PCNSA Practice Test 23 — 15 Questions

Question 1

An administrator has configured a security rule that allows traffic from the 'Trust' zone to the 'Untrust' zone for specific applications. The rule is placed at position 5 in the rulebase. A user reports that traffic matching this rule is being denied. Upon inspection, the administrator finds that a rule at position 3 denies all traffic from 'Trust' to 'Untrust' for any application. What is the most likely cause of the denial?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule at position 3 is evaluated first and matches the traffic, so the deny action is applied.. Security rules are processed in order from top to bottom, and the first rule that matches the traffic determines the action. Because the deny rule at position 3 matches all Trust-to-Untrust traffic, it takes precedence over the allow rule at position 5. To resolve this, the administrator should move the allow rule above the deny rule or modify the deny rule to be more specific.

Answer

The rule at position 5 is not correctly configured with the appropriate applications.

Answer

The deny rule at position 3 is a default rule and cannot be overridden by any other rule.

Answer

The firewall requires a security profile to be attached to the allow rule for it to take effect.

Question 2

An administrator is configuring a security policy rule that must allow access to a web server hosted at www.example.com. The web server's IP address changes frequently due to a content delivery network (CDN). The administrator wants the firewall to automatically update the IP address used in the rule without manual intervention. Which type of address object should be used?

Accepted Answer

FQDN address object. An FQDN address object is designed to resolve a domain name to IP addresses and can be configured to refresh at specified intervals. This enables the firewall to automatically update the object with the current IPs, ensuring security policies remain effective even when the web server's IP changes. For a CDN-hosted server, this provides the necessary automation without manual intervention.

Answer

IP Range address object

Answer

Dynamic address group

Answer

IP Netmask address object

Question 3

A security administrator is configuring a rule to allow access to a web application hosted on multiple servers with changing IP addresses. The administrator wants to ensure the rule automatically updates as the IP addresses change, without manual intervention. Which feature should be used?

Accepted Answer

Dynamic Address Group. Dynamic Address Groups automatically update their members based on tags. When an IP address is tagged, it becomes part of the group. This allows security rules to dynamically adapt to changing IP addresses without manual intervention. Static Address Groups, External Dynamic Lists, and Application Groups do not provide the same seamless dynamic membership based on tagging.

Answer

Static Address Group

Answer

Application Group

Answer

External Dynamic List

Question 4

An administrator is configuring a security policy to allow access to a critical application. The application uses multiple protocols and dynamic ports. The administrator wants to ensure that the policy is as secure as possible while allowing legitimate traffic. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Use App-ID to identify the application and allow only the specific application, rather than allowing the underlying ports.. To securely allow an application with dynamic ports, the administrator should use App-ID to identify the application and create a custom signature if needed. These actions ensure that only the specific application is allowed, regardless of port, while maintaining security. Allowing all ports or disabling inspection would weaken security and are not recommended.

Answer

Set the security rule to allow the application based on the destination port only, as dynamic ports are not supported by App-ID.

Answer

Allow all TCP and UDP ports from the source zone to the destination zone to ensure the application works.

Answer

Disable application inspection for the traffic to improve performance, since the application uses dynamic ports.

Question 5

An administrator is creating service objects to define custom applications for a security policy. The administrator needs to create a service object for a custom TCP-based application that uses a single port, and another service object for an application that uses a range of UDP ports. Which two actions must the administrator take when defining these service objects? (Choose two.)

Accepted Answer

Specify the protocol as TCP for the single-port service.. To define service objects for custom applications, the protocol must be correctly set (TCP or UDP) and the appropriate port or port range specified. For a TCP single-port service, set protocol to TCP and specify the port. For a UDP port-range service, set protocol to UDP and define the range. These two actions are essential for accurate traffic matching.

Answer

Set the destination port to 0 for the single-port service.

Answer

Use a dynamic address group to define the service.

Answer

Enable the 'Override' option to allow port ranges.

Question 6

A security administrator is configuring a policy to allow access from the Guest zone to the Internet zone. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and all other traffic is blocked. The administrator creates a rule with source zone Guest, destination zone Internet, application web-browsing and ssl, and action Allow. However, users report that they cannot access websites. What is the most likely cause?

