PCNSA Practice Test 26 — 15 Questions

Question 1

A network security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable only via a specific interface in the 'untrust' zone. The administrator creates a syslog server profile and a log forwarding profile. Which additional configuration is required to ensure that syslog messages are sent from the firewall's interface in the 'untrust' zone?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a service route for syslog that uses the specific source interface.. Syslog is a management-plane service. By default, it sources from the management interface. To send syslog from a dataplane interface, you must configure a service route for syslog that specifies the desired source interface. This ensures the syslog server receives traffic from the correct IP and that return traffic is routed properly. Other options do not control the source interface for syslog.

Answer

Create a policy-based forwarding rule that redirects syslog traffic to the 'untrust' interface.

Answer

Enable 'Use Management Interface for Syslog' under Device > Setup > Services.

Answer

Assign the syslog server profile to the 'untrust' zone under Network > Zones.

Question 2

A firewall administrator needs to ensure that the firewall can resolve domain names for security policy rules that use FQDN objects. The firewall is deployed in a network where DNS servers are reachable only through the dataplane interface ethernet1/2, which is in the untrust zone. The management interface cannot reach any DNS server. Which configuration should the administrator use to allow the firewall to resolve FQDNs?

Accepted Answer

Create a service route for DNS that uses the dataplane interface ethernet1/2, and specify the DNS servers in Device > Setup > Services > DNS.. Service routes allow specific management-plane services (such as DNS, email, SNMP, syslog, etc.) to be sourced from a dataplane interface instead of the management interface. By configuring a service route for DNS that uses ethernet1/2, and specifying the DNS servers, the firewall can send DNS queries out the dataplane interface, which has reachability to the DNS servers. This enables FQDN resolution for security policies even when the management interface cannot reach DNS.

Answer

Configure a DNS proxy object and assign it to the untrust zone, then set the DNS servers in Device > Setup > Services > DNS.

Answer

Configure a static route on the management interface to the DNS servers, and set the DNS servers in Device > Setup > Services > DNS.

Answer

Enable DNS resolution on the untrust zone interface and set the DNS servers in Device > Setup > Services > DNS.

Question 3

An administrator is configuring a Palo Alto Networks firewall to send SNMP traps to a monitoring server at 10.1.1.50. The administrator has already configured the SNMP community string under Device > Setup > Operations > SNMP Setup. Which two additional configurations are required to ensure traps are sent successfully? (Choose two.)

Accepted Answer

Configure an SNMP trap destination under Device > Setup > Operations > SNMP Setup, specifying the server IP 10.1.1.50 and the community string.. To send SNMP traps, the firewall must have a trap destination configured with the server IP and community string. Additionally, a service route for SNMP may be needed if the default management interface cannot reach the server. Security policy rules and management interface permitted IPs do not affect outbound traps, and SNMPv3 is optional. Thus, the trap destination and service route are the required configurations.

Answer

Enable SNMPv3 and configure a user with authentication and encryption, because SNMPv2c traps are not supported.

Answer

Create a security policy rule allowing SNMP traffic from the firewall to the monitoring server on UDP port 162.

Answer

Add the monitoring server's IP address to the management interface's permitted IP list for SNMP.

Question 4

A network security administrator needs to back up the firewall configuration before making changes. The administrator wants to store the backup on an external SCP server at 198.51.100.10 using the account 'backupuser'. Which sequence of steps should the administrator take in the web interface?

Accepted Answer

Device > Setup > Operations > Export named configuration snapshot, then select SCP and enter the server details.. In PAN-OS, configuration backups to external servers are performed via Device > Setup > Operations. The 'Export named configuration snapshot' option allows selection of SCP, FTP, or TFTP as the export protocol, and prompts for server address, username, and path. This is the standard method to store a configuration backup on an external SCP server, ensuring the configuration is preserved before changes are made.

Answer

Device > Configuration > Export, then select SCP and enter the server details.

Answer

Device > Setup > Management > Export configuration, then select SCP and enter the server details.

