PCNSA Practice Test 24 — 15 Questions

Question 1

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 2

A small company runs a Palo Alto Networks PA-220 firewall with three zones: trust (internal users), untrust (internet), and dmz (public-facing services). They host a web server on IP 10.0.1.10 in the dmz zone, serving HTTPS content. The administrator created a security policy rule that allows traffic from untrust to dmz with source 'any', destination 10.0.1.10, service HTTPS, and action allow. No security profiles are applied to this rule. Users outside the company can access the web server successfully. However, the administrator notices from log reports that certain application-based attacks, such as SQL injection and cross-site scripting, are reaching the web server undetected. The firewall has the required threat prevention licenses installed. What is the best course of action to improve security posture?

Accepted Answer

Add a decryption policy to decrypt HTTPS traffic for inspection.. The traffic is HTTPS, which is encrypted. Without decryption, the firewall cannot inspect the payload for application-based attacks like SQL injection or XSS, even with threat prevention licenses. Adding a decryption policy allows the firewall to decrypt the traffic, apply threat prevention profiles, and detect these attacks.

Answer

Change the rule's security profile group to include threat prevention profiles.

Answer

Move the web server to the trust zone and adjust routing.

Answer

Enable vulnerability protection profile on the existing rule.

Question 3

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Accepted Answer

Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.. Enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Answer

Subscribe to the WildFire cloud and rely on updates.

Answer

Set the content update schedule to check every minute.

Answer

Manually download the latest content from the support portal and upload via CLI.

Question 4

A security analyst needs to monitor decryption performance and identify sessions that are bypassing decryption due to policy or technical reasons. Which two monitoring tools or methods can provide this insight?

Accepted Answer

Decryption logs with filter 'decryption action not equal to decrypt'. Decryption logs with a filter for 'decryption action not equal to decrypt' will show sessions that were not decrypted, including those bypassed due to policy (e.g., excluded URLs) or technical reasons (e.g., unsupported cipher suites). Option C is correct because the ACC > Decryption Overview provides a dashboard that visualizes decryption performance metrics, such as the number of sessions bypassed, decrypted, or failed, giving the analyst a high-level view of bypass activity.

Answer

System logs with filter 'decryption bypass'

Answer

Traffic logs with filter 'action equals decrypt' and 'reason equals bypass'

Answer

Packet capture on the decryption port

Question 5

For a firewall to communicate with Panorama for centralized management, which requirement must be met?

Accepted Answer

Panorama must be reachable via the management interface. For a firewall to communicate with Panorama for centralized management, the Panorama server must be reachable via the firewall's dedicated management interface (MGT). This is because the management interface is the default source for all management-plane traffic, including Panorama communications, unless explicitly overridden by a service route. Without reachability through this interface, the firewall cannot establish the required HTTPS or SSH connections to Panorama.

Answer

Both A and B are required

Answer

A service route must be configured for Panorama

Answer

A valid license for Panorama management is required

Question 6

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Accepted Answer

Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.. In Palo Alto firewalls, inter-vsys traffic is controlled by creating a security policy rule that specifies the source zone from vsys1 and the destination zone from vsys2 with action allow. This selectively permits traffic between specific virtual systems. Option A is incorrect because intra-vsys refers to traffic within the same vsys, not between different vsys. Option B is incorrect because there is no global 'inter-vsys' enable setting; inter-vsys traffic is governed by security policies. Option C is incorrect because inter-vsys traffic is not automatically allowed; it must be explicitly permitted via policy.

Answer

Configure intra-vsys security policy for each vsys and allow the traffic.

Answer

Enable inter-vsys traffic globally in the firewall settings.

Answer

Traffic between vsys is automatically allowed.

Question 7

During SSL decryption, which three factors can cause the firewall to fail to decrypt a session or to bypass decryption?

Accepted Answer

The decryption rule has a schedule that is not currently active.. A decryption rule with a schedule that is not currently active will not apply, causing the firewall to bypass decryption for the matching traffic. The firewall checks the schedule before attempting decryption, and if the schedule is inactive, the rule is effectively disabled, leading to a bypass.

Answer

The SSH protocol is being used instead of SSL/TLS.

Answer

The firewall's decryption hardware accelerator is faulty.

Question 8

Refer to the exhibit. What is the effect of this configuration?

