PCNSA Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit. What is the PAN-OS version running on the firewall?

Accepted Answer

10.2.0. The PAN-OS version is determined by the first two digits of the version string displayed in the CLI output (e.g., '10.2.0'). In the exhibit, the firewall shows '10.2.0', which corresponds to PAN-OS 10.2.0. This is the correct version because the CLI command 'show system info' or the GUI dashboard displays the exact software version installed.

Answer

10.1.0

Answer

9.1.0

Answer

10.0.0

Question 2

Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?

Accepted Answer

The dynamic group requires a commit after adding the object. In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.

Answer

The tag is misspelled

Answer

The address object is not tagged

Answer

The group match type is 'all' not 'any'

Question 3

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Accepted Answer

Create a service group with two service objects (one for 1000, one for 2000). A service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.

Answer

Create a service object with port range 1000-2000

Answer

Create a service object with port 1000 and use an application override

Answer

Create a single service object with port 1000 and a separate rule for port 2000

Question 4

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Accepted Answer

Address. To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Answer

Schedule

Answer

Service

Answer

Tag

Question 5

An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?

Accepted Answer

Both destination port and protocol. In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.

Answer

Destination port

Answer

Source port

Answer

Protocol

Question 6

Match each security rule type to its purpose.

Accepted Answer

Security rule: Controls traffic based on source, destination, application, and service.. Correct matches: Security rule controls traffic based on source/destination/app/service; NAT rule translates IP addresses/ports; Decryption rule decrypts SSL/TLS traffic. Common confusions: QoS rules are for marking and prioritizing traffic, not access control; Application Override rules bypass App-ID, not decrypt traffic.

Answer

QoS rule: Controls traffic based on source, destination, and application.

Answer

Application Override rule: Decrypts traffic for inspection.

Question 7

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Define zones, then address objects, then application/service, then action, then commit. Security policies are configured by first defining zones, then addresses, then application/service, then action, and finally committing.

Answer

Define address objects, then zones, then application/service, then action, then commit

Answer

Define zones, then address objects, then action, then application/service, then commit

Answer

Commit, then define zones, then address objects, then application/service, then action

Question 8

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

Accepted Answer

Tags are case-sensitive. Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Answer

The address objects are not in the same zone

Answer

The group needs a commit after tagging

Answer

Tags are not case-sensitive

Question 9

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

FQDN. FQDN (Fully Qualified Domain Name) is a valid address object type in Palo Alto Networks that allows you to define a security policy rule based on a domain name rather than an IP address. The firewall dynamically resolves the FQDN to IP addresses at runtime, which is useful for destinations like cloud services or websites with changing IPs.

Answer

MAC Address

Answer

Subnet Object

Question 10

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

Accepted Answer

The EDL cache time is set higher than the refresh interval. The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Answer

The EDL URL is invalid

Answer

The EDL is not registered as a dynamic list

Answer

The firewall's DNS resolution fails

Question 11

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

Accepted Answer

NAT rules are evaluated from top to bottom, and the first match is applied. Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Answer

NAT rules are evaluated after security rules

Answer

NAT rules use longest prefix match on the destination address

Answer

NAT rules cannot combine source and destination NAT in a single rule

Question 12

Refer to the exhibit. An administrator notes that traffic to Facebook is being denied. What is the most likely reason?

Accepted Answer

Facebook is not in the allowed applications list.. The exhibit shows a security policy rule with an 'allowed applications' list that does not include Facebook. Since App-ID identifies Facebook traffic by its application signature, any traffic matching this rule will be denied unless Facebook is explicitly allowed. Option D is correct because the absence of Facebook in the allowed applications list causes the firewall to block the traffic.

Answer

SSL decryption is not configured.

Answer

The profile group is blocking Facebook.

Answer

The rule order is incorrect.

Question 13

Which Palo Alto Networks subscription service provides real-time threat intelligence about unknown files and links?

