, not ad-hoc queries.

Answer

The report template is not committed to the device group.

Answer

The firewall's log forwarding profile must be set to send logs to Panorama on a separate port.

Question 9

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 10

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Accepted Answer

The traffic is being dropped due to a security policy rule that denies the traffic. If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer

The traffic is intra-zone, not inter-zone

Answer

The firewall is using hardware offload for fast-path processing

Answer

The packet is part of an existing session that has not timed out

Question 11

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 12

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies. WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 13

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Accepted Answer

Verify that the policy has the correct source zone.. Options B and C are correct. Verifying the source zone (B) ensures the policy is applied to the correct traffic flow. Checking the traffic log (C) shows whether the session matched a security policy. Option A (CPU usage) does not verify policy matching. Option D (Threat log) is for blocked malicious traffic, not for verifying allowed traffic. Option E (URL filtering profile) is a content inspection feature, not directly for verifying policy matching.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 14

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule. This is a standard method of creating an exception to a broader deny rule.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 15

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 16

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Placing the most specific rules at the top of the rulebase (option B) ensures that traffic is matched quickly and correctly, reducing latency. Regularly reviewing and removing unused rules using hit counts (option D) improves performance and reduces security risks. Option A is wrong because enabling logging on all rules can overwhelm storage and impact performance, not increase visibility effectively. Option C is wrong because using a single 'allow all' rule defeats the purpose of a security policy and allows any traffic. Option E is wrong because disabling unused rules leaves clutter and can cause confusion; it's better to remove them.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 17

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options C and D are correct. To ensure traffic is inspected by threat prevention features, you need a security rule that allows the traffic and includes a security profile group with threat prevention (C). Additionally, the rule's action must be set to 'allow' (D) for the traffic to pass through and be inspected; otherwise, traffic would be blocked. Option A (decryption) is only required for encrypted traffic, but the question does not specify that all traffic is encrypted, so it is not universally required. Option B (NAT) is for address translation, not inspection. Option E (application override) is not necessary for threat prevention.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 18

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. Logging at session start records the session creation, which corresponds to when the session is established. This meets the administrator's requirement to log traffic from engineering to server zone only when a session is established. Option A (log at both session start and end) is incorrect because it would create duplicate logs and potentially excessive logging. Option B (no log) is incorrect because it provides no audit trail. Option C (log at session end) is incorrect because it logs only when the session terminates, not at establishment.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 19

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection. Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 20

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.