PCNSA Practice Test 2 — 25 Questions

Question 1

A company deploys a Palo Alto Networks firewall in a cloud environment using the VM-Series. The firewall must scale to handle traffic spikes. Which architectural approach provides the best elasticity and management simplicity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a VM-Series firewall with auto-scaling group and integration with Panorama.. Using a VM-Series firewall with an auto-scaling group and integration with Panorama provides the best elasticity and management simplicity. Auto-scaling dynamically adjusts the number of firewall instances based on traffic load, while Panorama centralizes configuration, policy management, and monitoring, eliminating the need for manual per-instance management. This approach aligns with cloud-native principles for scaling and operational efficiency.

Answer

Deploy multiple VM-Series firewalls in active/active HA with a virtual load balancer.

Answer

Use a single large VM-Series instance.

Answer

Combine physical and virtual firewalls with a shared configuration.

Question 2

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 3

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

Accepted Answer

The application filter must specify the parent application 'facebook' because 'facebook-base' is a sub-application.. In Panorama, application filters require the parent application name when filtering by sub-application. 'facebook-base' is a sub-application of 'facebook', so the correct filter should be '(app eq facebook) (subapp eq facebook-base)'. Option A correctly identifies that the filter must specify the parent application. Option B is incorrect because Panorama supports both scheduled and ad-hoc queries. Option C is incorrect because the report template does not need to be committed to a device group; reports are run independently. Option D is incorrect because log forwarding to Panorama is configured in the log forwarding profile, but the port is not the issue; the logs are already forwarded.

Answer

Panorama only supports scheduled reports, not ad-hoc queries.

Answer

The report template is not committed to the device group.

Answer

The firewall's log forwarding profile must be set to send logs to Panorama on a separate port.

Question 4

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 5

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Accepted Answer

The traffic is being dropped due to a security policy rule that denies the traffic. If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer

The traffic is intra-zone, not inter-zone

Answer

The firewall is using hardware offload for fast-path processing

Answer

The packet is part of an existing session that has not timed out

Question 6

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 7

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies. WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 8

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Accepted Answer

Verify that the policy has the correct source zone.. Options B and C are correct. Verifying the source zone (B) ensures the policy is applied to the correct traffic flow. Checking the traffic log (C) shows whether the session matched a security policy. Option A (CPU usage) does not verify policy matching. Option D (Threat log) is for blocked malicious traffic, not for verifying allowed traffic. Option E (URL filtering profile) is a content inspection feature, not directly for verifying policy matching.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 9

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule. This is a standard method of creating an exception to a broader deny rule.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 10

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 11

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Placing the most specific rules at the top of the rulebase (option B) ensures that traffic is matched quickly and correctly, reducing latency. Regularly reviewing and removing unused rules using hit counts (option D) improves performance and reduces security risks. Option A is wrong because enabling logging on all rules can overwhelm storage and impact performance, not increase visibility effectively. Option C is wrong because using a single 'allow all' rule defeats the purpose of a security policy and allows any traffic. Option E is wrong because disabling unused rules leaves clutter and can cause confusion; it's better to remove them.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 12

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options C and D are correct. To ensure traffic is inspected by threat prevention features, you need a security rule that allows the traffic and includes a security profile group with threat prevention (C). Additionally, the rule's action must be set to 'allow' (D) for the traffic to pass through and be inspected; otherwise, traffic would be blocked. Option A (decryption) is only required for encrypted traffic, but the question does not specify that all traffic is encrypted, so it is not universally required. Option B (NAT) is for address translation, not inspection. Option E (application override) is not necessary for threat prevention.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 13

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. Logging at session start records the session creation, which corresponds to when the session is established. This meets the administrator's requirement to log traffic from engineering to server zone only when a session is established. Option A (log at both session start and end) is incorrect because it would create duplicate logs and potentially excessive logging. Option B (no log) is incorrect because it provides no audit trail. Option C (log at session end) is incorrect because it logs only when the session terminates, not at establishment.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 14

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection. Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 15

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.

Question 16

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. The most likely cause is that the new rule is placed at the bottom of the security policy rulebase. Palo Alto Networks firewalls evaluate rules from top to bottom. If an existing deny rule that matches the same traffic (e.g., any-any deny) is placed above the new allow rule, the deny rule will match first and block the traffic. Therefore, the new allow rule never gets evaluated. Option C correctly identifies this issue.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.

Question 17

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

Accepted Answer

Policy Optimizer. Policy Optimizer (Option A) is the correct answer because it analyzes existing firewall rules and provides recommendations to consolidate, merge, or remove redundant and unused rules, making it ideal for simplifying legacy policies before migration to a Palo Alto Networks firewall. Option B, WildFire, is a cloud-based threat analysis service and does not simplify rules. Option C, Application Override, is used to bypass application identification for specific traffic, not for policy simplification. Option D, User-ID, maps users to IP addresses for user-based policies, which does not address rule simplification.

Answer

WildFire

Answer

Application Override

Answer

User-ID

Question 18

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options with null label, A, and D are correct. The null option is correct because if the destination address object is not in the rule's referenced address group, the rule will not match the traffic. Option A is correct because the traffic must match the source zone specified in the rule; otherwise, the rule is skipped. Option D is correct because a disabled rule is not evaluated and thus will not be hit. Option B is incorrect because a high hit count indicates the rule is being hit, not that it is not matched. Option C is incorrect because log forwarding configuration does not affect rule matching. Option E is incorrect because even though the action is set to drop, the rule can still be matched (and then drops traffic), so it can be hit.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 19

A network administrator is migrating from a legacy firewall to a new Palo Alto Networks firewall. The current firewall has a large number of ACL rules that allow traffic based on source/destination IP and port. The administrator wants to convert these rules to App-ID based policies on the Palo Alto firewall. What is the recommended best practice to ensure a smooth migration while maintaining security?

Accepted Answer

Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.. The recommended best practice for migrating from legacy firewall rules to App-ID based policies is to first replicate the existing port-based rules on the Palo Alto firewall to ensure no disruption to traffic. Then, enable App-ID in learning mode (or 'log and learn') to observe the actual applications being used. This allows the administrator to identify applications without blocking them. After sufficient data is collected, the administrator can create App-ID based policies. Option A is incorrect because Policy Optimizer is used for optimization after migration, not as the first step. Option B is risky as it leaves no security policies. Option D could cause outages by immediately enforcing App-ID.

Answer

Use the Policy Optimizer feature in Panorama to analyze existing logs and generate App-ID based policy recommendations.

Answer

Deploy the Palo Alto firewall inline with no policies first, and let it learn the traffic patterns automatically for a week.

Answer

Convert all existing rules to App-ID by using the application default ports and immediately enforce application blocking.

Question 20

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny