PCNSA Practice Test 4 — 25 Questions

Question 1

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 2

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

Accepted Answer

Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.. File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Answer

Ensure the security rule includes the application 'pdf-download' in the Application list.

Answer

Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

Answer

Verify the URL Category of the web application is included in the rule.

Question 3

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 4

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

Accepted Answer

Data Filtering Profile. Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Answer

URL Filtering Profile

Answer

Application Override

Answer

File Blocking Profile

Question 5

Which TWO methods can be used to create a custom App-ID signature?

Accepted Answer

Using a packet buffer override.. A packet buffer override is a method used to create a custom App-ID signature by capturing and analyzing the payload of a specific application's traffic. This allows the firewall to identify the application based on unique byte sequences or patterns in the packet payload, which is essential for applications that use non-standard ports or encryption.

Answer

Using a Data Filtering profile.

Answer

Using a URL Filtering profile.

Answer

Using a custom application signature with a port match.

Question 6

A company wants to block file uploads of PDFs to the internet via HTTP. Which Content-ID profile should be configured?

Accepted Answer

File Blocking Profile. The File Blocking Profile is specifically designed to block file transfers based on file type, such as PDF, over protocols like HTTP. This profile uses Content-ID to inspect the file content and enforce blocking policies for uploads or downloads, making it the appropriate choice to prevent PDF uploads to the internet.

Answer

Vulnerability Protection Profile

Answer

URL Filtering Profile

Answer

Virus Profile

Question 7

A user reports that they are unable to download executable files from the internet. The firewall security rule allows the application. What should the administrator check first?

Accepted Answer

The file blocking profile for the rule.. The user cannot download executable files, which is a specific file type. The file blocking profile is the Content-ID feature that controls file transfer based on type, regardless of the application being allowed. Since the security rule permits the application, the administrator should first check the file blocking profile attached to that rule to see if it blocks 'executable' files.

Answer

The SSL decryption policy.

Answer

The vulnerability protection profile.

Answer

The URL filtering category for 'executables'.

Question 8

An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?

Accepted Answer

Create a custom App-ID that matches the proprietary encryption wrapper signature.. When App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.

Answer

Use Application Override to force the ERP application for all traffic on port 4444.

Answer

Enable SSL decryption to inspect the encrypted traffic.

Answer

Add a security rule that allows the ERP application object without further configuration.

Question 9

Which TWO are required for accurate application identification when an application uses non-standard ports?

Accepted Answer

Enable App-ID.. App-ID is the core technology that identifies applications regardless of port, using signatures, protocol decoders, and behavioral analysis. When an application uses non-standard ports, App-ID must be enabled to inspect traffic beyond simple port-based classification, ensuring accurate identification even if the application is not using its default port.

Answer

Define a custom service for the port.

Answer

Use a Content-ID profile.

Answer

Disable SSL Decryption.

Question 10

Which of the following is a prerequisite for App-ID to identify applications in encrypted traffic?

Accepted Answer

Enable SSL decryption.. App-ID identifies applications by analyzing traffic patterns, including those in encrypted flows. However, to inspect the content of encrypted traffic (e.g., HTTPS), the firewall must first decrypt it using SSL decryption. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is insufficient for accurate identification of many modern applications that use encryption.

Answer

Configure a custom application signature.

Answer

Ensure the security rule allows the application.

Answer

Enable App-ID on the security rule.

Question 11

Refer to the exhibit. What is the status of the commit job?

Accepted Answer

Pending. The commit job status is 'Pending' because the commit operation has been initiated but not yet completed. In Palo Alto Networks firewalls, when a commit is in progress, the job status shows as 'Pending' until the configuration is successfully applied or an error occurs. The exhibit likely shows a commit job with a status of 'Pending', indicating that the system is still processing the configuration changes.

Answer

Completed

Answer

Canceled

Answer

Failed

Question 12

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

Accepted Answer

Path monitoring.. Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Answer

Heartbeat backup.

Answer

Session replication.

Answer

Link monitoring on all interfaces.

Question 13

A security administrator wants to inspect decrypted traffic for threats. What is the minimum set of features required?

Accepted Answer

SSL Decryption and Threat Prevention. To inspect decrypted traffic for threats, you must first decrypt the traffic using SSL Decryption, which terminates the SSL/TLS session and allows the firewall to examine the plaintext payload. Then, Threat Prevention (which includes IPS, antivirus, and anti-spyware signatures) can analyze that decrypted content for malicious patterns. Without SSL Decryption, Threat Prevention only sees encrypted traffic and cannot inspect the payload; without Threat Prevention, SSL Decryption alone provides no threat detection. Therefore, both features are required.

Answer

Threat Prevention only

Answer

SSL Decryption only

Answer

SSL Decryption and URL Filtering

Question 14

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Accepted Answer

App-ID with SSL protocol detection. App-ID with SSL protocol detection allows the firewall to identify HTTPS applications by inspecting the Server Name Indication (SNI) field in the TLS handshake and the certificate common name, without decrypting the traffic. This enables application identification while preserving encryption, meeting the requirement to monitor HTTPS traffic without decryption.

Answer

SSL Decryption Mirror

Answer

SSL Forward Proxy

Answer

URL Filtering

Question 15

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Accepted Answer

Check the traffic log to see if the policy is matched. The first step in troubleshooting a decryption policy that is not decrypting traffic is to check the traffic log to confirm whether the policy is actually being matched. If the traffic does not match the decryption rule, no decryption will occur regardless of certificate validity or other settings. This aligns with the systematic troubleshooting approach of verifying policy application before investigating deeper configuration issues.

Answer

Verify that the decryption certificate is valid

Answer

Disable the SSL/TLS service profile

Answer

Ensure that the server's certificate is imported

Question 16

A firewall is configured with decryption and a custom SSL/TLS service profile that has 'Block Expired Certificates' enabled. After renewing a server certificate, some users are unable to access the site. The server certificate is correctly installed. What could be the issue?

Accepted Answer

The firewall's system clock is not synchronized. When 'Block Expired Certificates' is enabled in a custom SSL/TLS service profile, the firewall checks the validity period of the server certificate against its own system clock. If the firewall's clock is not synchronized (e.g., via NTP) and is set to a time outside the new certificate's validity window, the firewall will incorrectly treat the valid renewed certificate as expired and block the connection. This explains why users cannot access the site despite the server certificate being correctly installed.

Answer

The renewal caused a private key mismatch

Answer

The client's system clock is not synchronized

Answer

The decryption policy still points to the old certificate

Question 17

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 18

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

Accepted Answer

The server is using an unsupported cipher suite.. The output shows a large number of handshake failures, which typically occur during the SSL/TLS handshake when the client and server cannot agree on a common cipher suite. If the server only supports weak or outdated ciphers that the firewall's decryption policy does not allow, or if the firewall's SSL forward proxy engine does not support the server's chosen cipher, the handshake will fail. This is the most likely cause because cipher suite mismatch is a common source of handshake failures in decryption environments.

Answer

The firewall's CRL server is unreachable.

Answer

The decryption policy is not matching the traffic.

Answer

The firewall's certificate is not trusted by clients.

Question 19

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. A Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 20

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings