PCNSA Practice Exam 3 — 20 Questions

Question 1

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. In PAN-OS, committing a candidate configuration pushes the new policy into the running configuration, but security policy evaluation happens at session setup. Existing sessions continue to be evaluated against the policy that was in force when the session was created, so users with long-lived or already-established sessions keep the old behavior while users opening new sessions get the new rule. This explains why only some users report issues after the commit.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 2

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Accepted Answer

The rule is positioned below an allow rule that matches the same traffic.. The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

Answer

The source IP is negated in the rule.

Answer

The rule is placed at the top of the rulebase and overridden by a later rule.

Answer

The rule is disabled in the rulebase.

Question 3

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 4

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

Accepted Answer

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed. For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Answer

The VLAN interface needs an IP address configured

Answer

The VLAN interface must be assigned to a virtual router

Answer

The firewall needs a commit to apply the changes

Question 5

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Accepted Answer

The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.. After a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Answer

The firewall's CPU and memory are insufficient for the new PAN-OS version.

Answer

The firewall is performing a backup of the configuration.

Answer

The rulebase has grown too large.

Question 6

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. The firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 7

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Accepted Answer

SSH Proxy. SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Answer

SSL Forward Proxy

Answer

Inbound Inspection

Answer

Decryption Mirror

Question 8

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

Accepted Answer

Use Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Answer

Use CLI scripts

Answer

Use a dedicated management server

Answer

Use SNMP

Question 9

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

SSL Inbound Inspection. SSL Inbound Inspection (C) is a valid decryption method: the firewall is configured with the server's certificate and private key so it can decrypt traffic destined to an internal server, which is the standard approach for protecting inbound connections to your own web servers. SSL Forward Proxy (E) is also valid: the firewall acts as a man-in-the-middle, generating a forged certificate signed by a trusted CA and decrypting outbound client-initiated SSL/TLS sessions to inspect them. The other options are not decryption methods for SSL/TLS: IPsec Decryption (A) applies to IPsec VPN traffic, not SSL/TLS; SSH Proxy (B) is for controlling SSH sessions, not decrypting SSL/TLS; and Decryption Mirror (D) is a feature for copying decrypted traffic to a destination for analysis, not a method to decrypt SSL/TLS itself.

Answer

IPsec Decryption

Answer

SSH Proxy

Answer

Decryption Mirror

Question 10

Users report that some internal services are not accessible when connected via VPN, but they work when on the local network. The firewall has a policy allowing all traffic from the VPN zone to the internal zone. What should the administrator check first?

Accepted Answer

Check if there are NAT rules that affect the VPN zone traffic, such as missing reverse NAT.. When internal services work on the local network but fail over VPN, and the security policy allows VPN-to-internal traffic, the most likely culprit is NAT. If the VPN zone traffic is being source-NATed (e.g., to an interface IP) or if reverse NAT is missing for return traffic, the internal servers may not have a route back or may reject the connection. Checking NAT rules affecting the VPN zone, including reverse NAT, is the first logical step.

Answer

Check if SSL decryption is breaking the traffic.

Answer

Check if the zone protection profile is dropping traffic.

Answer

Check if the security policy rule order is correct.

Question 11

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Accepted Answer

A rule with a broader match exists above the blocking rule in the rulebase.. In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Answer

The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

Answer

The custom object containing the malicious IP was not committed.

Answer

The device clock is out of sync, causing time-based rules to fail.

Question 12

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Accepted Answer

Apply the log forwarding profile to a security policy rule.. A log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Answer

Set the syslog server to use TCP port 514.

Answer

Specify the syslog facility code in the log forwarding profile.

Question 13

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Accepted Answer

Block the social-networking category and allow a custom URL category containing LinkedIn URLs.. To block all social media except LinkedIn, you must block the social-networking URL category and allow a custom URL category containing LinkedIn URLs. URL filtering evaluates custom categories with higher priority than predefined categories, so the allow action for LinkedIn overrides the block for social-networking. This achieves the granular exception without unblocking the entire category.

Answer

Alert the social-networking category and block a custom URL category for LinkedIn.

Answer

Block the social-networking category and block a custom URL category for LinkedIn.

Answer

Allow the social-networking category and block a custom URL category for LinkedIn.

Question 14

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

Accepted Answer

Asymmetric routing. The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Answer

Application override configured for HTTP

Answer

DNS resolution failure

Answer

NAT policy mismatch

Question 15

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. Option A is correct because a security rule that references the application by name (via App-ID) and sets the action to 'deny' blocks all traffic identified as that application regardless of which ports it uses, which is exactly what is needed for a multi-port application. Option E is correct because an Application Override policy lets the firewall reclassify traffic on specified ports as a known application, after which a security rule can deny that application, providing a way to block traffic that App-ID might not otherwise identify across its multiple ports. Option B is not ideal because blocking only the common ports leaves the application free to use other ports, so it does not reliably block all traffic from the application. Option C is wrong because disabling App-ID removes the ability to identify and control the application by name. Option D is wrong because allowing the application with a limit still permits traffic rather than blocking it.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 16

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 17

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Accepted Answer

Create a decryption exclusion rule for specific URLs or categories.. Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites. Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Answer

Rely on the browser's security settings to prevent decryption.

Answer

Disable SSL Decryption globally when the user visits sensitive sites.

Answer

Use a policy to decrypt only HTTP traffic.

Question 18

A network engineer is configuring a new PA-220 firewall in a small branch office. The firewall must be managed centrally from Panorama. What is the first step after physically installing the firewall?

Accepted Answer

Configure the management IP address and authenticate to Panorama.. The correct first step after physically installing a Palo Alto Networks firewall is to configure the management IP address and authenticate to Panorama. Without a reachable management IP, the firewall cannot communicate with Panorama for registration, device group assignment, or configuration pushes. This foundational step establishes the initial network connectivity required for all subsequent centralized management operations.

Answer

Register the firewall with Panorama using the serial number.

Answer

Create a device group in Panorama and add the firewall.

Answer

Push the initial configuration from Panorama to the firewall.

Question 19

Which TWO statements about App-ID are correct? (Choose two.)

Accepted Answer

App-ID can identify applications even if they use standard ports for other services.. Option A is correct because App-ID performs application identification through deep packet inspection and protocol decoding rather than relying on TCP/UDP port numbers, so it can detect an application even when it runs on a port normally associated with a different service (for example, SSH tunneled over port 80 or peer-to-peer traffic on port 443). Option D is correct because App-ID relies on a signature- and context-based engine that matches known application traffic patterns, protocol behaviors, and heuristics to classify applications accurately. Options B, C, and E are incorrect: App-ID is not limited to well-known commercial applications (it also identifies custom, evasive, and unknown applications), it does not primarily identify applications by port numbers (that is the legacy port-based approach App-ID replaces), and it does not require a fixed minimum of 10 packets, since identification can occur after the first few packets or even the first packet depending on the protocol.

Answer

App-ID is only effective for well-known commercial applications.

Answer

App-ID primarily identifies applications based on port numbers.

Answer

App-ID requires at least 10 packets to identify an application.

Question 20

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

Accepted Answer

The service group should not include service-https. The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Answer

The application web-browsing should not be in the rule

Answer

The rule action should be deny

Answer

The source IP should be an address group