PCNSA Practice Test 24 — 15 Questions

Question 1

A firewall administrator is reviewing the security policy and notices that a rule allowing DNS from the Trust zone to the Untrust zone has a hit count of zero. The administrator confirms that DNS traffic is being generated and that the rule is enabled. Which action should the administrator take to troubleshoot why the rule is not being hit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if there is a rule above that matches DNS traffic and has a deny action.. Security rules are evaluated top-down. If a rule above the DNS allow rule matches DNS traffic and denies it, the DNS allow rule will never be reached, resulting in zero hits. The administrator should examine the rules above for any that might match DNS and have a deny action, or any action that would prevent the DNS rule from being evaluated.

Answer

Verify that the DNS application is included in the rule's Application column.

Answer

Ensure that the source and destination zones are correctly configured as Trust and Untrust.

Answer

Check if the rule is placed after a more general allow rule that permits all traffic.

Question 2

A security administrator is configuring a security policy rule to allow access to a web server from the internet. The rule is set to allow HTTP and HTTPS traffic to the server's public IP address. However, after committing the change, users report that they cannot access the web server from the internet. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit rule. What is the most likely cause of the issue?

Accepted Answer

The security rule does not have the correct source zone specified.. The correct answer is that the source zone is likely incorrect. For inbound traffic from the internet, the source zone should be the Untrust zone (or the zone of the external interface). If the source zone is set to Trust or another internal zone, the rule will not match, and the traffic will be denied by the interzone-default rule.

Answer

The security rule is placed below the intrazone-default rule.

Answer

The security rule is placed below the interzone-default rule.

Answer

The security rule is configured with the wrong destination address.

Question 3

An administrator is auditing the security policy on a PA-3220 firewall. The administrator notices that a rule allowing RDP from the 'Trust' zone to the 'DMZ' zone has a source user of 'domain\jdoe' and is positioned below a broader rule that allows any application from Trust to DMZ for any user. The administrator wants the user-specific rule to be evaluated first. What is the most efficient way to achieve this?

Accepted Answer

Move the user-specific rule above the broader rule in the security policy.. Security rules are processed in a top-down sequence, and the first rule that matches all criteria (source zone, destination zone, source address, destination address, application, user, etc.) is applied. To ensure a specific rule takes precedence over a more general one, it must be placed above the general rule. Moving the user-specific rule above the broader rule guarantees it is evaluated first, allowing the intended access control.

Answer

Create a new rule with the same source user and place it at the bottom of the rulebase.

Answer

Change the source user on the broader rule to 'any' and rely on application-based matching.

Answer

Add a negative source user to the broader rule to exclude 'domain\jdoe'.

Question 4

An administrator has configured a security rule that allows traffic from the 'Guest' zone to the 'Internet' zone for web-browsing and ssl applications. The rule is placed at the top of the rulebase. Users in the Guest zone report that they can access websites but cannot use other applications like SSH or FTP. Which statement explains this behavior?

Accepted Answer

The rule allows only web-browsing and ssl, so other applications are implicitly denied by the default deny rule at the bottom.. The security rule only allows web-browsing and ssl applications. Traffic for SSH and FTP does not match this rule and is therefore evaluated against subsequent rules. Since there is no explicit allow rule for those applications, they are denied by the default deny rule at the bottom of the rulebase. This is the expected behavior of a default-deny security policy.

Answer

The rule is at the top, so it allows all traffic, but the applications are not properly defined.

Answer

The rule is missing a security profile, which is required to allow non-web applications.

Answer

The firewall is configured to block SSH and FTP by default, regardless of rule configuration.

Question 5

A firewall administrator is reviewing the security policy and notices that a rule allowing DNS from the Trust zone to the Untrust zone has a hit count of zero. The administrator confirms that DNS traffic is being generated and that the rule is enabled. Which action should the administrator take to troubleshoot why the rule is not being hit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The allow rule is shadowed by the deny rule above it.. Security rules in PAN-OS are evaluated in top-down order. If a deny rule is placed above an allow rule and both match the same traffic, the deny rule will be hit first, preventing the allow rule from ever being evaluated. This is called shadowing, and the allow rule is effectively disabled.

Answer

The deny rule is more specific and therefore takes precedence.

Answer

The allow rule requires a URL filtering profile to be hit.

Answer

The deny rule has a higher priority due to its action.

Question 6

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall has two virtual routers: VR1 for the internal network and VR2 for the internet. The syslog server is reachable only through VR1. Which configuration setting must be applied to ensure syslog messages are sent via VR1?