Answer

Device > Setup > Services > Export configuration, then select SCP and enter the server details.

Question 5

A security administrator has configured a security policy rule to allow SSH from the Trust zone to the Untrust zone. The rule uses the application 'ssh' and the service 'application-default'. Users report that SSH connections to external servers on port 2222 are failing, while SSH on port 22 works. What is the most likely cause of the failure?

Accepted Answer

The service 'application-default' only allows the default port for the application, so port 2222 is blocked.. The service 'application-default' restricts traffic to the default ports of the selected applications. For SSH, the default port is 22, so connections on port 2222 are blocked. To allow SSH on a non-standard port, the administrator must either set the service to 'any' or create a custom service for port 2222 and apply it to the rule. This ensures that the firewall permits the traffic on the desired port while still identifying it as SSH.

Answer

The application 'ssh' does not support non-standard ports; a custom application must be created.

Answer

The application 'ssh' is not included in the rule's application list; instead, 'any' is used.

Answer

The security policy rule is missing a URL filtering profile to allow SSH on port 2222.

Question 6

An administrator has configured a security policy rule to allow traffic from the 'trust' zone to the 'untrust' zone with application 'any' and service 'any'. The administrator wants to ensure that the firewall logs all allowed traffic, but notices that not all sessions are being logged. What is the most likely reason?

Accepted Answer

The security policy rule is not matching all traffic because it is placed after a more specific rule that denies or allows traffic without logging.. The most likely reason for not all allowed sessions being logged is that another rule earlier in the rulebase is matching some traffic and either has logging disabled or is a deny rule. The 'any/any' rule only logs sessions that it processes. If a more specific rule above it handles certain traffic without logging, those sessions will not appear in the logs. Therefore, reviewing rule order and logging settings is necessary to ensure all allowed traffic is logged.

Answer

The security policy rule does not have 'Log at Session End' enabled.

Answer

The firewall is not configured to log at session start, and some sessions are not being logged because they are not completing.

Answer

The firewall's log storage is full, causing new logs to be dropped.

Question 7

A network security engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable only through the untrust zone via the ethernet1/2 interface, which is in the untrust zone and uses the default virtual router. The engineer wants to ensure that syslog traffic egresses via ethernet1/2 and uses the correct source IP address. Which configuration should the engineer perform?

Accepted Answer

Configure a Syslog service route under Device > Setup > Services > Service Route Configuration, selecting the 'custom' option for Syslog and specifying the source interface as ethernet1/2.. Syslog is an outbound management service, and its source interface is controlled by service routes. By default, it uses the management interface. To send syslog via ethernet1/2, a custom service route must be configured for Syslog, specifying ethernet1/2 as the source interface. Security policies, NAT, and static routes do not affect firewall-generated syslog traffic, so they cannot fulfill the requirement.

Answer

Enable 'Use management interface for all services' under Device > Setup > Management and add a policy-based forwarding rule for syslog traffic.

Answer

Configure a static route for the syslog server's IP address pointing to ethernet1/2 and set the source IP in the syslog server profile.

Answer

Create a security policy rule allowing syslog traffic from the trust zone to the untrust zone and apply a NAT rule to translate the source IP to ethernet1/2.

Question 8

An administrator needs to create a dynamic address group that automatically includes all virtual machines in a VMware environment based on their tags. The firewall is integrated with VMware NSX-T. Which two actions must the administrator take to enable this dynamic grouping? (Choose two.)

Accepted Answer

Configure a dynamic address group with a filter that matches the VM tags.. To create a dynamic address group that automatically includes VMs based on VMware NSX-T tags, the administrator must first integrate the firewall with the NSX-T manager by configuring a service manager profile. Then, a dynamic address group must be created with a filter that matches the relevant tags. These two actions enable the firewall to query NSX-T for VM tags and populate the group dynamically. Static groups or subnet filters do not provide the required tag-based automation.

Answer

Create a static address object for each VM and add them to a static address group.

Answer

Configure a dynamic address group with a filter that matches the VM's IP subnet.