Accepted Answer

The rule is placed below a more general deny rule that blocks all traffic from Guest to Internet.. Security rules are processed in order from top to bottom, and the first rule that matches the traffic is applied. If a deny rule for all traffic from Guest to Internet is placed above the allow rule for web-browsing and ssl, the deny rule will match first and block all traffic, preventing users from accessing websites. The allow rule must be moved above the deny rule to take effect.

Answer

The rule is missing a security profile that allows web browsing.

Answer

The rule's service is set to application-default, but the users are using non-standard ports.

Answer

The application web-browsing does not include HTTPS traffic, so ssl must be replaced with web-browsing.

Question 7

A security administrator at a hospital needs to allow clinicians to access a cloud-based electronic health record (EHR) system at ehr.example.com. The firewall must inspect the traffic for threats, but the EHR vendor requires that the firewall not decrypt the traffic due to strict patient data privacy regulations. Which Security policy rule configuration should the administrator implement?

Accepted Answer

Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to no-decrypt, and create a Security policy rule that allows the application ssl and attaches the appropriate Security profiles.. The correct solution uses a Decryption policy rule with the no-decrypt action to exempt ehr.example.com from SSL decryption, honoring the privacy requirement. A separate Security policy rule allows the application ssl and applies Security profiles, ensuring threat inspection still occurs on the encrypted traffic. This two-policy approach is the standard method to selectively bypass decryption while maintaining security enforcement.

Answer

Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to decrypt, and create a Security policy rule that allows the application ssl without any Security profiles.

Answer

Create a Security policy rule that allows the application ssl, with the action allow, and attach a Decryption profile set to no-decrypt for the EHR server certificate.

Answer

Create a Security policy rule that allows the application ssl, with the action allow, and attach a URL Filtering profile that blocks the healthcare category.

Question 8

An administrator has configured a security rule that allows traffic from the 'Trust' zone to the 'Untrust' zone for specific applications. The rule is placed at position 5 in the rulebase. A user reports that traffic matching this rule is being denied. Upon inspection, the administrator finds that a rule at position 3 denies all traffic from 'Trust' to 'Untrust' for any application. What is the most likely cause of the denial?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The source user group 'Marketing' is not properly synchronized with the firewall's user-ID agent.. User-based rules require User-ID to map IP addresses to users and groups. If the 'Marketing' group is not synchronized, the firewall cannot match the source user, and the session falls through to the implicit deny. Verifying User-ID agent connectivity and group mapping is the first troubleshooting step for user-based policy failures.

Answer

The application 'web-browsing' is not correctly defined in the application filter.

Answer

The security rule is placed below the implicit deny rule.

Answer

The destination zone in the rule is incorrectly set to 'Untrust' instead of 'Trust'.

Question 9

An administrator is configuring a security policy rule to allow access to a critical application. The administrator wants to ensure that the rule is only active for users in the 'Finance' group and only during weekdays. Which two configuration elements must be used to achieve this? (Choose two.)

Accepted Answer

User Group. To restrict a security rule to a specific user group and to weekdays, the administrator must use a User Group in the Source User field and a Schedule in the Schedule field. User Groups require User-ID to be configured. Schedules define the active times. Other options like Application Filters, External Dynamic Lists, and Security Profiles do not fulfill these specific requirements.

Answer

External Dynamic List

Answer

Application Filter

Answer

Security Profile

Question 10

A security administrator is configuring a rule to allow access to a web server. The rule uses a URL category as the destination. The administrator notices that the rule is not matching traffic to the web server's IP address when users connect directly via IP. What is the most likely reason?

Accepted Answer

URL categories are only evaluated for HTTP and HTTPS traffic, and direct IP access may not be categorized.. URL categories are derived from the URL or SNI in the request. When users connect directly to an IP address without a hostname, the firewall often cannot determine a URL category, so a rule that references a URL category will not match. The traffic may then be evaluated against other rules or the implicit deny. To allow such traffic, the administrator should use an IP address or address group in the destination field instead of a URL category.

Answer

The security profile attached to the rule is blocking the traffic before the rule can match.

Answer

The firewall requires a DNS sinkhole to be configured for URL category rules to work.

Answer

The rule's source zone is incorrect, causing the traffic to be evaluated against a different rule.