Accepted Answer

The firewall responds to pings on the management interface.. The configuration shown is a management profile applied to an interface. The 'ping' service is enabled under the management profile, which allows the firewall to respond to ICMP echo requests (pings) on that specific interface. This does not permit transit ping traffic through the firewall, nor does it enable SSH or allow the firewall to initiate pings. Therefore, option C is correct.

Answer

The firewall allows ping traffic through all interfaces.

Answer

The management profile allows SSH access.

Answer

The firewall cannot ping others.

Question 9

Which TWO management methods allow CLI access to a Palo Alto Networks firewall?

Accepted Answer

SSH. SSH (Secure Shell) is a standard management method that provides encrypted CLI access to Palo Alto Networks firewalls, allowing administrators to execute commands securely over a network. The serial console port on the firewall provides direct, out-of-band CLI access for initial configuration or troubleshooting when network connectivity is unavailable.

Answer

HTTPS

Answer

HTTP

Answer

Telnet

Question 10

A company has a PA-5250 firewall with 10 Gbps threat prevention throughput. They are planning to enable SSL decryption for all traffic. What is the most likely impact on the firewall's throughput?

Accepted Answer

Throughput will decrease, typically by 30-50% depending on traffic.. SSL decryption requires the firewall to intercept, decrypt, inspect, and re-encrypt traffic. This process is computationally intensive, especially for high-throughput environments. Even with dedicated hardware, the PA-5250's threat prevention throughput is rated without decryption; enabling it typically reduces throughput by 30-50% due to the overhead of cryptographic operations and deep packet inspection on decrypted content.

Answer

Throughput will remain the same because the firewall uses dedicated hardware.

Answer

Throughput will increase due to offloading encryption to hardware.

Answer

Throughput will decrease only if decryption is applied to video traffic.

Question 11

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

Accepted Answer

The rule is placed after an allow rule that matches the traffic.. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Answer

BitTorrent is not part of the peer-to-peer application category.

Answer

The security rule is using an application group instead of an application filter.

Answer

The firewall does not have the latest App-ID update and cannot identify BitTorrent.

Question 12

What is the primary benefit of using App-ID in a security policy instead of relying solely on port-based rules?

Accepted Answer

It allows enforcement based on application identity, even if the application uses non-standard ports.. App-ID identifies the actual application regardless of port, allowing enforcement based on application identity even when applications use non-standard ports or camouflage as other traffic. Option A is incorrect because App-ID can have a minor performance impact, not increase throughput. Option C is incorrect because while App-ID can help reduce reliance on port-based rules, the primary benefit is application identification, not rule count reduction. Option D is incorrect because App-ID identifies many applications, not just HTTP/HTTPS.

Answer

It increases firewall throughput.

Answer

It reduces the number of security rules needed.

Answer

It limits traffic to HTTP and HTTPS only.

Question 13

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Accepted Answer

No Decrypt (bypass decryption). The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer

Error due to rule conflict

Answer

Block

Answer

Decrypt

Question 14

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

Accepted Answer

Ensure the application is identified by App-ID and that the correct application name is used.. If a security policy allows a specific application but traffic from that application is blocked, the most likely cause is that the application is not being correctly identified by App-ID. The administrator should first verify that the application is recognized by App-ID and that the correct application name is used in the rule. Option B is correct. Option A is wrong because zones being correct is necessary but not the first check if the application is allowed. Option C is wrong because the action is already allow; the issue is identification. Option D is wrong because rule order matters only if multiple rules match, but here the rule matches yet traffic is blocked, so identification is the primary concern.

Answer

Verify the source and destination zones are correct.

Answer

Confirm that the action is set to allow.

Answer

Check the order of security rules.

Question 15

An administrator needs to access the firewall's CLI via SSH, but the default SSH port (22) is blocked by the corporate firewall. Which configuration allows SSH on a non-standard port?

Accepted Answer

Device > Setup > Management > Port for SSH. The firewall's SSH port is configured under Device > Setup > Management > Port for SSH. This setting allows the administrator to change the default TCP port 22 to any non-standard port, enabling SSH access when the corporate firewall blocks the default port. The management interface settings control all inbound management protocols, including SSH, HTTPS, and ping.

Answer

Device > Setup > Services > SSH Port

Answer

Device > Setup > Management > Port for HTTP/HTTPS

Answer

Device > Administration > SSH Port

Answer

Device > Setup > Operations > SSH