PCNSA Practice Test 26 — 15 Questions

Question 1

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 2

An administrator configured SNMP community and trap destination under Device > Setup > Services, but no traps are received. What additional configuration is needed?

Accepted Answer

Add a management profile that allows SNMP. Even after configuring SNMP communities and trap destinations under Device > Setup > Services, the firewall still requires a management profile that explicitly permits SNMP (and optionally traps) on the interface through which the traps will be sent. Without this profile applied to the interface, the firewall will not allow SNMP traffic to egress, and traps will be silently dropped.

Answer

Set the source interface

Answer

Configure SNMP version

Answer

Create a security policy

Answer

Enable SNMP on the interface

Question 3

A small business needs a firewall that supports at least 500 Mbps firewall throughput and includes integrated SD-WAN capabilities. Which TWO Palo Alto Networks platforms meet these requirements? (Choose two.)

Accepted Answer

PA-400 series. The PA-400 series supports up to 4 Gbps firewall throughput and includes integrated SD-WAN capabilities, while the PA-800 series supports up to 2 Gbps firewall throughput with integrated SD-WAN. Both meet the small business requirement of at least 500 Mbps firewall throughput and integrated SD-WAN.

Answer

PA-5250

Answer

PA-7080

Answer

PA-220

Question 4

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Accepted Answer

Inbound Inspection Decryption. Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Answer

Decryption Mirror

Answer

Outbound (Forward Proxy) Decryption

Answer

SSH Proxy

Question 5

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080

Question 6

Which TWO methods can be used to help prevent rule shadowing? (Select two.)

Accepted Answer

Placing more specific rules above general rules. Placing more specific rules above general rules prevents rule shadowing by ensuring that traffic matching a specific condition is evaluated and permitted or denied by the intended rule before reaching a broader rule that might otherwise match it. In Palo Alto Networks firewalls, rule evaluation is first-match, so a general rule placed above a specific rule will shadow the specific rule, making it unreachable. This ordering principle directly addresses the root cause of shadowing.

Answer

Using rule hit counts

Answer

Using dynamic address groups

Answer

Using rule order analysis tools

Question 7

Refer to the exhibit. A network administrator notices that SSL decryption performance has degraded. Based on the exhibit, which factor is most likely contributing to the performance issue?

Accepted Answer

The decryption policy matches (12000) are high relative to the number of SSL/TLS proxy sessions (5000), indicating many sessions are being decrypted but then possibly dropped or not fully processed.. The exhibit shows 12000 decryption policy matches but only 5000 SSL/TLS proxy sessions, indicating that many sessions matched the decryption policy but were not fully decrypted (e.g., due to unsupported ciphers or certificate issues), leading to wasted processing and degraded performance.

Answer

The firewall has been running for too long without a reboot.

Answer

The session utilization is at 95%, nearing the capacity limit, but decryption sessions are only a small fraction.

Answer

The data plane CPU and memory are both high, indicating resource exhaustion.

Question 8

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Dynamic Updates > Software. The PAN-OS software upgrade can be initiated via the GUI under Device > Dynamic Updates > Software, where administrators can download and install new PAN-OS versions. This is a standard method for upgrading the firewall's operating system through the web interface.

Answer

Using the GUI under Device > Dynamic Updates > Content Updates

Answer

Downloading the image via SCP and using 'load software'

Answer

Using Panorama's 'Software' tab to push an upgrade to the firewall

Question 9

A junior administrator is investigating a network issue where traffic to a critical server is being blocked. To see the specific security rule that matched and the action taken, which log should the administrator review?

Accepted Answer

Traffic log. The Traffic log records every session that traverses the firewall, including the specific security rule that matched and the action taken (allow, deny, drop, etc.). Since the administrator needs to identify which rule blocked the traffic to the critical server, the Traffic log is the correct source. System, Threat, and Config logs do not provide per-session rule matching details.

Answer

System log

Answer

Threat log

Answer

Config log

Question 10

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

Accepted Answer

Session synchronization. Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Answer

Stateful failover

Answer

Packet buffer

Answer

Session Timer adjustment

Question 11

An administrator wants to block all peer-to-peer file sharing traffic, but must ensure that legitimate business applications like FTP are not affected. Which approach is most effective?

Accepted Answer

Create an Application Filter that matches all P2P applications and use it in a deny rule.. Palo Alto Networks App-ID can identify peer-to-peer (P2P) traffic by application signature, regardless of port. Creating an Application Filter that matches all P2P applications (e.g., BitTorrent, eDonkey, Gnutella) and applying it in a deny rule ensures all P2P traffic is blocked while legitimate business applications like FTP (which uses distinct App-ID signatures) are not affected, as App-ID decodes traffic at Layer 7.

Answer

Create a security rule with 'application none' and block the common P2P ports.

Answer

Use a Service object to block all ports typically used by P2P applications.

Answer

Identify each known P2P application and add them individually to a block rule.

Question 12

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Accepted Answer

Tunnel Inspection logs. Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

Answer

URL Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 13

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Accepted Answer

Create a more specific decryption policy to only decrypt necessary traffic.. The firewall is decrypting unnecessary traffic (social media sites) in addition to critical medical cloud services. By refining the decryption policy to exclude non-essential traffic, the administrator reduces the CPU load from SSL/TLS handshake and encryption processing, directly addressing the spike without requiring hardware changes. This aligns with Palo Alto Networks best practices of minimizing decryption scope to only traffic that requires inspection.

Answer

Increase the decryption session timeout value.

Answer

Replace the firewall with a higher-end model.

Answer

Enable SSL acceleration hardware offloading.

Question 14

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Accepted Answer

Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.. Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Answer

Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.

Answer

Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.

Answer

Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.

Question 15

An administrator is using Policy Tester to validate a rule before deployment. The rule allows HTTP and HTTPS from user 'John' (IP 10.1.1.10) to server 192.168.1.100. The tester shows 'No match' for traffic from John's IP to the server on port 80. What could be the reason?

Accepted Answer

The rule has an application override that is not set to HTTP.. Application override forces a specific application identification for traffic. If the rule uses application override but the override is not set to HTTP for HTTP traffic (port 80), the rule will not match, even though the traffic is HTTP. Option A is incorrect because rule ordering is irrelevant when testing a specific rule with Policy Tester; it evaluates the rule regardless of its position in the rulebase. Option B is incorrect because user-ID mapping correctness does not affect the match for HTTP traffic from the user; the issue is about application identification. Option C is incorrect because while a rule using only port 443 would not match HTTP on port 80, the question states the rule allows both HTTP and HTTPS, so the mismatch is due to application override, not port restriction.

Answer

The rule is placed after a deny rule.

Answer

The user-ID mapping is incorrect.

Answer

The rule uses port 443 only.