Accepted Answer

In the syslog server profile, specify the source address as an interface in VR1, and ensure a route exists in VR1 for the syslog server.. To force syslog traffic through a specific virtual router, you must specify a source address in the syslog server profile that belongs to that virtual router. The firewall then uses that source address for outgoing syslog packets, and the virtual router associated with that interface will handle routing. This ensures the syslog server is reached via the intended path.

Answer

Under Device > Server Profiles > Syslog, set the virtual router to VR1 for the syslog server profile.

Answer

In the log forwarding profile, configure the syslog server to use VR1 as the source interface.

Answer

Create a static route in VR1 for the syslog server IP address and ensure the firewall uses the management interface for logging.

Question 7

An administrator needs to create a security policy rule that allows only DNS traffic from the 'Guest' zone to the 'DMZ' zone. Which application should be used in the rule to achieve this?

Accepted Answer

dns. The 'dns' application in PAN-OS accurately identifies DNS traffic based on its signature, typically on port 53. Using this application in the security rule ensures that only DNS traffic is allowed from the Guest zone to the DMZ zone, while other traffic is blocked. This approach leverages App-ID for precise control, rather than relying solely on port numbers, which can be less secure.

Answer

dns-over-https

Answer

dns-base

Answer

udp-53

Question 8

A security administrator is configuring a Palo Alto Networks firewall with a security policy that allows traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that only specific users can access certain applications. The administrator creates a rule with source zone Trust, destination zone Untrust, source user 'domain\jdoe', application 'web-browsing', action allow. However, after committing, the user jdoe reports that they cannot access the web. The administrator checks the traffic logs and sees that the traffic is being denied by the implicit rule. What is the most likely cause?

Accepted Answer

User-ID is not enabled on the Trust zone, so the firewall cannot map the source IP to the user.. The most likely cause is that User-ID is not enabled on the Trust zone. For a security rule with a source user criterion to match, the firewall must map the source IP to a username. If User-ID is not enabled on the zone, the mapping does not occur, and the rule is skipped. The traffic then hits the implicit deny. The administrator should enable User-ID on the Trust zone and ensure the user mapping is working.

Answer

The user 'domain\jdoe' is not in the local user database of the firewall.

Answer

The security rule is placed below a rule that denies all traffic from Trust to Untrust.

Answer

The application 'web-browsing' is not allowed for the user 'domain\jdoe' because of an application override.

Question 9

An administrator is configuring a security policy on a Palo Alto Networks firewall. The administrator wants to allow only HTTP and HTTPS traffic from the Trust zone to the Untrust zone, and block all other applications. The administrator creates a rule with source zone Trust, destination zone Untrust, application 'web-browsing' and 'ssl', action allow. However, after committing, users can still access other applications like SSH. What is the most likely explanation?

Accepted Answer

There is another rule above this rule that allows all applications from Trust to Untrust.. The most likely explanation is that there is another rule above the newly created rule that allows all applications or specifically SSH from Trust to Untrust. Because rules are evaluated top-down, the first matching rule is applied. The administrator should check the rule order and ensure the new rule is placed above any broader allow rules.

Answer

The rule's application field is set to 'any' instead of the specific applications.

Answer

The firewall is not licensed for App-ID, so it cannot enforce application-based rules.

Answer

The security rule is not committed, so the old rules are still in effect.

Question 10

A network security administrator is configuring a security policy on a PA-5220 firewall. The administrator wants to allow HTTP and HTTPS traffic from the 'Guest' zone to the 'Internet' zone, but only for specific users in the 'guest-users' group. The administrator creates a rule with source zone 'Guest', destination zone 'Internet', source user 'guest-users', and application 'web-browsing' and 'ssl'. However, when testing, all Guest users can access the Internet, not just those in the group. What is the most likely cause?

Accepted Answer

The rule is placed below a more general rule that allows all Guest traffic to the Internet.. In PAN-OS, security rules are evaluated from top to bottom. If a rule that allows all Guest users to the Internet exists above the user-specific rule, it will match first and permit all traffic. The user-specific rule will never be evaluated. To restrict access to only the 'guest-users' group, the specific rule must be placed above any broader rules that could match the same traffic.

Answer

The application 'ssl' is not a valid application for HTTP and HTTPS traffic.

Answer

The source user group 'guest-users' does not exist in the local user database.

Answer

User-ID is not enabled on the firewall, so user-based rules are ignored.

Question 11

A security administrator is troubleshooting why a security rule that allows traffic from the 'Trust' zone to the 'DMZ' zone is not being matched. The administrator confirms that the source IP, destination IP, and application are correct. The rule is placed at the top of the rulebase. What is the most likely reason the rule is not being hit?

