PCNSA Practice Test 5 — 25 Questions

Question 1

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 2

A network administrator is configuring a Palo Alto Networks firewall in a datacenter. Which TWO traffic types can be inspected by the firewall's Threat Prevention subscription? (Choose two.)

Accepted Answer

Web traffic (HTTP/HTTPS). The Threat Prevention subscription on Palo Alto Networks firewalls is designed to inspect web traffic (HTTP/HTTPS) using signatures for exploits, malware, command-and-control, and phishing, and email traffic (SMTP, POP3, IMAP) for malicious attachments, links, and spam. It does not include inspection for FTP, VoIP (SIP, H.323), or database protocols (SQL, Oracle) by default; those traffic types require other security profiles such as Application Security, Data Filtering, or specific decryption policies. Therefore, the correct answers are B and D.

Answer

FTP traffic (File Transfer Protocol)

Answer

VoIP traffic (SIP, H.323)

Answer

Database traffic (SQL, Oracle)

Question 3

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Accepted Answer

Use a dedicated physical interface or VLAN for HA heartbeat communication. The best practice is to use a dedicated physical interface or VLAN for HA heartbeat communication (Option B). This isolates heartbeat traffic from data traffic, ensuring reliable and fast detection of peer failure. Options A, C, and D are incorrect: A) Setting both firewalls' HA election delay to 0 is not recommended because it can cause flapping if both firewalls have equal priority; a small delay helps prevent unnecessary failovers. C) Enabling preemptive mode is generally not recommended as it can cause unnecessary failovers when the primary comes back online. D) Active/active mode is available on some models but is more complex to configure and not typically recommended for most HA deployments; active/passive is simpler and more reliable.

Answer

Set both firewall's HA election delay to '0' for fast failover

Answer

Enable preemptive mode to ensure the primary firewall always resumes control

Answer

Configure both firewalls in active/active mode to maximize throughput

Question 4

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. Option A is correct because the firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 5

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Accepted Answer

The internal interface (ethernet1/2) is administratively down. Option D is correct because the exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 6

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 7

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 8

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Accepted Answer

Check the Traffic log with the session's source IP and destination. Option D is correct because the Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Answer

Check the System log for related entries

Answer

Run a packet capture on the ingress interface

Answer

Check the global counters for dropped packets

Question 9

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications traversing the network regardless of port. The correct matches are: App-ID identifies applications, User-ID maps users, Content-ID inspects content, WildFire analyzes unknown threats. Common confusions involve swapping the definitions of App-ID and User-ID.

Answer

App-ID: Maps users to IP addresses for policy enforcement

Answer

User-ID: Identifies applications traversing the network regardless of port

Question 10

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Define zones, then address objects, then application/service, then action, then commit. Security policies are configured by first defining zones, then addresses, then application/service, then action, and finally committing.

Answer

Define address objects, then zones, then application/service, then action, then commit

Answer

Define zones, then address objects, then action, then application/service, then commit

Answer

Commit, then define zones, then address objects, then application/service, then action

Question 11

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure IKE gateway, then IPsec crypto profile, then tunnel interface, then static route to tunnel interface, then security policy allowing VPN traffic.. IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.

Answer

Configure IPsec crypto profile, then IKE gateway, then tunnel interface, then static route, then security policy.

Answer

Configure IKE gateway, then IPsec crypto profile, then static route, then tunnel interface, then security policy.

Answer

Configure security policy, then IKE gateway, then IPsec crypto profile, then tunnel interface, then static route.

Question 12

Match each Palo Alto Networks service to its typical use.

Accepted Answer

Panorama: Centralized management and reporting for multiple firewalls. Panorama is used for centralized management and reporting of multiple firewalls. WildFire provides cloud-based malware analysis and prevention. Common confusions include swapping these services or confusing them with AutoFocus.

Answer

Panorama: Cloud-based threat intelligence

Answer

WildFire: Centralized management for firewalls

Question 13

Drag and drop the steps to configure a NAT policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Navigate to Policies > NAT, add rule > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Configure Translated Packet (Translated Source, Translated Destination) > Commit. NAT policy configuration requires specifying original and translated addresses, service, and committing.

Answer

Navigate to Policies > NAT, add rule > Configure Translated Packet (Translated Source, Translated Destination) > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Commit

Answer

Configure Original Packet > Navigate to Policies > NAT, add rule > Configure Translated Packet > Commit

Answer

Navigate to Policies > NAT, add rule > Configure Original Packet > Commit > Configure Translated Packet

Question 14

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Accepted Answer

Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.. Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Answer

Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.

Answer

Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.

Answer

Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.

Question 15

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 16

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Backup configuration, then access CLI, then issue factory-reset command, then confirm, then reboot.. Factory reset requires backup, CLI access, reset command, confirmation, and reboot.

Answer

Access CLI, then issue factory-reset command, then confirm, then reboot, then backup configuration.

Answer

Backup configuration, then access CLI, then confirm, then issue factory-reset command, then reboot.

Answer

Reboot, then access CLI, then backup configuration, then issue factory-reset command, then confirm.

Question 17

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure HA interfaces (control link and data link), then Set HA mode to Active-Passive, then Configure device priority (lower value = higher priority), then Configure peer IP address, then Enable preemption and session synchronization.. HA configuration requires setting up interfaces, mode, priority, peer IP, preemption, and synchronization.

Answer

Configure device priority, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Enable preemption and session synchronization.

Answer

Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Configure device priority, then Enable preemption and session synchronization.

Answer

Enable preemption and session synchronization, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure device priority, then Configure peer IP address.

Question 18

Match each security zone type to its characteristic.

Accepted Answer

Trust: Network zone for internal trusted users and resources.. In Palo Alto firewalls, typical security zones include Trust (internal), Untrust (external), DMZ (public services), and Management (firewall admin). Common confusions arise from swapping Trust and Untrust or misattributing DMZ characteristics.

Answer

Trust: Zone for publicly accessible servers.

Answer

Untrust: Zone for internal trusted networks.

Question 19

Match each security rule type to its purpose.

Accepted Answer

Security rule: Controls traffic based on source, destination, application, and service.. Correct matches: Security rule controls traffic based on source/destination/app/service; NAT rule translates IP addresses/ports; Decryption rule decrypts SSL/TLS traffic. Common confusions: QoS rules are for marking and prioritizing traffic, not access control; Application Override rules bypass App-ID, not decrypt traffic.

Answer

QoS rule: Controls traffic based on source, destination, and application.

Answer

Application Override rule: Decrypts traffic for inspection.

Question 20

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access