PCNSA Practice Test 22 — 15 Questions

Question 1

A network security administrator needs to create a service object that represents a custom application running on TCP port 8443 and UDP port 8443. The administrator wants to ensure that both protocols are matched by a single service object to simplify policy management. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service group that includes two service objects: one for TCP port 8443 and one for UDP port 8443, then reference the service group in the security policy.. A service group allows multiple service objects to be grouped under one name, so referencing the group in a security policy covers both TCP and UDP port 8443. This reduces the number of objects in the policy and simplifies management. The other options either require multiple objects in the policy or use unsupported protocol combinations.

Answer

Create a service object with protocol TCP and destination port 8443, then create another service object with protocol UDP and destination port 8443, and use both in the security policy.

Answer

Create an application object with protocol TCP-UDP and destination port 8443.

Answer

Create a service object with protocol TCP-UDP and destination port 8443.

Question 2

An administrator is creating a security policy and needs to reference multiple service objects for different applications. The administrator wants to group these services into a single object that can be used in the policy. Which TWO of the following statements are true about service groups in PAN-OS? (Choose two.)

Accepted Answer

A service group can contain other service groups, allowing for hierarchical grouping.. The two true statements are that a service group can contain both predefined and custom service objects, and that it can contain other service groups (nested groups). These capabilities provide flexibility in grouping services for policy use. The other options are false because service groups are restricted to service objects and cannot contain address objects or applications, nor can they be used in address fields.

Answer

A service group can be used in the Source Address field of a security policy.

Answer

A service group can contain applications, allowing for application-based filtering.

Answer

A service group can contain address objects to simplify policy creation.

Question 3

An administrator needs to ensure that a security policy rule only allows traffic to a specific destination FQDN that resolves to multiple IP addresses, and the IP addresses change frequently. The administrator wants the firewall to automatically update the IP addresses without manual intervention. Which object type should the administrator use?

Accepted Answer

FQDN address object. An FQDN address object is designed to resolve a domain name to its IP addresses and update them automatically as DNS records change. This provides dynamic IP address tracking without manual intervention. The other options either require manual updates or use different mechanisms that do not directly resolve FQDNs. Thus, the FQDN address object is the correct solution for this scenario.

Answer

Dynamic address group with a tag-based filter

Answer

Static address object with a single IP address

Answer

External Dynamic List (EDL) referencing a URL

Question 4

An administrator is configuring a security policy and needs to reference a set of external servers that are frequently updated by a third-party service. The servers' IP addresses change often, and the administrator wants the firewall to automatically update the list without manual intervention. Which type of object should the administrator use?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List is designed to automatically retrieve and update lists of IP addresses, URLs, or domains from an external server. By configuring an EDL, the firewall periodically pulls the list and uses it in policy, ensuring that changes made by the third-party service are reflected without manual intervention. This is the most efficient and appropriate solution for dynamically changing IP lists.

Answer

FQDN address object

Answer

Static address group

Answer

Dynamic address group

Question 5

A network security administrator is configuring a security policy to allow access to a set of web servers. The servers are located in a dynamic environment where new instances are added frequently. The administrator wants to ensure that the policy automatically includes new web servers without manual updates. The administrator has created a dynamic address group named 'WebServers-DAG' with the filter 'WebServer'. Which additional configuration is required to ensure that the dynamic address group is populated correctly?

Accepted Answer

Ensure that each web server has a tag that matches the filter, such as 'WebServer', applied to its address object.. For a dynamic address group to automatically include members, the filter must match tags applied to address objects. The filter 'WebServer' will include any address object tagged with 'WebServer'. As new web servers are deployed, tagging their address objects with 'WebServer' ensures they are dynamically added to the group, allowing the security policy to automatically cover them without manual updates.

Answer

Create an address object for each web server and add them as static members to the dynamic address group.

Answer

Set the dynamic address group's filter to 'WebServer-*' to match tags that start with 'WebServer'.

Answer

Configure the dynamic address group to use an External Dynamic List (EDL) that contains the IP addresses of the web servers.