Question 11

An administrator is designing a security policy for a Palo Alto Networks firewall. The administrator wants to ensure that the policy is efficient and follows best practices for rule evaluation. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable logging at the end of the session for rules that allow critical traffic.. Ordering rules from specific to general ensures that intended traffic matches the correct rule before a broader rule can apply. Logging at session end for critical allow rules provides necessary visibility. Using any in source/destination or placing a deny all at the top would create security gaps or block legitimate traffic. Application filters may be too broad for precise control. These two practices support an efficient and secure rulebase.

Answer

Use any as the source and destination in rules to simplify policy management.

Answer

Place a deny all rule at the top of the rulebase to block unwanted traffic immediately.

Answer

Use application filters instead of specific applications to reduce the number of rules.

Question 12

An administrator has configured a security rule that allows traffic from the 'Trust' zone to the 'Untrust' zone for specific applications. The rule is placed at position 5 in the rulebase. A user reports that traffic matching this rule is being denied. Upon inspection, the administrator finds that a rule at position 3 denies all traffic from 'Trust' to 'Untrust' for any application. What is the most likely cause of the denial?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service 'application-default' only allows default ports, so port 8443 is blocked. A custom service must be added to the rule.. The service 'application-default' restricts traffic to the default ports for the selected applications. For 'ssl', the default port is 443. Since the website uses port 8443, the traffic does not match the service and is blocked. To allow it, the administrator must create a custom service for port 8443 and add it to the security rule, ensuring the application is still identified correctly.

Answer

The security rule is not matching because the application 'web-browsing' does not cover HTTPS traffic.

Answer

The firewall is configured to block non-standard ports by default, and a security profile must be applied to allow them.

Answer

The application 'ssl' does not support non-standard ports; a custom application must be created.

Question 13

An administrator is troubleshooting why a security rule that allows traffic from the Trust zone to the DMZ zone is not being hit. The administrator confirms that the source IP, destination IP, and application are correct. Which factor should the administrator check next to determine why the rule is being bypassed?

Accepted Answer

Whether a NAT rule is translating the destination IP and changing the destination zone before security policy evaluation.. NAT rules are processed before security rules. Destination NAT can change the destination IP and therefore the destination zone. If the translated destination falls into a different zone than the one specified in the security rule, the rule will not match. The administrator should examine the NAT policy to see if a rule is altering the destination zone. This is a frequent cause of unexpected rule bypass in Palo Alto Networks firewalls.

Answer

Whether the rule is placed below a more general rule that also matches the traffic.

Answer

Whether the application is identified as a different application due to App-ID signature updates.

Answer

Whether the security rule has a schedule applied that is currently inactive.

Question 14

An administrator has created a security rule that allows traffic from the 'Guest' zone to the 'Internet' zone for web browsing. Users in the Guest zone report that they can access some websites but not others. The administrator checks the traffic logs and sees that some sessions are being denied by the implicit deny rule. What is the most likely reason?

Accepted Answer

The security rule is only allowing the 'web-browsing' application, but some websites use other applications such as 'ssl' or 'facebook-base'.. The allow rule only permits the 'web-browsing' application. Some websites use HTTPS or other applications that are not matched by this rule, so those sessions fall through to the implicit deny. The administrator should add the necessary applications, such as 'ssl', to the rule to allow complete web access.

Answer

The implicit deny rule is evaluated before the custom rule, so all traffic is denied unless explicitly allowed above it.

Answer

The rule is placed below the implicit deny rule, so it is never evaluated.

Answer

The security rule is not logging traffic, so the administrator cannot see which rule is allowing the traffic.

Question 15

An administrator is creating a security policy rule that must allow traffic from a group of users who are currently logged into the firewall via GlobalProtect. The administrator wants the rule to automatically include all users who are members of the 'Marketing' group in the directory service. Which type of object should be used in the Source User field of the security policy rule?

Accepted Answer

Dynamic User Group. A Dynamic User Group automatically includes users based on directory attributes, such as group membership. It can be configured to match users in the 'Marketing' group and updates dynamically as users log in or out. This ensures the security policy remains current without manual intervention. Static user groups, address groups, and service groups do not provide this automatic, directory-based user matching.

Answer

Address Group

Answer

Static User Group

Answer

Service Group