PCNSA Practice Test 21 — 15 Questions

Question 1

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

Accepted Answer

The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.. App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Answer

The firewall is not connected to the cloud for App-ID updates.

Answer

Decryption is not enabled for Google Drive traffic.

Answer

An application override is configured for Google Drive.

Question 2

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 3

A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.

Answer

Custom URL Category

Answer

Address Group

Answer

Application Filter

Question 4

A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?

Accepted Answer

Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.. The 'application mismatch' denial indicates that the firewall's App-ID engine identified the traffic as a different application than the one allowed in the security policy. This can occur if the application signature is outdated or if the traffic pattern does not match the expected 'crm-base' application. Updating signatures and potentially adding a fallback application or custom App-ID is the correct course of action.

Answer

Enable SSL decryption to inspect the traffic and improve application identification.

Answer

Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.

Answer

Check that the destination address object for the CRM server is correct and includes the CDN IPs.

Question 5

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

Accepted Answer

The rule has 'Log at Session End' disabled. The 'Log at Session End' setting on a security policy rule controls whether traffic matching that rule generates a Traffic log entry when the session closes. If this setting is disabled, the firewall will allow the traffic per the rule but will not record it in the Traffic logs, which matches the scenario where traffic is permitted but not logged.

Answer

Zone Protection profile is set to 'Log at Session Start'

Answer

The Log Forwarding profile is not applied

Answer

Disable Server Response Inspection on the rule

Question 6

Refer to the exhibit. A user in the trust zone attempts to access https://www.example.com. The traffic matches rule 2 first. What is the expected behavior?

Accepted Answer

The traffic is denied because of rule 2.. In Palo Alto Networks security policy, rules are evaluated top-down and the first match wins. Since the traffic matches rule 2 first, rule 2's action (deny) is applied immediately, and no further rules are evaluated. Therefore, the traffic is denied, regardless of rule 3 allowing web-browsing or the implicit allow at the end.

Answer

The traffic is allowed due to the implicit allow at the end.

Answer

The traffic is allowed because rule 3 allows web-browsing.

Answer

The traffic is allowed because no explicit deny is configured.

Question 7

A company deploys a Palo Alto Networks firewall in a cloud environment using the VM-Series. The firewall must scale to handle traffic spikes. Which architectural approach provides the best elasticity and management simplicity?

Accepted Answer

Use a VM-Series firewall with auto-scaling group and integration with Panorama.. Using a VM-Series firewall with an auto-scaling group and integration with Panorama provides the best elasticity and management simplicity. Auto-scaling dynamically adjusts the number of firewall instances based on traffic load, while Panorama centralizes configuration, policy management, and monitoring, eliminating the need for manual per-instance management. This approach aligns with cloud-native principles for scaling and operational efficiency.

Answer

Deploy multiple VM-Series firewalls in active/active HA with a virtual load balancer.

Answer

Use a single large VM-Series instance.

Answer

Combine physical and virtual firewalls with a shared configuration.

Question 8

A large financial institution runs a PA-5250 firewall in a virtual wire mode between two core switches. The firewall is configured with multiple virtual wire sub-interfaces to segregate traffic for different VLANs. Recently, the security team noticed that multicast traffic from a critical trading application is not being forwarded across the virtual wire link. The firewall has multicast policies enabled, and the trading application uses IGMPv3. The administrator has verified that the firewall's multicast policy allows the traffic and that the IGMP snooping is enabled on the adjacent switches. However, the multicast stream does not reach the receivers on the other side. Which step should the administrator take to resolve this issue?

Accepted Answer

Enable IGMP snooping on the virtual wire sub-interfaces of the firewall.. In a virtual wire deployment, the firewall does not participate in Layer 2 protocols like IGMP snooping by default. Even if multicast policies are enabled, the firewall must explicitly perform IGMP snooping on its virtual wire sub-interfaces to track multicast group memberships and forward the traffic correctly. Enabling IGMP snooping on the sub-interfaces allows the firewall to intercept IGMPv3 membership reports and build the necessary forwarding state for the multicast stream.

Answer

Increase the multicast traffic bandwidth limit in the QoS policy.

Answer

Change the virtual wire mode to layer 3 mode and configure PIM.

Answer

Configure a static multicast MAC address mapping on the firewall.

Question 9

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal users and the internet. The security team wants to enforce different security profiles based on the destination country of outbound traffic. They have created a Security policy rule that allows web-browsing and ssl from the trust zone to the untrust zone. They now need to apply a URL Filtering profile that blocks malicious sites only when the destination IP is geolocated in a specific high-risk country. What should the administrator configure to achieve this?

Accepted Answer

Create a new Security policy rule above the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.. The correct configuration creates a new Security policy rule with a destination region match for the high-risk country, placed above the existing rule. This ensures that traffic to that country is evaluated first and receives the URL Filtering profile, while other traffic continues to be handled by the original rule. This leverages geolocation objects and rule ordering to apply security profiles conditionally.