Question 6

An administrator is configuring a Dynamic Address Group (DAG) that uses tags to automatically include members. The administrator wants to ensure that the DAG is populated correctly. Which two actions are required to make a firewall register an IP address as a member of the DAG? (Choose two.)

Accepted Answer

The firewall must receive the tag information via an external source, such as a User-ID agent or a syslog listener.. Dynamic Address Groups are populated based on tags that are registered with the firewall. The two essential actions are: the firewall must receive tag information from an external source (like User-ID agent or syslog), and the DAG filter must reference those tags. Without both, the group will not be populated. Manual addition or DNS resolution are not part of the DAG mechanism.

Answer

The administrator must enable the 'Dynamic Group' option in the security policy rule.

Answer

The administrator must manually add each IP address as a static member of the DAG.

Answer

The firewall must be configured to resolve the IP addresses to hostnames via DNS.

Question 7

A security administrator is configuring an External Dynamic List (EDL) for IP addresses that will be used in a security policy to block malicious traffic. The EDL is hosted on an internal web server at https://edl.example.com/blocklist. The administrator wants to ensure that the firewall can retrieve the list and that it is updated every hour. Which configuration is required for the EDL to function correctly?

Accepted Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and ensure that the firewall can resolve the DNS name and has a route to the web server.. For an EDL to be retrieved, the firewall must be able to resolve the domain name and reach the server. The update interval is set in the EDL configuration. Certificate authentication is only needed if the server requires it and the firewall does not trust the certificate. Thus, ensuring DNS resolution and network connectivity is fundamental.

Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and ensure that the firewall has a valid certificate to authenticate to the web server.

Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and configure a custom URL category to include the EDL.

Answer

Configure the EDL with source URL http://edl.example.com/blocklist, set the recurring update to hourly, and add the EDL to a security policy as a source address.

Question 8

An administrator wants to ensure that a security policy rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should be used?

Accepted Answer

Schedule. To activate a security rule only during specific times, a Schedule object must be created and attached to the rule. Schedules define time ranges and days of the week. Security Profiles, Application Filters, and External Dynamic Lists serve different purposes and do not control rule activation timing.

Answer

Application Filters

Answer

External Dynamic Lists

Answer

Security Profiles

Question 9

A network security administrator is reviewing the security policy on a Palo Alto Networks firewall. The administrator wants to ensure that traffic from the Trust zone to the Untrust zone is inspected by a specific security profile group. Which policy component should the administrator configure to attach the security profile group?

Accepted Answer

The security rule that permits the traffic. Security profile groups are attached directly to security rules. When traffic matches a security rule, the firewall applies the attached profile group to inspect the traffic for threats, malware, and other risks. NAT, decryption, and application override rules serve different purposes and do not provide the field to attach security profile groups. The administrator must edit the security rule that permits the traffic.

Answer

The decryption policy rule that matches the traffic

Answer

The application override policy rule

Answer

The NAT rule that translates the source address

Question 10

An administrator is reviewing the security policy on a Palo Alto Networks firewall and notices that a rule allowing web browsing from the Trust zone to the Untrust zone has no application specified. The administrator wants the firewall to permit only web-browsing and ssl while blocking all other applications on ports 80 and 443. What should the administrator do to meet this requirement?

Accepted Answer

Add the applications web-browsing and ssl to the rule and set the action to Allow.. The Application column in a security rule determines which applications are allowed. By specifying web-browsing and ssl, the rule only permits those applications, and all other applications on ports 80 and 443 will not match and will be denied by subsequent rules or the default deny. This is the correct way to restrict traffic to specific applications.

Answer

Enable the 'Log at Session Start' option and monitor which applications are in use.

Answer

Create a new rule below the existing rule that denies any application on ports 80 and 443.

Answer

Change the service to application-default and remove any application specification.

Question 11

An administrator is creating a new security rule at the top of the rulebase to allow specific web traffic. After committing, users report that all web traffic is now blocked, including traffic that was previously allowed by a lower rule. The new rule's action is set to 'Deny' and its source and destination are set to 'any'. What is the most likely cause?