Accepted Answer

WildFire. WildFire is the correct answer because it is Palo Alto Networks' cloud-based threat analysis service specifically designed to detect and block unknown malware, zero-day exploits, and advanced persistent threats. It analyzes files and links in a sandboxed environment, correlating behavioral indicators with real-time threat intelligence to generate signatures that protect the entire network.

Answer

URL Filtering

Answer

DNS Security

Answer

Threat Prevention

Question 14

Which TWO of the following are valid dataplane components in a Palo Alto Networks firewall?

Accepted Answer

Session table. The session table is a core dataplane component because it stores the state of active sessions, enabling the firewall to perform stateful inspection and apply security policies at wire speed. The flow accelerator (FPGA) is a hardware-based dataplane component that offloads packet processing from the CPU, accelerating throughput for established sessions.

Answer

Management Plane

Answer

Routing table

Answer

Panorama

Question 15

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

Accepted Answer

PA-220. The PA-220 is the most appropriate platform for a branch office with 50 users because it is a low-end, entry-level next-generation firewall designed for small to medium-sized businesses and remote/branch offices. It supports up to 100 Mbps of threat prevention throughput and includes all core NGFW features (App-ID, User-ID, SSL decryption) at a cost-effective price point, making it ideal for this user count.

Answer

PA-3250

Answer

VM-Series

Answer

PA-5280

Question 16

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Accepted Answer

Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings. FTP uses separate control (TCP 21) and data channels, and the firewall must inspect both to enforce security policies. Enabling 'FTP Alg' in the Application Override settings allows the Palo Alto Networks firewall to dynamically open pinholes for the data channel and perform deep inspection of FTP commands, ensuring proper stateful handling of active and passive modes.

Answer

Create a rule with service 'tcp-21' and application 'any'

Answer

Create a rule with application 'ftp' and disable Application Override

Answer

Create a rule with application 'ftp' and service 'application-default'

Question 17

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. The best way to share security policies across firewalls with different interface configurations is to use a single device group containing both firewalls. Device groups are designed to manage security policies centrally, while templates handle device-specific settings like interface configurations. Option B is correct because it allows policy consistency without duplicating effort. Option A (separate device groups) would require manual duplication. Option C (templates) is incorrect because templates are for device-level configuration, not security policies. Option D (Shared policy with overrides) is not a standard or efficient approach for this scenario.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.

Question 18

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Accepted Answer

Change the 'ssl-protocol-settings' max-version to 'tls1-3'.. The decryption profile specifies max-version as tls1-2, which prevents decryption of TLS 1.3 traffic. Updating the max-version to tls1-3 allows decryption of TLS 1.3 sessions.

Answer

Change the min-version to 'tls1-3'.

Answer

Add a new rule for TLS 1.3 traffic.

Answer

Enable 'decrypt-unknown-protocol' to capture all traffic.

Question 19

An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?

Accepted Answer

The traffic was decrypted because it matched a decryption policy.. The traffic log entries indicate that the session to 192.168.1.1 was decrypted, as shown by the decryption flag or action field (e.g., 'decrypt'). This occurs when the traffic matches a decryption policy configured on the firewall, typically for SSL/TLS inspection. The destination being internal (192.168.1.1) and the application being SSL are not sufficient conditions for decryption; a matching decryption rule is required.

Answer

The traffic was decrypted because the application is SSL.

Answer

The traffic was not decrypted because it matched a no-decrypt policy.

Answer

The traffic was not decrypted because the destination is external.

Question 20

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Accepted Answer

Create a security policy rule that allows traffic from the internal zone to the external zone. In a virtual wire deployment (which operates at Layer 2), traffic inspection is still governed by security policy rules. A rule allowing traffic from the internal zone to the external zone ensures that all outbound traffic is evaluated and inspected by the firewall. Security policies are the primary mechanism for controlling and logging traffic, regardless of the deployment mode.

Answer

Define a NAT policy to translate internal IPs to the external interface

Answer

Enable SSL decryption on the firewall

Answer

Configure a virtual wire between the internal and external interfaces