PCNSA Practice Exam 2 — 20 Questions

Question 1

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Accepted Answer

Check the traffic log to see if the policy is matched. The first step in troubleshooting a decryption policy that is not decrypting traffic is to check the traffic log to confirm whether the policy is actually being matched. If the traffic does not match the decryption rule, no decryption will occur regardless of certificate validity or other settings. This aligns with the systematic troubleshooting approach of verifying policy application before investigating deeper configuration issues.

Answer

Verify that the decryption certificate is valid

Answer

Disable the SSL/TLS service profile

Answer

Ensure that the server's certificate is imported

Question 2

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 3

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings

Question 4

Which Palo Alto Networks subscription service provides real-time threat intelligence about unknown files and links?

Accepted Answer

WildFire. WildFire is the correct answer because it is Palo Alto Networks' cloud-based threat analysis service specifically designed to detect and block unknown malware, zero-day exploits, and advanced persistent threats. It analyzes files and links in a sandboxed environment, correlating behavioral indicators with real-time threat intelligence to generate signatures that protect the entire network.

Answer

URL Filtering

Answer

DNS Security

Answer

Threat Prevention

Question 5

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Accepted Answer

Enable Session Setup and State Synchronization under HA configuration. Session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Answer

Configure HA1 and HA2 interfaces with appropriate IPs

Answer

Enable Config Sync on the HA General tab

Answer

Configure Path Monitoring to detect link failures

Question 6

What is the purpose of the 'Telemetry' feature in PAN-OS?

Accepted Answer

To send anonymous device health and usage data to Palo Alto Networks. The Telemetry feature in PAN-OS sends anonymous device health and usage data to Palo Alto Networks to help improve product development and threat detection. This data includes information such as system resource utilization, feature usage statistics, and aggregate threat information, but does not include sensitive or personally identifiable information. It is an opt-in feature that enhances Palo Alto Networks' ability to provide proactive support and security updates.

Answer

To send logs to Panorama

Answer

To enable DNS proxy

Answer

To configure User-ID agent

Question 7

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Accepted Answer

Pattern matching (signatures). App-ID identifies applications primarily through pattern matching (signatures) (D), which inspects packet payloads against a database of application-specific signatures to recognize known applications, and protocol decoding (E), which decodes the application-layer protocol to understand its behavior and enforce policy even when traffic is encrypted or evasive. These two techniques are the core detection mechanisms Palo Alto Networks documents for App-ID, working alongside behavioral heuristics and decryption. URL filtering (A) is a separate security profile that controls web access by category, not an App-ID identification method. Source port number (B) and source IP address (C) are Layer 3/4 header attributes used in traditional firewall rules, not application identification techniques.

Answer

URL filtering

Answer

Source port number

Answer

Source IP address

Question 8

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

Accepted Answer

Data Filtering. Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Answer

URL Filtering

Answer

File Blocking

Answer

WildFire

Question 9

Which THREE are default security profile groups in PAN-OS? (Choose three.)

Accepted Answer

Strict. In PAN-OS, the predefined Security Profile Groups are Strict, Alert, and Best Practice, so options A, C, and E are correct. The Strict group (A) applies aggressive block/drop actions across Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and WildFire profiles, making it suitable for high-security enforcement. The Alert group (C) is designed for monitoring rather than blocking, using alert/allow actions so administrators can observe traffic before enforcing policy. The Best Practice group (E) bundles Palo Alto Networks-recommended settings for each profile type to provide balanced, vendor-recommended protection. Option B (Server) is not a default profile group; it is a common custom grouping name, and option D (Custom) is merely a label for user-created groups, not a predefined PAN-OS default.

Answer

Server

Answer

Custom

Question 10

During troubleshooting, an administrator needs to review firewall system events such as user logins, configuration changes, and commit failures. Which log type should be examined?

Accepted Answer

System logs. System logs in Palo Alto Networks firewalls capture administrative and system-level events, including user logins, configuration changes, and commit failures. These logs are generated by the management plane and are essential for auditing and troubleshooting device management activities.

Answer

Threat logs

Answer

Traffic logs

Answer

URL filtering logs

Question 11

Which of the following is a primary benefit of using App-ID in a security policy?

Accepted Answer

It enforces policies based on the actual application, irrespective of port or encryption.. App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Answer

It allows blocking traffic based on port numbers only.

Answer

It only works for known applications.

Answer

It can only be applied to outbound traffic.

Question 12

Which two authentication methods can be used for administrative access to the firewall's web interface? (Choose two.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is correct because it enables single sign-on (SSO) for administrative access to the firewall's web interface, allowing integration with external identity providers (IdPs) such as Okta or Microsoft Entra ID. The local database is correct because it is the default authentication method, where administrators are created and stored locally on the firewall, and credentials are verified against the internal user database. Both methods are natively supported in PAN-OS for web interface (GUI) access.

Answer

NTLM

Answer

OAuth

Answer

Kerberos

Question 13

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 14

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.. In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry. The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Answer

OSPF is flapping and causing route instability.

Answer

A DDoS attack is overwhelming the management plane.

Answer

The firewall's licenses have expired, causing feature degradation.

Question 15

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

Accepted Answer

Dataplane resources are exhausted. The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Answer

The firewall has been recently rebooted

Answer

System CPU is too high

Answer

The session limit is being reached

Question 16

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 17

Refer to the exhibit. A security analyst reviews a traffic log entry in JSON format. Which firewall feature is responsible for including the 'user' field in the log?

Accepted Answer

User-ID. The 'user' field in a traffic log is populated by User-ID, which maps IP addresses to usernames by monitoring authentication events from Active Directory, LDAP, or terminal services agents. This allows the firewall to log and enforce policies based on user identity rather than just IP addresses.

Answer

Data Filtering

Answer

Captive Portal

Answer

GlobalProtect

Question 18

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

Accepted Answer

App-ID has not yet completed identification because the session is new or requires more packets.. When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Answer

The security rule is misconfigured because it lacks an application field.

Answer

The firewall does not have an App-ID signature for the website.

Answer

SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

Question 19

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

Accepted Answer

NAT rules are evaluated from top to bottom, and the first match is applied. Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Answer

NAT rules are evaluated after security rules

Answer

NAT rules use longest prefix match on the destination address

Answer

NAT rules cannot combine source and destination NAT in a single rule

Question 20

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Option B is correct because Palo Alto Networks evaluates security rules top-down and stops at the first match, so placing the most specific rules above broader ones ensures precise traffic handling and prevents a general rule from shadowing a narrower one. Option D is correct because the firewall tracks hit counts per rule, and periodically reviewing those counters to identify and delete rules with zero hits reduces rulebase bloat and shrinks the attack surface. Option A is not a best practice since logging every rule, including high-volume allow rules, generates excessive log traffic and storage overhead; logging should be targeted to security-relevant events. Option C is wrong because a single 'allow all' rule defeats the purpose of a least-privilege, zone-based policy and provides no visibility or control. Option E is wrong because disabling rather than removing unused rules leaves dead configuration in the rulebase, and proper hygiene calls for deletion after confirming zero hits.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.