PCNSA Practice Test 25 — 15 Questions

Question 1

An administrator needs to restrict access to the firewall's web management interface to only the IT department subnet 10.0.0.0/24. The firewall's management interface is in the 'Management' zone. Which configuration step is required to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Interface Management Profile with permitted IP addresses 10.0.0.0/24 and apply it to the management interface.. Interface Management Profiles are specifically designed to control management access to an interface by specifying allowed IP addresses and enabled services. Applying such a profile to the management interface with 10.0.0.0/24 ensures only that subnet can access the web UI. Other options either apply to transit traffic or do not enforce source IP restrictions.

Answer

Enable 'Require HTTPS' and configure an authentication profile with allowed users from 10.0.0.0/24.

Answer

Create a security policy rule allowing only 10.0.0.0/24 to the Management zone and deny all other sources.

Answer

Set up a NAT rule to translate external IPs to the management IP and restrict via security policy.

Question 2

A security administrator at a company with a PA-5220 running PAN-OS 10.2 must ensure that configuration backups can be restored to a replacement firewall of the same model. The administrator plans to use scheduled configuration exports and also wants to retain a copy of the running configuration before a major change. Which TWO actions will satisfy these requirements? (Choose two.)

Accepted Answer

Create a scheduled configuration export under Device > Setup > Operations that saves a full configuration snapshot to an external SCP server on a recurring basis.. Scheduled configuration exports provide recurring off-box full configuration snapshots that can be loaded onto a replacement firewall, satisfying disaster recovery. Named configuration snapshots taken before a major change provide a local rollback point on the same device. Together they cover both off-box retention and quick local recovery, while log exports and device state exports do not contain the full configuration.

Answer

Export only the device state under Device > Setup > Operations, since the device state contains all security policy and object definitions.

Answer

Configure a scheduled log export to the same SCP server so that configuration and logs are stored together for restoration.

Answer

Enable configuration versioning under Device > Setup > Management so the firewall automatically pushes each commit to an external repository.

Question 3

A security administrator needs to restrict access to the firewall's web management interface to only the IP address 10.1.1.100. The administrator logs into the firewall and navigates to Device > Setup > Management. Which configuration should be modified?

Accepted Answer

Management Interface Settings: Add 10.1.1.100/32 to the Permitted IP Addresses list.. The Permitted IP Addresses list under Device > Setup > Management > Management Interface Settings is specifically designed to restrict management access to specified IP addresses. Adding 10.1.1.100/32 ensures only that host can connect to the web interface. Other settings, such as admin roles or service ports, do not provide IP-based restriction.

Answer

Device > Setup > Services: Configure a security policy rule to allow only 10.1.1.100 to the management interface.

Answer

Administrative Accounts: Create a new admin role with read-only access for 10.1.1.100.

Answer

Management Interface Settings: Enable HTTP and HTTPS on the management interface.

Question 4

An administrator is configuring a security policy on a PA-3260 firewall. The administrator wants to ensure that a rule allowing SSH from the 'Management' zone to the 'Internal' zone is only active during business hours (9 AM to 5 PM) on weekdays. The administrator creates a schedule object named 'BusinessHours' and attaches it to the rule. However, after applying the policy, SSH access is allowed at all times. What is the most likely reason?

Accepted Answer

Another rule above the scheduled rule allows SSH from Management to Internal without a schedule.. In PAN-OS, schedule objects are used to define time-based rules. If a rule with a schedule is placed below another rule that matches the same traffic without a schedule, the first rule will match and allow traffic at all times. The scheduled rule will never be evaluated. To enforce time-based access, the scheduled rule must be placed above any broader rules that could match the same traffic.

Answer

The schedule object was not applied to the correct rule.

Answer

The schedule object 'BusinessHours' is not committed to the firewall.

Answer

The schedule object 'BusinessHours' is defined with the wrong time zone.

Question 5

A security administrator is creating a Security policy rule to allow only the business-critical functions of a SaaS application while blocking its social and file-sharing components. The administrator wants the firewall to distinguish between the different functions within the same application. Which App-ID capability should be used to accomplish this?

Accepted Answer

Application functions. Application functions are the mechanism App-ID uses to expose individual capabilities within a single application as separate policy objects. A rule that references a function App-ID can allow or deny that specific behavior without affecting the rest of the application. This is the only option that provides the required per-function granularity within the same SaaS application.