Answer

Modify the existing Security policy rule to include a destination region object for the high-risk country and attach the URL Filtering profile.

Answer

Create a new Security policy rule below the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.

Answer

In the Security policy rule, add a source region object for the high-risk country and attach the URL Filtering profile.

Question 10

An administrator needs to create a security rule that permits HTTP and HTTPS access to a web server cluster. The cluster members are defined as address objects named Web1, Web2, and Web3. The administrator wants to reference these three objects as a single entity in the security rule. Which object type should be created?

Accepted Answer

Address Group. The correct answer is the address group, which is designed to group multiple address objects for use in policy. By creating a static address group containing Web1, Web2, and Web3, the administrator can reference a single object in the security rule, reducing administrative overhead and ensuring consistency. Other object types serve different purposes: service groups group services, dynamic address groups rely on tags, and EDLs import external lists.

Answer

Service Group

Answer

Dynamic Address Group

Answer

External Dynamic List

Question 11

A network administrator is configuring a security policy to allow SSH access to a server. The administrator wants to use a predefined service object for SSH. Which service object should be selected?

Accepted Answer

ssh. The predefined service object 'ssh' is the correct choice because it is already defined in PAN-OS with the appropriate protocol (TCP) and port (22). Using predefined services simplifies policy creation and ensures accuracy. The other options are either non-existent or custom names that would require manual creation, which does not meet the requirement of using a predefined object.

Answer

ssh-tcp

Answer

service-ssh

Answer

tcp-22

Question 12

An administrator is configuring a Dynamic Address Group (DAG) to automatically include all servers that have the tag 'WebServer'. The DAG will be used in a security policy. Which two of the following statements are true regarding the configuration and behavior of this DAG? (Choose two.)

Accepted Answer

The DAG can be referenced in a security policy as a source or destination address.. Dynamic Address Groups automatically update their membership based on tag changes, and they can be used in security policies as source or destination addresses. These two characteristics make DAGs powerful for dynamic environments where server roles or IPs change frequently.

Answer

The DAG requires the firewall to be connected to a User-ID agent to function.

Answer

The DAG can only contain IP addresses from a single subnet.

Answer

The DAG filter must be written in a specific regular expression syntax.

Question 13

A network security administrator needs to create an address object that represents a range of IP addresses from 10.1.1.10 to 10.1.1.20. Which address object type should be used?

Accepted Answer

IP Range. The requirement is to represent a specific range of IP addresses from 10.1.1.10 to 10.1.1.20. PAN-OS provides an address object type called IP Range that allows defining a start and end IP address. This type is designed exactly for such scenarios, enabling efficient policy management without needing to list each address individually or use a subnet that might include unwanted addresses.

Answer

FQDN

Answer

Dynamic

Answer

IP Netmask

Question 14

An administrator is configuring a security policy and needs to allow access to a set of web servers that are defined by a dynamic address group. The dynamic address group uses the filter 'web-server' and tags are applied to the address objects. However, the administrator notices that the dynamic group is not populating with the expected members. Which action should the administrator take to troubleshoot this issue?

Accepted Answer

Verify that the tag 'web-server' is registered on the firewall and applied to the correct address objects.. Dynamic address groups populate based on tags applied to address objects. The filter must reference existing tags that are applied correctly. If the group is empty, the most likely cause is that the tag is missing or not applied to the intended address objects. Verifying tag registration and application directly addresses the root cause.

Answer

Restart the management plane to refresh the dynamic address group membership.

Answer

Check that the firewall has a valid license for dynamic address groups.

Answer

Ensure that the dynamic address group is referenced in a security policy with the correct source and destination zones.

Question 15

An administrator is creating a Dynamic Address Group (DAG) that should include all servers tagged with 'web' and 'prod'. The firewall is configured to use a VMware NSX-T service manager for tag registration. Which configuration is required to ensure the DAG is populated correctly?

Accepted Answer

Create an address group with type 'Dynamic' and a match filter that uses the tags 'web' and 'prod' with an 'and' operator.. To create a Dynamic Address Group that includes only servers with both 'web' and 'prod' tags, the administrator must configure the DAG with a match filter that uses the 'and' operator between the tags. This ensures that only addresses that have both tags are included. The DAG must also be linked to the NSX-T service manager as the source of tags, but the filter logic is critical for correct membership.

Answer

Create a Dynamic Address Group and configure it to use the 'Any' filter, then rely on NSX-T to push the correct IP addresses.

Answer

Create a Dynamic Address Group with a filter that uses the tags 'web' or 'prod' with an 'or' operator.

Answer

Create an address group with type 'Static' and manually add the IP addresses of the servers.