PCNSA Practice Test 5 — 25 Questions

Question 1

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.. In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Answer

The traffic is using TLS 1.3 which is not supported by the firewall.

Answer

The firewall's encryption algorithm settings do not match the server's cipher suite.

Answer

The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

Question 2

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

Accepted Answer

The Default-No-Decrypt rule is above Decrypt-Web and matches all traffic. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If the 'Default-No-Decrypt' rule is placed above the 'Decrypt-Web' rule and matches all traffic (e.g., source/destination 'any'), then all traffic, including traffic to the web server, will match this rule first and will not be decrypted, preventing the 'Decrypt-Web' rule from ever being evaluated.

Answer

The 'strict' profile is misconfigured

Answer

The Decrypt-Web rule has a profile that blocks decryption

Answer

The source is set to 'any' in the Decrypt-Web rule

Question 3

A company needs to receive email alerts for critical system events. What is the recommended method to configure email notifications on a Palo Alto Networks firewall?

Accepted Answer

Create an Email server profile under Device > Server Profiles with SMTP settings. Palo Alto Networks firewalls provide a native Email Server Profile under Device > Server Profiles that allows direct SMTP configuration for sending email alerts. This is the recommended method as it integrates directly with the firewall's alerting system without requiring external tools or services.

Answer

Configure an SNMP trap receiver to forward events to email

Answer

Enable ICMP echo replies to trigger email via a separate scripting tool

Answer

Set up a syslog server that sends email alerts

Question 4

Refer to the exhibit. What is the effect of this configuration?

Accepted Answer

The firewall responds to pings on the management interface.. The configuration shown is a management profile applied to an interface. The 'ping' service is enabled under the management profile, which allows the firewall to respond to ICMP echo requests (pings) on that specific interface. This does not permit transit ping traffic through the firewall, nor does it enable SSH or allow the firewall to initiate pings. Therefore, option C is correct.

Answer

The firewall allows ping traffic through all interfaces.

Answer

The management profile allows SSH access.

Answer

The firewall cannot ping others.

Question 5

A company wants to ensure that decryption policies are applied based on the user identity. The firewall is integrated with Active Directory. Which decryption policy matching criteria should be used?

Accepted Answer

Source user. Source user is correct because decryption policies based on user identity require matching the user information obtained from Active Directory integration. The firewall uses User-ID to map IP addresses to usernames, and the decryption policy can then enforce rules based on the source user.

Answer

URL category

Answer

Source zone

Answer

Source IP address

Question 6

Which three components are part of the Palo Alto Networks Next-Generation Firewall architecture? (Choose three.)

Accepted Answer

Application ID engine. Option A (Application ID engine) is correct because Palo Alto NGFWs use the App-ID engine to identify applications regardless of port, protocol, encryption, or evasive technique, which is a core architectural component of the platform. Option B (Single-pass software architecture) is correct because PAN-OS performs App-ID, User-ID, and Content-ID in a single pass through the firewall, avoiding the multiple processing passes used by older port-based firewalls. Option E (Decoupled control and data plane) is correct because Palo Alto's architecture separates the control plane (management, routing, logging) from the data plane (packet processing), which improves performance, scalability, and resilience. Option C (Policy optimizer) is not a recognized PAN-OS architectural component, and Option D (GlobalProtect VPN) is a licensed feature/service for remote access and endpoint security, not one of the three defining architectural components asked for here.

Answer

Policy optimizer

Answer

GlobalProtect VPN

Question 7

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Accepted Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.. It uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Answer

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Question 8

A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?

Accepted Answer

The traffic will be allowed because Rule1 matches before Rule2.. Palo Alto Networks firewalls use first-match policy evaluation: the first rule that matches the traffic's source zone, destination zone, source/destination IP, application, and user determines the action. Since Rule1 (allow) appears before Rule2 (deny), traffic from Engineering to Servers matches Rule1 first and is allowed, regardless of later deny rules.

Answer

To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.

Answer

Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.

Answer

The firewall evaluates all rules and applies the most restrictive action (deny).

Question 9

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

Accepted Answer

URL Filtering profile to block the Social Networking category.. A URL Filtering profile allows the administrator to block access to specific categories of websites, such as Social Networking. By applying this profile to a security policy rule that governs internet access, the firewall can identify and block HTTP/HTTPS traffic to social media sites based on their URL category, without needing to decrypt or inspect the content.

Answer

SSL Decryption policy to decrypt traffic to social media.

Answer

QoS policy to limit bandwidth to social media sites.

Answer

File blocking profile to block executable files from social media.

Question 10

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. In a Palo Alto Networks decryption policy, the three valid rule actions are No Decrypt, Forward Untrust Certificate, and Decrypt. Option A (No Decrypt) is correct because it allows specified traffic to bypass decryption entirely, which is used for traffic that cannot or should not be decrypted, such as pinned or sensitive sessions. Option B (Forward Untrust Certificate) is correct because it is a specific decryption action that presents the firewall's untrust certificate to clients when the destination server certificate is not trusted, enabling continued inspection. Option E (Decrypt) is correct because it is the primary action that instructs the firewall to decrypt and inspect matching SSL/TLS traffic. Options C (Block) and D (Forward) are not valid decryption policy actions; Block is a security policy action, and Forward is not a decryption rule action in this context.

Answer

Block

Answer

Forward

Question 11

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Accepted Answer

The log forwarding profile is not configured to forward logs for denied sessions.. In PAN-OS, log forwarding profiles have a separate checkbox for 'Denied Sessions' under the Traffic log type. Even if the profile includes the 'traffic' log type, denied traffic logs will not be forwarded unless this option is explicitly enabled. Since the SIEM receives allowed traffic logs but not denied ones, the most likely cause is that the profile is not configured to forward logs for denied sessions.

Answer

The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Answer

The firewall is logging only at session end and the deny sessions are not completing.

Answer

The SIEM is not configured to receive syslog messages for deny actions.

Question 12

Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?

Accepted Answer

The firewall's system time is ahead of the certificate's validity start. When the firewall's system time is ahead of the certificate's validity start (the 'not before' date), the firewall considers the certificate as not yet valid. During SSL/TLS decryption, the firewall validates the server certificate's time constraints against its own system clock. If the firewall's clock is ahead, the certificate appears to be from the future, causing a decryption failure even though the server and client clocks may be correct.

Answer

The server's certificate is expired

Answer

The decryption profile rejects self-signed certificates

Answer

The client's system time is behind

Question 13

Which THREE of the following are valid features of Palo Alto Networks active/passive HA?

Accepted Answer

Session synchronization from active to passive.. In Palo Alto Networks active/passive HA, session synchronization from the active firewall to the passive firewall is a core valid feature, so option A is correct because it keeps the passive device ready to take over established sessions. Option C is correct because active/passive HA provides stateful failover of sessions, meaning the passive device can continue existing flows after failover using synchronized session state. Option D is correct because configuration changes made on the active device are automatically synchronized to the passive device, keeping both peers consistent. Option B is not a valid feature because link monitoring is not prevented on the passive device; HA link and path monitoring behavior is part of the HA configuration and does not simply disable monitoring on the passive peer. Option E is not valid for active/passive HA because load sharing of traffic between both devices describes active/active HA, not active/passive.

Answer

Prevention of link monitoring on passive device.

Answer

Load sharing of traffic between both devices.

Question 14

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

Accepted Answer

Create an allow rule for internal source addresses, then a deny rule for any source.. The correct structure is to create an allow rule for internal source addresses first, then a deny rule for any source. Firewalls evaluate rules top-down and stop at the first match, so placing the specific allow rule before the broad deny ensures internal users are permitted while all other traffic, including external IPs, is denied by the subsequent catch-all deny. This implements a whitelist model with an explicit deny-all fallback, which is the recommended security posture.

Answer

Create a deny rule for external IP addresses, then an allow rule for internal.

Answer

Place the allow rule after the deny rule.

Answer

Create a single rule with a 'Deny' action and apply a user-ID condition.

Question 15

Which of the following is a prerequisite for App-ID to identify applications in encrypted traffic?

Accepted Answer

Enable SSL decryption.. App-ID identifies applications by analyzing traffic patterns, including those in encrypted flows. However, to inspect the content of encrypted traffic (e.g., HTTPS), the firewall must first decrypt it using SSL decryption. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is insufficient for accurate identification of many modern applications that use encryption.

Answer

Configure a custom application signature.

Answer

Ensure the security rule allows the application.

Answer

Enable App-ID on the security rule.

Question 16

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Accepted Answer

The profiles are set to 'alert' instead of 'block' for the critical threat categories.. If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight. Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Answer

The antivirus signatures are outdated.

Answer

The security profiles are not attached to any security rule.

Answer

The profile groups are applied in the wrong order.

Question 17

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 18

A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?

Accepted Answer

The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.. Zone protection profiles with Flood Protection enabled apply rate-based thresholds (SYN, UDP, ICMP, etc.) at the ingress of a zone. If thresholds are set too low, legitimate traffic that exceeds those rates is dropped before security policy evaluation, which explains why an allow-all outbound policy still results in denied traffic. This is the most likely cause given the scenario.

Answer

The security policy is set to deny due to an implicit deny rule.

Answer

The security policy has a logging profile attached that is blocking traffic.

Answer

The security policy has a schedule configured that is currently outside the allowed time.

Question 19

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

Accepted Answer

Verify the SNMP community string and allowed management IPs in the SNMP server profile. The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Answer

Check that the SNMP manager supports SNMPv3

Answer

Verify that the firewall's management IP is reachable from the SNMP manager

Answer

Ensure the SNMP manager is running on the same subnet as the firewall

Question 20

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. The internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.