Answer

Application subcategories

Answer

Application filters

Answer

Application containers

Question 6

A security administrator notices that a large number of unknown TCP sessions are being generated by an internal application. The administrator wants to identify the application using App-ID. Which action should they take first?

Accepted Answer

Use the Application Command Center (ACC) to view unknown applications and their characteristics.. The Application Command Center (ACC) provides detailed visibility into unknown applications, including their traffic patterns and endpoints. By analyzing this information, the administrator can determine if the application is a custom internal tool or a known application that is not yet identified. This is the recommended first step before creating a custom App-ID or contacting support. Other actions like creating a port-based App-ID or enabling logging are not as effective for initial identification.

Answer

Enable logging on the security policy rule to capture the unknown sessions.

Answer

Submit a support ticket to Palo Alto Networks to create a new App-ID.

Answer

Create a custom App-ID based on the destination port.

Question 7

A network security administrator needs to ensure that a Palo Alto Networks firewall sends SNMP traps to a monitoring server at 10.1.1.50 using the MGT interface. The administrator has already added the SNMP community string and trap destination under Device > Setup > Services > SNMP. However, no traps are being received. Which additional configuration is required to ensure traps are sent from the MGT interface?

Accepted Answer

Create a service route for SNMP under Device > Setup > Services > Service Routes.. Service routes override the default source interface for management services such as SNMP, syslog, and email. When a specific source interface is required, a service route must be configured. Without it, the firewall may use a different interface, causing the SNMP server to reject or ignore traps. Thus, creating a service route for SNMP is the correct action.

Answer

Enable SNMP on the MGT interface under Network > Interfaces > Management.

Answer

Assign the SNMP server IP address to a custom zone and create a NAT policy.

Answer

Configure a security policy rule allowing SNMP traffic from the MGT interface to the SNMP server.

Question 8

A security administrator is reviewing the security policy on a PA-220 firewall. The administrator notices that a rule allowing DNS from the 'Trust' zone to the 'Untrust' zone is being shadowed by a rule above it that denies all traffic from 'Trust' to 'Untrust'. What is the term for this situation?

Accepted Answer

Rule shadowing. Rule shadowing in PAN-OS occurs when a rule is placed below another rule that matches the same traffic and takes a different action, causing the lower rule to never be evaluated. In this case, the deny rule above the DNS allow rule shadows it, effectively disabling the allow rule. This is a critical policy management issue that can be identified using the firewall's rule analysis tools.

Answer

Rule duplication

Answer

Rule overlap

Answer

Rule conflict

Question 9

An administrator is configuring a Palo Alto Networks firewall to send email alerts for critical system events. The administrator has configured an SMTP server under Device > Setup > Services > Email. However, test emails are not being delivered. Which additional step is required to allow the firewall to send email alerts?

Accepted Answer

Set up a service route for SMTP under Device > Setup > Services > Service Routes.. Email alerts are sent from the management plane, and their source interface is determined by service routes. If the SMTP server is not reachable from the default management interface, a service route must be configured to specify the correct egress interface. This ensures that the firewall can deliver email alerts successfully. Without a service route, the firewall may use an interface that cannot reach the SMTP server.

Answer

Enable SMTP in the Management Interface settings under Network > Interfaces.

Answer

Configure a security policy rule allowing SMTP traffic from the firewall to the SMTP server.

Answer

Add an SNMP trap destination for email notifications.

Question 10

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable via a specific interface and virtual router. Which two configurations are required to ensure that syslog messages are sent from the correct source interface? (Choose two.)

Accepted Answer

Configure a Syslog Server Profile and assign it to the appropriate log forwarding settings.. To send logs to an external syslog server, you must configure a Syslog Server Profile and apply it to log forwarding settings. To control the source interface used for syslog messages, you must configure a service route for the syslog service, specifying the desired interface and virtual router. These two steps ensure that logs are sent from the correct interface. Security policies and Interface Management Profiles do not influence syslog source interface selection.

Answer

Specify the source interface in the Syslog Server Profile.

Answer

Enable syslog on the management interface via an Interface Management Profile.

Answer

Create a Security policy rule allowing syslog traffic from the firewall to the syslog server.

Question 11

A network security administrator needs to confirm whether the firewall is actually decrypting outbound web traffic and which URLs are being decrypted. The administrator wants to see entries that explicitly show the decryption status of each session. Which log type and field combination should the administrator use?