Accepted Answer

The destination zone is incorrectly configured on the firewall interface.. Security rules match on source and destination zones, which are determined by the interfaces the traffic enters and exits. If the DMZ interface is not assigned to the 'DMZ' zone, the destination zone in the rule will not match the actual zone of the egress interface. This prevents the rule from being hit. Checking zone assignments is a critical troubleshooting step.

Answer

The security profile attached to the rule is blocking the traffic.

Answer

The application is not recognized by App-ID due to encryption.

Answer

The rule is disabled.

Question 12

An administrator needs to allow administrators to authenticate to the firewall's web interface using an external LDAP directory at ldap.corp.example.com, while still allowing a local break-glass account. The directory uses a bind DN of cn=svc-bind,ou=service,dc=corp,dc=example,dc=com. After configuring the LDAP server profile under Device > Server Profiles > LDAP, authentication still fails for directory users. Which additional step is required?

Accepted Answer

Create an authentication profile that references the LDAP server profile and assign it to the management interface under Device > Setup > Management > Authentication Settings.. LDAP authentication on PAN-OS requires two objects: a server profile describing the directory connection, and an authentication profile that references it and defines the login method and permitted groups. Assigning the authentication profile to the management interface enables directory logins for the web UI. Local accounts remain available unless explicitly disabled, which preserves break-glass access.

Answer

Add the LDAP server to the firewall's DNS server list under Device > Setup > Services so the hostname ldap.corp.example.com resolves for authentication.

Answer

Enable 'LDAP Authentication' under Device > Setup > Management > Management Interface Settings to activate directory logins for the web UI.

Answer

Import the LDAP server's root CA certificate under Device > Certificate Management so the firewall can validate the bind DN.

Question 13

An administrator wants to block all peer-to-peer (P2P) file sharing applications while allowing other traffic. Which security policy action should be used to achieve this?

Accepted Answer

Create a rule that denies the 'p2p' application group and place it above the allow rules.. To block P2P applications, create a security policy rule with the action 'deny' and specify the 'p2p' application group. Place this rule above any allow rules that permit general internet traffic. This ensures P2P is blocked while other applications are allowed. Rule order is critical because the firewall evaluates rules top-down.

Answer

Create a rule that allows all applications except P2P, using the 'negate' option for the application.

Answer

Use an application filter that excludes P2P applications in the allow rule.

Answer

Configure a URL filtering profile that blocks P2P websites and apply it to the allow rule.

Question 14

A security administrator needs to create a policy that allows users in the 'trust' zone to access the internet, but blocks access to a specific set of known malicious URLs. The administrator has subscribed to a URL filtering service and wants to use a custom URL category to block the malicious sites. Which configuration should be used?

Accepted Answer

Create a custom URL category containing the malicious URLs, then create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the custom category.. To block specific malicious URLs while allowing general internet access, the administrator should create a custom URL category with those URLs and apply a URL filtering profile that blocks that category. The security policy rule must allow web-browsing so that traffic is permitted and then inspected by the URL filtering profile. This ensures that only the listed malicious URLs are blocked, while all other web traffic is allowed.

Answer

Create a custom URL category containing the malicious URLs, then create a security policy rule that denies web-browsing and applies a URL filtering profile that allows the custom category.

Answer

Create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.

Answer

Create a security policy rule that denies web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.

Question 15

An administrator is configuring a Palo Alto Networks firewall to use an external LDAP server for administrator authentication. The administrator wants to ensure that only members of the 'NetworkAdmins' group can log in with read-write privileges. Which configuration steps are required?

Accepted Answer

Create an LDAP server profile, an authentication profile, and an authorization profile that maps the 'NetworkAdmins' group to a read-write admin role.. Configuring LDAP administrator authentication requires three components: an LDAP server profile to define the server connection, an authentication profile to specify how users authenticate, and an authorization profile to map LDAP groups to administrative roles. By mapping only the 'NetworkAdmins' group to a read-write role, you ensure that only members of that group receive the appropriate privileges.

Answer

Create an LDAP server profile and an authorization profile that maps the 'NetworkAdmins' group to a read-write admin role. No authentication profile is needed.

Answer

Create an authentication profile and an authorization profile. The authorization profile should map all LDAP users to a read-write role, and then use a security policy to restrict access to the 'NetworkAdmins' group.

Answer

Create an LDAP server profile and an authentication profile. Assign the authentication profile directly to the admin role 'superuser'.