PCNSA Practice Test 22 — 15 Questions

Question 1

An administrator wants to synchronize the firewall's clock with a central NTP server. Where is this configured?

Accepted Answer

Under Device > Setup > Services, NTP tab. NTP (Network Time Protocol) client configuration on a Palo Alto Networks firewall is performed under Device > Setup > Services, where the NTP tab allows you to specify primary and secondary NTP servers. This synchronizes the firewall's system clock, which is critical for accurate log timestamps, certificate validation, and security policy enforcement. The firewall acts as an NTP client, sending periodic NTP requests (typically using UDP port 123) to the configured servers.

Answer

Under Objects > Regions

Answer

Under Device > Licenses

Answer

Under Network > Interfaces, Management Interface

Question 2

A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?

Accepted Answer

The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.. The zone protection profile with Flood Protection can drop traffic that exceeds configured thresholds. If the thresholds are set too low, legitimate traffic may be mistaken for a flood and denied, even though a security policy allows it. This is the most likely cause of the denial. Option A is incorrect because the security policy allowing all outbound traffic overrides the implicit deny rule when a match occurs. Option C is incorrect because logging profiles do not affect traffic flow; they only control logging. Option D is incorrect because if a schedule were restricting access, the policy would not be active at the current time, but the question states the policy allows all outbound traffic, implying no schedule restriction.

Answer

The security policy is set to deny due to an implicit deny rule.

Answer

The security policy has a logging profile attached that is blocking traffic.

Answer

The security policy has a schedule configured that is currently outside the allowed time.

Question 3

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

Accepted Answer

MGT (Management) interface. The MGT (Management) interface is a dedicated physical port on Palo Alto Networks firewalls designed specifically for out-of-band management traffic. It operates on a separate routing table and does not participate in production data forwarding, ensuring complete isolation of management traffic from production traffic as required by the scenario.

Answer

HA1 interface

Answer

VLAN interface

Answer

Ethernet 1/1

Question 4

A security analyst is troubleshooting a decryption issue. Which TWO logs are most useful for identifying decryption failures? (Choose two.)

Accepted Answer

Traffic Logs. Traffic Logs (B) are most useful because they record the result of decryption actions, including whether decryption was applied and if it succeeded or failed, with specific error codes. Decryption Logs (E) are dedicated logs that capture detailed decryption events, such as handshake failures, certificate errors, or unsupported cipher suites, making them essential for troubleshooting decryption failures.

Answer

Config Logs

Answer

System Logs

Answer

Threat Logs

Question 5

Which THREE are required for Panorama to manage a firewall? (Select three)

Accepted Answer

Certificate-based mutual authentication (or pre-shared key). Panorama and managed firewalls must establish a secure, authenticated connection using either certificate-based mutual authentication or a pre-shared key. This ensures that only authorized firewalls can register with Panorama and receive configuration updates, preventing unauthorized devices from joining the management domain.

Answer

A valid Panorama license

Answer

Panorama plugin installed on the firewall

Question 6

An organization is using outbound SSL decryption with a forward proxy. They notice that mobile devices (iOS/Android) are having trouble connecting to many HTTPS sites after decryption is enabled. IT has installed the root CA certificate on all devices. What is the most likely reason?

Accepted Answer

The root CA certificate is not trusted by mobile OS due to certificate transparency or pinning.. Mobile operating systems (iOS and Android) implement certificate transparency (CT) requirements and certificate pinning for many HTTPS sites. Even if the root CA certificate is installed, the firewall's decryption certificate is not logged in public CT logs, causing the OS to reject the connection. Additionally, pinned certificates (e.g., for Google or Apple services) will fail validation when the firewall presents its own certificate instead of the original server certificate.

Answer

The decryption profile does not allow TLS 1.3 connections.

Answer

The firewall's decryption certificate uses a weak key length.

Answer

The firewall is not configured to decrypt traffic from mobile devices.

Question 7

Which TWO methods are valid for managing a Palo Alto Networks firewall? (Select two)

Accepted Answer

HTTPS. HTTPS (port 443) is the standard web-based management interface for Palo Alto Networks firewalls, providing encrypted GUI access via the Panorama or local web interface. SSH (port 22) is the secure CLI access method, allowing command-line management with encryption and authentication. Both are explicitly supported and recommended for secure management.

