PCNSA Practice Test 1 — 25 Questions

Question 1

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Accepted Answer

The application ssl is not matching because HTTPS traffic may be classified as web-browsing.. Option A is correct: HTTPS traffic is typically classified as application 'web-browsing', not 'ssl'. The rule specifies application 'ssl', so the traffic does not match because the application mismatch occurs before the service check. Option B is incorrect because the action 'allow' is valid; security profiles are optional and do not affect rule matching. Option C is misleading: although service 'https' uses TCP 443, the application 'ssl' is for VPN/encryption, not HTTPS; the issue is the application mismatch, not the service. Option D is incorrect because the destination address '10.10.10.0/24' includes the host 10.10.10.5.

Answer

The action should be 'allow with security profile'.

Answer

The service https requires TCP 443, but ssl application is used for encryption.

Answer

The destination address is a specific subnet but the user is accessing a host within that subnet.

Question 2

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Accepted Answer

Deny the traffic because rule 2 matches and denies social-networking.. The firewall evaluates rules in order from top to bottom. Rule 2 explicitly denies the application 'social-networking', and since the user at 192.168.1.10 is attempting to access a social-networking site, rule 2 matches before any subsequent rule. Therefore, the traffic is denied. Option D is correct because rule 2 matches and denies the traffic.

Answer

Allow the traffic because rule 1 matches and allows all web traffic.

Answer

Allow the traffic because rule 3 allows all traffic.

Answer

Deny the traffic because no rule allows social-networking.

Question 3

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit. VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Answer

Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit

Answer

Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit

Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy

Question 4

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.

Question 5

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 6

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Accepted Answer

Enable Session Setup and State Synchronization under HA configuration. Option C is correct because session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Answer

Configure HA1 and HA2 interfaces with appropriate IPs

Answer

Enable Config Sync on the HA General tab

Answer

Configure Path Monitoring to detect link failures

Question 7

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 8

Refer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?

Accepted Answer

Rule 2 (Allow-Any-Web). Rule 2 (Allow-Any-Web) is correct because it is a broad rule that permits HTTP (port 80) traffic from any source to any destination, which matches the user's attempt to browse to an external website. The traffic originates from the Sales subnet (10.10.1.50) and targets IP 203.0.113.50 on port 80, and since no more specific rule (like Rule 1) matches the destination, Rule 2 applies as the first general web access rule.

Answer

Rule 4 (Allow-DNS)

Answer

Rule 3 (Block-Restricted-Apps)

Answer

Rule 1 (Allow-Sales-to-App)

Question 9

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Accepted Answer

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.. Option B is correct because Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Answer

Use URL Filtering to block BitTorrent.

Answer

Use Data Filtering to block BitTorrent traffic.

Answer

Block the commonly used ports for BitTorrent.

Question 10

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 11

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. Option A is correct because a Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 12

A security administrator wants to block users from accessing social media websites during business hours. The firewall is connected to the internet and has a Security policy that allows general web browsing. What is the most efficient way to block social media?

Accepted Answer

Create a new Security policy rule with a URL Filtering profile that blocks the social-media category.. Option B is correct because URL Filtering profiles are specifically designed to block entire categories of websites (like social media) based on URL categorization, which is the most efficient method for blocking access to social media sites. This approach leverages Palo Alto Networks' URL Filtering database, which categorizes millions of URLs, allowing the administrator to block the entire 'social-media' category with a single policy rule without needing to identify individual applications or destinations.

Answer

Create a new Security policy rule with an Application ID that blocks social-media applications.

Answer

Add a Custom Signature to the existing rule to block social media traffic.

Answer

Modify the existing web browsing rule to deny social media destinations.

Question 13

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 14

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

Accepted Answer

An application on the internal network is not completing TCP handshakes.. A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.

Answer

A DDoS attack is flooding the firewall with SYN packets.

Answer

The firewall's TCP timeout setting is too short.

Answer

The firewall's hardware is failing.

Question 15

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

Accepted Answer

Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.. Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.

Answer

Create a VPC peering connection between the two subnets and attach the firewall.

Answer

Attach the firewall to a single subnet and use it as a default gateway for both subnets.

Answer

Configure AWS security groups to route traffic through the firewall.

Question 16

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Accepted Answer

The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.. Option B is correct because after a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Answer

The firewall's CPU and memory are insufficient for the new PAN-OS version.

Answer

The firewall is performing a backup of the configuration.

Answer

The rulebase has grown too large.

Question 17

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Option B is correct because setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 18

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

Accepted Answer

The rule is disabled in the rulebase.. Option D is correct because if a security policy rule is disabled in the rulebase, it will not be evaluated or enforced, even if it matches the traffic. The firewall will skip the rule entirely, meaning no logging or inspection occurs for traffic that would have matched it. This directly explains why the traffic is not being inspected or logged despite the rule appearing to be configured.

Answer

The rule is placed below an earlier rule that also matches the traffic.

Answer

The firewall's license for the threat prevention subscription has expired.

Answer

The firewall is in an active/passive HA pair and the passive unit is handling traffic.

Question 19

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Accepted Answer

Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.. Option D is correct because, by default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Answer

Configure a zone protection profile on the DMZ zone.

Answer

Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.

Answer

Create a rule allowing traffic from DMZ to Untrust with a deny action.

Question 20

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

Accepted Answer

Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).. Option A is correct because it implements a least-privilege security model using Palo Alto Networks zones and granular application- and port-based rules. By creating separate zones (Web, App, DB) and explicitly allowing only the necessary protocols (e.g., HTTP/HTTPS from the internet to Web, specific ports from Web to App, and specific ports from App to DB), the firewall enforces strict segmentation and minimizes the attack surface. This design leverages the zone-based security paradigm of PAN-OS to control inter-zone traffic precisely, aligning with the principle of zero trust.

Answer

Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.

Answer

Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.

Answer

Place all servers in the same zone and use rules to allow traffic between them.