PCNSA Practice Test 4 — 25 Questions

Question 1

A syslog server is only reachable through a specific interface on the firewall. To ensure syslog logs are sent via that interface, which configuration is required?

Accepted Answer

Set up a service route for syslog. Service routes in Palo Alto Networks firewalls allow you to specify which source interface or IP address is used for outbound traffic from the firewall itself, such as syslog, SNMP, or authentication. By configuring a service route for syslog, you ensure that syslog messages are sourced from the specific interface that can reach the syslog server, even if the routing table would otherwise choose a different path.

Answer

Configure a static route for the syslog server IP

Answer

Enable NAT on the syslog traffic

Answer

Use policy-based forwarding for syslog traffic

Question 2

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. Palo Alto Networks security policies are evaluated top-down, and the first rule that matches the traffic is applied. If an existing deny rule that matches HTTP from Trust to Untrust sits above the new allow rule, the deny rule wins and traffic remains blocked. The new rule must be moved above the deny rule (or the deny rule modified) to take effect.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.

Question 3

Which THREE are required for Panorama to manage a firewall? (Select three)

Accepted Answer

Certificate-based mutual authentication (or pre-shared key). Panorama and managed firewalls must establish a secure, authenticated connection using either certificate-based mutual authentication or a pre-shared key. This ensures that only authorized firewalls can register with Panorama and receive configuration updates, preventing unauthorized devices from joining the management domain.

Answer

A valid Panorama license

Answer

Panorama plugin installed on the firewall

Question 4

A security analyst notices that a legitimate application is being incorrectly identified as a different application by the firewall. What is the best first step to resolve this issue?

Accepted Answer

Verify the application signature in the App-ID database and submit a false-positive report if needed. The first step in resolving an application misidentification is to verify the application signature in the App-ID database. If the signature is incorrect or missing, submitting a false-positive report allows Palo Alto Networks to update the database, ensuring accurate identification without manual overrides. This aligns with the principle of using the built-in App-ID engine as the primary identification method.

Answer

Reboot the firewall to refresh the application cache

Answer

Disable the application override and use port-based rules

Answer

Create a custom App-ID to override the incorrect identification

Question 5

Match each PAN-OS component to its role.

Accepted Answer

Management Plane: Handles device configuration, management access, and logging.. The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Answer

Management Plane: Processes and forwards network traffic based on security policies.

Answer

Data Plane: Handles device configuration, management access, and logging.

Question 6

Which three of the following services are commonly permitted on the management interface? (Choose three.)

Accepted Answer

Ping. Ping (ICMP Echo) is commonly permitted on the management interface because it allows network administrators to verify the interface's reachability and responsiveness without exposing management services to unnecessary risk. While ICMP is not a management protocol per se, it is a fundamental troubleshooting tool that is typically allowed on the management plane to test connectivity to the management IP address.

Answer

HTTP

Answer

Telnet

Question 7

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. In Palo Alto Networks security policies, rules are evaluated top-down, and the first match is applied. To allow specific traffic while still blocking other traffic, the administrator should add a new allow rule above the existing deny rule that matches the specific source IP range and application. This ensures the specific traffic is permitted, while all other traffic continues to be blocked by the deny rule below.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 8

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

Accepted Answer

Configure User-ID by integrating with Active Directory or using captive portal.. User-ID requires a source of user-to-IP mapping. The two supported methods on Palo Alto Networks firewalls are integrating with a directory service such as Active Directory (via the User-ID Agent or Windows-based agent) or using captive portal to force users to authenticate. Once mappings exist, security policies can reference users or groups in the Source User field.

Answer

Deploy SSL decryption to see user credentials.

Answer

Enable URL Filtering to track user visits.

Answer

Activate App-ID to detect user login events.

Question 9

Which THREE actions can be taken based on hit counts in security rules? (Select three.)

Accepted Answer

Identify unused rules for cleanup. Hit counts record how many times each security rule has matched traffic, so option A is correct because rules showing zero or near-zero hits over a long period are strong candidates for removal during rule cleanup. Option C is correct because hit counts reveal which rules are heavily used versus rarely used, letting administrators focus optimization and consolidation efforts on the rules that matter most. Option D is correct because comparing expected traffic against actual hit counts helps diagnose why traffic is or is not matching a given rule, exposing mis-ordered or mis-scoped rules. Option B is not correct because hit counts are observational statistics and do not themselves trigger or generate dynamic rule updates. Option E is not correct because shadowing is determined by analyzing rule order and overlapping match criteria, not by hit-count values alone.