Answer

HTTP

Answer

SNMP (Read/Write)

Answer

Telnet

Question 8

Which of the following is a primary benefit of using App-ID in a security policy?

Accepted Answer

It enforces policies based on the actual application, irrespective of port or encryption.. App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Answer

It allows blocking traffic based on port numbers only.

Answer

It only works for known applications.

Answer

It can only be applied to outbound traffic.

Question 9

A small business owner wants to block all social media applications during work hours for employees. The firewall is configured with App-ID and has a security rule that denies the 'social-networking' application category from the internal zone to the internet zone. However, employees are still able to access Facebook and Twitter. The traffic logs show these applications are being allowed by a different rule. The administrator checks the security policy and finds the deny rule for social-networking is present but not matched. What is the most likely reason the deny rule is not being matched?

Accepted Answer

There is a rule above the deny rule that allows all traffic.. The most likely reason the deny rule is not matched is that a higher-priority rule (placed above the deny rule) is allowing all traffic, including social networking. In Palo Alto firewalls, security rules are evaluated from top to bottom; the first matching rule is applied. Even if a deny rule exists for social-networking, if a preceding rule allows all traffic, the deny rule is never evaluated. The traffic logs indicate that the applications are allowed by a different rule, which supports this explanation.

Answer

The source IP address range does not include the employees' subnet.

Answer

The source zone is set to 'any' but the actual traffic is coming from a different zone than assumed.

Answer

The security rule does not have a URL Filtering profile attached.

Question 10

Refer to the exhibit. The firewall is currently running PAN-OS 9.1.4. The administrator wants to upgrade to the latest available version shown. What should the administrator do first?

Accepted Answer

Download the PAN-OS 9.1.7 package from the support site. The firewall is running PAN-OS 9.1.4, and the latest available version shown is 9.1.7. Before any upgrade can be performed, the administrator must first download the PAN-OS 9.1.7 image from the Palo Alto Networks support site. This is a prerequisite step because the upgrade process requires the image file to be present on the firewall or accessible via a valid download path; the firewall cannot install a version it has not yet obtained.

Answer

Reset the firewall to factory defaults to ensure a clean upgrade

Answer

Reboot the firewall to apply pending updates

Answer

Directly install the PAN-OS 9.1.7 package

Question 11

Match each PAN-OS component to its role.

Accepted Answer

Management Plane: Handles device configuration, management access, and logging.. The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Answer

Management Plane: Processes and forwards network traffic based on security policies.

Answer

Data Plane: Handles device configuration, management access, and logging.

Question 12

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Accepted Answer

The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.. After a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Answer

The firewall's CPU and memory are insufficient for the new PAN-OS version.

Answer

The firewall is performing a backup of the configuration.

Answer

The rulebase has grown too large.

Question 13

An administrator wants to allow ping (ICMP) and SSH access on a data interface (e.g., ethernet1/1) for troubleshooting. Which configuration is required?

Accepted Answer

Configure an interface management profile on ethernet1/1. Interface management profiles control which management services (ping, SSH, HTTP, etc.) are permitted on a data interface.

Answer

Enable 'Management' profile on the VLAN interface

Answer

Create a security policy allowing ICMP and SSH inbound

Answer

Enable the service route for ping and SSH

Question 14

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

Accepted Answer

Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.. To inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.

Answer

Create a VPC peering connection between the two subnets and attach the firewall.

Answer

Attach the firewall to a single subnet and use it as a default gateway for both subnets.

Answer

Configure AWS security groups to route traffic through the firewall.

Question 15

Which TWO conditions must be true for intra-zone traffic to be allowed between two interfaces in the same zone?

Accepted Answer

The interfaces are in the same virtual router. Intra-zone traffic between two interfaces in the same zone requires that both interfaces belong to the same virtual router (Option A) because the virtual router defines the routing table and forwarding domain. Without this, the firewall cannot route packets between the interfaces even if they are in the same zone. Additionally, a security policy must explicitly allow the traffic (Option E), as Palo Alto Networks firewalls default to a deny-all posture; no traffic is permitted without an explicit rule.

Answer

Intra-zone default rule is set to allow

Answer

The zones are in the same vsys

Answer

The interfaces are in the same virtual wire