Accepted Answer

The new deny rule is placed above the existing allow rules, so it matches all web traffic before the allow rules can be evaluated.. Security rules are processed in order from top to bottom. The first rule that matches the traffic determines the action. A broad deny rule placed at the top will match all web traffic and block it before any lower allow rules can be evaluated. To fix this, the administrator should move the deny rule below specific allow rules or narrow its match criteria.

Answer

The new rule has a higher priority because it was created more recently, overriding older rules regardless of position.

Answer

The firewall applies security rules in a random order, so the deny rule sometimes matches before the allow rules.

Answer

The deny rule is only evaluated after the allow rules, so it should not block allowed traffic; the issue is likely a misconfigured application filter.

Question 12

An administrator needs to allow a specific set of external IP addresses to access an internal web server on port 443, but all other traffic to that server must be blocked. The administrator creates a security policy rule that allows the specific IP addresses and places it at the bottom of the rulebase. What will be the result?

Accepted Answer

The rule will be evaluated last, and if no other rule matches, the specific IP addresses will be allowed and all others will be blocked by the implicit deny.. Security rules are evaluated from top to bottom. Placing a specific allow rule at the bottom means it will be evaluated after any earlier rules. If no earlier rule matches, the specific IP addresses will be allowed, and all other traffic will be blocked by the implicit deny. However, best practice is to place more specific rules above more general ones to ensure they are hit first.

Answer

The rule will be ignored because the implicit deny rule at the top blocks all traffic first.

Answer

The rule will allow the specific IP addresses but also allow all other traffic because the implicit deny is overridden.

Answer

The rule will not be evaluated because rules are processed in alphabetical order.

Question 13

An administrator needs to create an object that represents a set of subnets belonging to the same department, but the subnets are not contiguous. The object will be used in a security policy rule and must be updated automatically when new subnets are added in IP address management (IPAM). Which type of address object should the administrator use?

Accepted Answer

Dynamic address group. A dynamic address group is designed to automatically include address objects based on tags, which can be updated by external systems like IPAM. This allows the group to reflect changes without manual intervention. For non-contiguous subnets that need automatic updates, this object type provides the necessary flexibility and integration, unlike static address objects that require manual maintenance.

Answer

IP Netmask address object

Answer

IP Range address object

Answer

FQDN address object

Question 14

A network security administrator at a university wants to allow students in the 'Student' zone to access the internet, but only during exam periods should they be blocked from social media. The administrator creates a security rule at the top of the rulebase that denies social media applications from the Student zone to the Internet zone and schedules it to be active only during exam weeks using a schedule object. Which statement correctly describes the evaluation of this rule?

Accepted Answer

The rule will be evaluated only when the schedule is active; outside the schedule, it is skipped and later rules are evaluated.. Security rules can be associated with schedule objects to make them active only during specific time periods. When the schedule is inactive, the rule is skipped entirely during policy evaluation, allowing subsequent rules to be processed. This enables temporary enforcement without manual rule changes, which is ideal for time-bound restrictions like exam-period social media blocks.

Answer

The rule will always be evaluated, but the action will be changed to allow when the schedule is inactive.

Answer

The rule will be evaluated only if the schedule is active, and if inactive, the default interzone-default rule will be applied immediately.

Answer

The rule will be evaluated regardless of schedule, but logging will be suppressed when the schedule is inactive.

Question 15

An administrator needs to create a security policy rule that allows access to a web server with IP address 203.0.113.10, but the IP address may change in the future. The administrator wants to minimize manual updates to the policy. Which address object type should the administrator use?

Accepted Answer

FQDN address object. An FQDN address object automatically resolves a domain name to IP addresses and updates when DNS changes. This means if the web server's IP changes, the administrator only needs to update the DNS record, and the firewall will automatically use the new IP. This minimizes manual updates to the security policy. Static objects, dynamic address groups, and EDLs require more manual intervention or additional infrastructure. Therefore, the FQDN address object is the best choice.

Answer

Dynamic address group

Answer

External Dynamic List (EDL)

Answer

Static address object