PCNSA Practice Test 25 — 15 Questions

Question 1

Refer to the exhibit. The administrator wants to remove unused rules to improve performance. Which rule should be removed?

Accepted Answer

deny-ssh. The rule 'deny-ssh' has a hit count of 0, indicating it is not being used and should be removed to improve performance. Option A is incorrect because 'deny-all' has 73 hits. Option B is incorrect because 'allow-dns' has many hits. Option D is incorrect because 'allow-web' has many hits. Therefore, option C is correct.

Answer

deny-all

Answer

allow-dns

Answer

allow-web

Question 2

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Accepted Answer

SSH Proxy. SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Answer

SSL Forward Proxy

Answer

Inbound Inspection

Answer

Decryption Mirror

Question 3

A company has a security policy that allows 'ssl' application but does not have SSL decryption enabled. What can App-ID still identify from the encrypted session?

Accepted Answer

The SNI (Server Name Indication).. App-ID can identify the SNI (Server Name Indication) from an encrypted session because the SNI is sent in cleartext during the TLS handshake, before encryption begins. This allows the firewall to determine the destination hostname without decrypting the traffic, enabling policy enforcement based on the application or domain even when SSL decryption is disabled.

Answer

The exact URL being accessed.

Answer

The file type being transferred.

Answer

The client and server IP addresses.

Question 4

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 5

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

Accepted Answer

Verify the SNMP community string and allowed management IPs in the SNMP server profile. The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Answer

Check that the SNMP manager supports SNMPv3

Answer

Verify that the firewall's management IP is reachable from the SNMP manager

Answer

Ensure the SNMP manager is running on the same subnet as the firewall

Question 6

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

Accepted Answer

An application on the internal network is not completing TCP handshakes.. A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.

Answer

A DDoS attack is flooding the firewall with SYN packets.

Answer

The firewall's TCP timeout setting is too short.

Answer

The firewall's hardware is failing.

Question 7

A security architect is planning a deployment for a multi-tenant data center where each tenant requires isolated security policies and separate administrators. Which Palo Alto Networks architecture best meets these requirements?

Accepted Answer

Deploy a single firewall with multiple virtual systems (vsys).. Virtual systems (vsys) allow a single Palo Alto Networks firewall to be partitioned into multiple logical firewalls, each with its own independent security policies, administrators, and virtual routers. This provides complete tenant isolation and separate administrative domains without requiring additional physical hardware, making it the ideal architecture for a multi-tenant data center.

Answer

Deploy a single firewall with multiple virtual routers and separate zone definitions.

Answer

Use a single firewall with a single management profile and role-based access control.

Answer

Deploy multiple physical firewalls, one per tenant.

Question 8

A user from 10.0.0.5 tries to access 8.8.8.8 on TCP 443. The traffic is matched to the above rule. Which additional configuration is required for the traffic to be decrypted?

Accepted Answer

Both a Decryption policy rule and a Decryption Profile. For traffic to be decrypted, a Decryption policy rule must explicitly match the traffic and a Decryption Profile with SSL Forward Proxy enabled must be applied. The rule alone only identifies traffic for potential decryption; the profile defines the decryption method (e.g., SSL Forward Proxy) and controls certificate handling. Without both, the firewall will not perform decryption even if the security rule allows the traffic.

Answer

A Decryption policy rule matching the same traffic

Answer

An SSL Forward Proxy certificate installed

Answer

A Decryption Profile with SSL Forward Proxy enabled

Question 9

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Accepted Answer

The policy "Allow_SSH" has tunnel detection set to none, so it does not match.. The Allow_SSH policy has tunnel detection set to 'none', which means the firewall will not detect SSH tunnels, so the policy does not match. The other options are incorrect: Option B is wrong because the Block_Tor policy only blocks Tor tunnels, not all tunnels. Option C is wrong because TTL is not related to SSH tunnel detection. Option D is wrong because the default action for application tunnels is not necessarily deny; it depends on the policy configuration.

Answer

The application tunnel policy "Block_Tor" is blocking all tunnels.

Answer

The time-to-live setting prevents SSH tunnel detection.

Answer

The default action for application tunnels is deny.

Question 10

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

Accepted Answer

The address object has multiple tags including the wrong one. Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Answer

The group is configured as static

Answer

The dynamic group uses 'match all' and the object lacks some tags

Answer

The administrator added the object directly to the group

Question 11

Refer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?

Accepted Answer

Rule 2 (Allow-Any-Web). Rule 2 (Allow-Any-Web) is correct because it is a broad rule that permits HTTP (port 80) traffic from any source to any destination, which matches the user's attempt to browse to an external website. The traffic originates from the Sales subnet (10.10.1.50) and targets IP 203.0.113.50 on port 80, and since no more specific rule (like Rule 1) matches the destination, Rule 2 applies as the first general web access rule.

Answer

Rule 4 (Allow-DNS)

Answer

Rule 3 (Block-Restricted-Apps)

Answer

Rule 1 (Allow-Sales-to-App)

Question 12

During a firewall upgrade from PAN-OS 9.1 to 10.0, the administrator receives an error that the upgrade cannot proceed because there is a pending commit. The administrator checks the commit status and sees that a commit was initiated but has not completed. What is the best course of action?

Accepted Answer

Run 'commit force yes' from the CLI to force the commit. The 'commit force yes' command overrides a stuck or incomplete commit by forcing the commit operation to proceed, which clears the pending commit state and allows the upgrade to continue. In PAN-OS, a pending commit blocks administrative operations like upgrades, and forcing the commit is the safest way to resolve this without disrupting the firewall's operational state.

Answer

Reboot the firewall to clear the pending commit

Answer

Wait for the commit to complete automatically

Answer

Cancel the upgrade and restart

Question 13

Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?

Accepted Answer

The firewall's system time is ahead of the certificate's validity start. When the firewall's system time is ahead of the certificate's validity start (the 'not before' date), the firewall considers the certificate as not yet valid. During SSL/TLS decryption, the firewall validates the server certificate's time constraints against its own system clock. If the firewall's clock is ahead, the certificate appears to be from the future, causing a decryption failure even though the server and client clocks may be correct.

Answer

The server's certificate is expired

Answer

The decryption profile rejects self-signed certificates

Answer

The client's system time is behind

Question 14

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.. It creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.

Answer

Modify the existing decrypt rule to decrypt all categories except those two.

Answer

Disable decryption entirely for all student traffic.

Answer

Create a security policy rule to allow traffic to those URL categories without inspection.

Question 15

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Accepted Answer

Create a decryption policy with action 'no-decrypt' for traffic to financial sites, and a catch-all decryption policy with action 'decrypt' for all other traffic.. It uses a specific 'no-decrypt' action in a decryption policy for financial sites, which explicitly excludes them from SSL/TLS decryption. A catch-all policy with 'decrypt' then ensures all other internal user traffic is decrypted. This approach directly aligns with the forward proxy requirement to decrypt all traffic except the specified financial sites.

Answer

Create a decryption policy and use the 'exclude cache' option for financial sites.

Answer

Create a security policy that allows financial sites without decryption; then create a decryption policy with action 'no-decrypt' for those sites.

Answer

Create a decryption policy with action 'decrypt' and a source zone of internal; then create a decryption exemption for financial URLs.