Answer

Create dynamic updates to rules

Answer

Determine rule shadowing

Question 10

An administrator modifies a security policy but the change does not take effect. What must the administrator do?

Accepted Answer

Commit the configuration.. In Palo Alto Networks firewalls, configuration changes are made in a candidate configuration that is not active until explicitly committed. The administrator must commit the configuration to apply the changes to the running configuration and enforce the new security policy. Without a commit, the modification remains pending and does not affect traffic.

Answer

Import the configuration.

Answer

Save the configuration.

Answer

Reboot the firewall.

Question 11

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Accepted Answer

Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.. By default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Answer

Configure a zone protection profile on the DMZ zone.

Answer

Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.

Answer

Create a rule allowing traffic from DMZ to Untrust with a deny action.

Question 12

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Accepted Answer

Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.. Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Answer

Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.

Answer

Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.

Answer

Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.

Question 13

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

Accepted Answer

A security policy rule that allows traffic from the internet zone to the DMZ zone and has a threat prevention profile attached.. A security policy rule that allows traffic from the internet zone to the DMZ zone with a threat prevention profile attached is the essential component to inspect all traffic from the internet to the internal web server for threats. The threat prevention profile enables the firewall to perform intrusion prevention system (IPS) and antivirus inspection on the allowed traffic, ensuring malicious content is blocked. Without this profile, traffic would be permitted but not inspected for threats, failing the requirement.

Answer

Destination NAT policy to translate the public IP to the internal server.

Answer

SSL decryption policy to decrypt traffic to the web server.

Answer

A QoS policy to prioritize web traffic.

Question 14

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.

Question 15

A company requires automatic daily backups of the firewall configuration. Which method should be used?

Accepted Answer

Schedule a configuration backup under Device > Setup > Operations. The PAN-OS web interface provides a built-in scheduler under Device > Setup > Operations that allows administrators to automate daily configuration backups without external scripts or manual intervention. This method is the simplest and most reliable way to ensure consistent backups, as it leverages the firewall's native scheduling capability.

Answer

Backup the config using TFTP from the CLI

Answer

Write a script using the PAN-OS API to copy the running config

Answer

Use the 'Export Device State' feature manually

Question 16

An administrator is troubleshooting decryption-related connectivity issues. Which two log types should be examined to gather information about decryption actions and errors?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record details about SSL/TLS decryption actions, including handshake failures, certificate validation errors, and decryption policy matches. When troubleshooting connectivity issues related to decryption, these logs provide the most direct insight into why a session might be blocked or failing due to decryption errors.

Answer

System logs

Answer

URL Filtering logs

Answer

Threat logs

Question 17

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 18

A small business uses a single PA-220 firewall for internet access and has three internal zones: Trust, DMZ, and Guest. Users in the Trust zone report intermittent connectivity to a public cloud application. The firewall administrator checks the traffic logs and sees that sessions to the cloud application show "Application: ssl" and "Action: allow". The administrator suspects the issue might be related to decryption. The firewall currently has a decryption policy that decrypts all outbound HTTPS traffic for threat inspection. The cloud application uses certificate pinning and breaks when decrypted. What is the best solution to allow this application to function while still decrypting other traffic?

Accepted Answer

Create a decryption exclusion rule for the specific cloud application by source or URL category.. Creating a decryption exclusion rule for the specific cloud application (by source IP, URL category, or destination) allows the firewall to bypass decryption for that traffic while continuing to decrypt all other outbound HTTPS traffic. This resolves the certificate pinning issue without compromising security for other traffic. Decryption exclusion rules are a standard feature in PAN-OS for handling applications that break under decryption.

Answer

Upgrade the firewall to a model that supports certificate key protection.

Answer

Disable SSL decryption entirely.

Answer

Change the decryption policy to decrypt only inbound traffic.

Question 19

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 20

Refer to the exhibit. What is the default gateway of the firewall?

Accepted Answer

10.0.0.1. The default gateway for a firewall is the IP address of the next-hop router that the firewall uses to reach networks not directly connected. In the exhibit, the route with destination 0.0.0.0/0 (the default route) points to next-hop 10.0.0.1, making 10.0.0.1 the default gateway. This is the standard behavior in PAN-OS: the default gateway is defined by the static default route, not by an interface IP.

Answer

ethernet1/1

Answer

10.0.0.0

Answer

0.0.0.0