Accepted Answer

Decryption log with the 'Decryption Status' field and URL details. The Decryption log is the authoritative source for verifying SSL/TLS decryption. It records the decryption policy match, the decryption status of each session, and associated URL or host details, allowing an administrator to confirm that outbound web traffic is being decrypted and to see the specific URLs involved. Other log types either record security events, system events, or session termination reasons and do not provide per-session decryption confirmation.

Answer

Traffic log with the 'Session End Reason' field filtered for 'decrypt'

Answer

Threat log filtered by 'ssl-decryption' threat ID

Answer

System log filtered by subtype 'ssl-decrypt'

Question 12

An administrator wants to ensure that only the firewall administrator's workstation at 203.0.113.45 can reach the web management interface on a PA-3220 running PAN-OS 10.2. The workstation is on the trust zone, and management access is currently allowed from any address on the management interface. Which configuration object should the administrator create and apply to the management interface?

Accepted Answer

An Interface Management profile with HTTPS enabled and the permitted IP address 203.0.113.45/32, applied to the management interface.. Interface Management profiles are the correct mechanism to control which management services (HTTPS, SSH, SNMP, etc.) are enabled on an interface and to restrict those services to specific permitted IP addresses. By creating a profile with HTTPS enabled and only 203.0.113.45/32 as a permitted address, the administrator ensures that the web management interface is reachable only from the intended workstation, directly meeting the stated requirement.

Answer

A Management Interface ACL applied to the trust zone interface, permitting only 203.0.113.45.

Answer

A Security policy rule from the trust zone to the management zone allowing only 203.0.113.45, with a default deny rule after it.

Answer

An Authentication profile bound to the management interface, allowing only the user account associated with 203.0.113.45.

Question 13

A security administrator notices that a SaaS application is allowed by the security policy, but the firewall is not decrypting the traffic. Without decryption, which Content-ID feature can still identify and control the application's use based on the server certificate?

Accepted Answer

Certificate-based App-ID. Certificate-based App-ID is designed to identify applications by examining the server certificate presented during the TLS handshake, without requiring decryption. This allows enforcement of security policies for SaaS applications while maintaining end-to-end encryption. Decryption profiles, File Blocking, and Data Filtering all require visibility into the payload, which is not available when traffic remains encrypted. Thus, certificate-based App-ID is the correct Content-ID feature for this scenario.

Answer

SSL Decryption profile

Answer

File Blocking profile

Answer

Data Filtering profile

Question 14

An administrator at a branch office with a PA-440 needs to allow the firewall itself to resolve external hostnames and to forward DNS queries from internal clients to public resolvers. The administrator wants to configure a DNS proxy on the firewall so clients use the firewall's interface IP as their DNS server. Which configuration step is required to enable this behavior?

Accepted Answer

Configure a DNS Proxy object under Network > DNS Proxy and assign it to the ingress interface, then create a security policy rule allowing DNS from the internal zone to the untrust zone.. DNS Proxy is a Network configuration object bound to an interface where client queries arrive, with upstream servers the firewall forwards to. Enabling it requires both the proxy object assignment and a security policy allowing DNS from the client zone to the upstream zone, because proxied traffic is still evaluated by policy. The firewall's own DNS server list is separate and only affects management-plane lookups.

Answer

Enable DNS resolution under Device > Setup > Services and add the public resolvers to the firewall's DNS server list; clients will be automatically redirected to the firewall.

Answer

Configure an Application Override policy for DNS on port 53 so the firewall inspects and answers queries on behalf of clients.

Answer

Create a NAT rule translating TCP and UDP port 53 from the internal zone to a public resolver, which will cause the firewall to act as a DNS proxy.

Question 15

An administrator manages a PA-3220 running PAN-OS 10.2 with two virtual routers: VR-A for the internal network and VR-B for the internet. The firewall must send SNMP traps, syslog, and email alerts to servers reachable only through VR-B. Which setting directly controls which virtual router the firewall uses to egress that management-plane traffic?

Accepted Answer

The Service Route Configuration under Device > Setup > Services. Firewall-originated management services such as SNMP, syslog, and email do not follow dataplane routing by default; they are steered by Service Route Configuration. Binding each service to an interface in VR-B forces that egress path, which is exactly what the scenario requires. Other mechanisms either affect only transit traffic or the dedicated management port.

Answer

A static route in VR-A pointing to the SNMP, syslog, and SMTP servers

Answer

A Policy-Based Forwarding (PBF) rule matching the firewall's own management traffic

Answer

The Management Interface's default gateway under Device > Setup > Interfaces