PCNSA Practice Test 21 — 15 Questions

Question 1

An organization uses App-ID to allow 'web-browsing' but notices that some web traffic is being blocked. The traffic is HTTP over port 8080. What is a likely cause?

Accepted Answer

The security rule does not have Application set to 'web-browsing' for that traffic.. If the security rule does not have 'web-browsing' set as the Application, the firewall will not allow HTTP traffic even if the port (8080) is permitted. App-ID identifies the application regardless of port, but the security policy must explicitly allow the application for the traffic to pass. In this case, the traffic is being blocked because the rule either has a different application or no application specified, so the firewall drops it by default.

Answer

The 'web-browsing' application does not include HTTP.

Answer

A custom application must be created for port 8080.

Answer

App-ID cannot identify HTTP over non-standard ports.

Question 2

A firewall administrator notices that traffic from an internal user is being decrypted, but the user's browser shows a certificate warning. The firewall uses a CA certificate issued by the company's internal PKI. What is the most likely reason for the browser warning?

Accepted Answer

The firewall's root CA certificate is not installed in the user's browser trusted root store.. The browser warning indicates that the firewall's decrypted traffic is being signed with a certificate that the browser does not trust. When a firewall performs SSL/TLS decryption using a CA certificate from the company's internal PKI, the browser will only trust the decrypted connections if the root CA certificate of that PKI is installed in the browser's trusted root certificate store. Without this trust anchor, the browser cannot validate the certificate chain presented by the firewall, resulting in a certificate warning.

Answer

The decryption policy has the action 'decrypt' but no certificate profile.

Answer

The user's browser does not support TLS 1.2.

Answer

The server certificate is revoked.

Question 3

An administrator is troubleshooting why an application is being identified as 'incomplete' in the traffic log. What does this indicate?

Accepted Answer

The session was terminated before App-ID could complete.. When App-ID cannot complete its analysis before the session terminates, the traffic log marks the application as 'incomplete'. This typically happens with short-lived sessions or when the firewall receives insufficient data packets to match a signature or decode the protocol. The correct answer is B because App-ID requires multiple packets or a full handshake to definitively identify the application.

Answer

The application is using a non-standard port.

Answer

The firewall could not determine the application.

Answer

The application is unknown to the firewall.

Question 4

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Accepted Answer

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.. Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Answer

Use URL Filtering to block BitTorrent.

Answer

Use Data Filtering to block BitTorrent traffic.

Answer

Block the commonly used ports for BitTorrent.

Question 5

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

Accepted Answer

Data Filtering. Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Answer

URL Filtering

Answer

File Blocking

Answer

WildFire

Question 6

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Accepted Answer

Block the social-networking category and allow a custom URL category containing LinkedIn URLs.. It blocks the entire social-networking category and then creates a custom URL category for LinkedIn with an allow override, allowing LinkedIn while blocking all other social media. Option B is incorrect because alerting does not block, so social media would not be blocked. Option C is incorrect because it would block both the category and LinkedIn, resulting in LinkedIn being blocked. Option D is incorrect because allowing the social-networking category would allow all social media, including those that should be blocked.

Answer

Alert the social-networking category and block a custom URL category for LinkedIn.

Answer

Block the social-networking category and block a custom URL category for LinkedIn.

Answer

Allow the social-networking category and block a custom URL category for LinkedIn.

Question 7

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

Accepted Answer

Create an allow rule for internal source addresses, then a deny rule for any source.. Correct answer is C. Rule order is critical: Palo Alto firewalls evaluate rules top-down, and the first match is applied. By placing an allow rule for internal source addresses first, internal traffic is permitted. Then a subsequent deny rule for any source blocks all other traffic, including external IPs. Option A is incorrect because creating a deny rule for external IPs first would block external traffic but does not guarantee internal access if the deny rule is overly broad or if any later rule could inadvertently allow external traffic. Option B is incorrect because placing the allow rule after the deny rule would cause the deny rule to match all traffic first, including internal, since the deny rule typically covers any source. Option D is incorrect because a single deny rule with a user-ID condition cannot differentiate between internal and external users unless all internal users are authenticated, which is impractical for basic IP-based access control.

Answer

Create a deny rule for external IP addresses, then an allow rule for internal.

Answer

Place the allow rule after the deny rule.

Answer

Create a single rule with a 'Deny' action and apply a user-ID condition.

Question 8

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

Accepted Answer

App-ID has not yet completed identification because the session is new or requires more packets.. When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Answer

The security rule is misconfigured because it lacks an application field.

Answer

The firewall does not have an App-ID signature for the website.

Answer

SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

Question 9

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

Accepted Answer

The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.. App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Answer

The firewall needs to have Application Override enabled for the custom signature to work.

Answer

The firewall must be restarted to apply the new custom signature.

Answer

The signature must be imported from the Palo Alto Networks application database.

Question 10

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 11

Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?

Accepted Answer

The traffic is not matching the application 'web-browsing'. The session shows application 'incomplete' because the firewall has not yet identified the application due to insufficient data or because the traffic does not match the expected application signature. In this case, the traffic is likely not matching the 'web-browsing' application, which is the application defined in the security rule 'Allow-Web'. The firewall requires the first few packets to complete application identification; if the traffic is not recognized as 'web-browsing' (e.g., due to non-standard HTTP headers or encrypted payloads), the session remains 'incomplete' and may be dropped or not allowed by the rule.

Answer

The NAT rule is missing

Answer

The destination IP is not in the destination zone

Answer

The security rule 'Allow-Web' is configured after 'Block-All'

Question 12

An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?

Accepted Answer

Rule1. The first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.

Answer

Rule3

Answer

Rule2

Answer

No rule matched

Question 13

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. Ensuring App-ID updates are current and using application identification enhancements (such as application override when needed) directly improves the accuracy of application identification. Option A (SSL Decryption) can help identify encrypted applications but does not directly address misidentification due to outdated signatures or custom needs. Option B (port-based rules) would reduce reliance on App-ID, which is counterproductive. Option C (custom application signatures) is useful but is not the first step; verifying updates and enhancements is a more fundamental action. Therefore, D is the best initial step.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.

Question 14

A company wants to block all traffic from the application 'facebook-base' but allow 'facebook-chat'. Which type of security rule is most appropriate?

Accepted Answer

Application filter in security policy. An Application filter in a security policy allows you to specify which applications are allowed or denied based on the App-ID. By creating a rule that denies 'facebook-base' while allowing 'facebook-chat', you can precisely control traffic at the application layer, even when both applications share the same underlying protocol (e.g., TCP/443). This granularity is a core feature of App-ID, enabling you to block the broader Facebook base application while permitting the specific chat sub-application.

Answer

File Blocking profile

Answer

URL Filtering profile

Answer

Security rule with 'facebook-base' as deny and 'facebook-chat' as allow

Question 15

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. Firewall policy changes only affect new sessions. Existing sessions continue to use the old policy until they time out. This explains why some users (with existing sessions) may still be affected by the old policy, while new users (new sessions) experience the new policy. Option A is incorrect because an incorrect source zone would cause consistent issues for all traffic matching that rule, not just some users. Option B is unrelated to the commit process; interface type mismatch would cause connectivity issues regardless of session state. Option C is incorrect because a committed configuration is no longer in candidate state; if it were still candidate, the changes would not take effect at all.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.