Answer

Enable User-ID and map VM tags to user attributes.

Question 9

An administrator is configuring a new PA-3220 firewall and needs to allow DNS queries from the internal network to an external DNS server. The internal network is in the Trust zone, and the external DNS server is reachable via the Untrust zone. Which type of security policy rule should be created to permit this traffic?

Accepted Answer

An interzone rule from Trust to Untrust allowing UDP port 53. DNS queries from the internal network to an external server traverse from the Trust zone to the Untrust zone, which is interzone traffic. A security policy rule that specifies source zone Trust and destination zone Untrust, with the DNS application or UDP port 53, will correctly permit this traffic while enforcing zone-based security.

Answer

A universal rule allowing UDP port 53 regardless of zone

Answer

An intrazone rule from Trust to Trust allowing UDP port 53

Answer

An intrazone rule from Untrust to Untrust allowing UDP port 53

Question 10

A network security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable only via a specific interface in the 'untrust' zone. The administrator creates a syslog server profile and a log forwarding profile. Which additional configuration is required to ensure that syslog messages are sent from the firewall's interface in the 'untrust' zone?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL Forward Proxy and configure a Forward Trust certificate.. SSL Forward Proxy decryption requires a Forward Trust certificate, which the firewall uses to generate certificates for external sites on the fly. This certificate must be trusted by internal clients. The Forward Untrust certificate is used to sign certificates for sites that the firewall does not trust, but it is not the primary certificate for decryption. Inbound Inspection is for internal servers and requires their private keys.

Answer

Enable SSL Inbound Inspection and configure a Forward Untrust certificate.

Answer

Enable SSL Forward Proxy and configure a Forward Untrust certificate.

Answer

Enable SSL Inbound Inspection and configure a Forward Trust certificate.

Question 11

A security administrator wants to prevent users from posting sensitive data, such as social security numbers, to web forms on external websites. The administrator has enabled SSL decryption for outbound traffic. Which Content-ID feature should be configured to detect and block this activity?

Accepted Answer

Data Filtering profile. Data Filtering profiles are specifically designed to detect and control sensitive data patterns, including social security numbers, in web traffic. When SSL decryption is enabled, the firewall can inspect the content of web forms and apply the Data Filtering profile to block or alert on the transmission. This is the correct feature to prevent data leakage through web forms.

Answer

Antivirus profile

Answer

File Blocking profile

Answer

URL Filtering profile

Question 12

A security administrator is configuring a Data Filtering profile to prevent sensitive customer data from leaving the network via webmail. The administrator wants to block any email that contains a U.S. Social Security Number. Which Data Filtering profile setting should be used to detect the SSN pattern?

Accepted Answer

Predefined pattern for Social Security Number. The Data Filtering profile provides predefined patterns for common sensitive data types, including U.S. Social Security Numbers. By selecting the predefined SSN pattern, the administrator can reliably detect and block emails containing SSNs. This leverages built-in regular expressions optimized for accurate detection, avoiding the need for custom patterns that may be error-prone.

Answer

Application override for webmail

Answer

File type matching for .txt files

Answer

Custom pattern using a regular expression

Question 13

An administrator has configured SSL decryption for outbound traffic. Users report that they can access most HTTPS sites, but when they visit their bank's website, they receive a certificate error and the connection is blocked. The administrator wants to allow access to the bank site without decryption. What should be configured?

Accepted Answer

A decryption policy rule with action 'no-decrypt' for the bank's URL category.. To exempt specific traffic from decryption, a decryption policy rule with the action 'no-decrypt' must be created. This rule should match the bank's traffic, often by URL category or FQDN, and be placed above the decrypt rule. This allows the traffic to bypass decryption, preventing certificate errors caused by certificate pinning or other incompatibilities.

Answer

Disable SSL decryption globally and rely on application identification.

Answer

Add the bank's certificate to the firewall's trusted root CA list.

Answer

Create a security policy rule that allows the bank's traffic without any decryption profile.

Question 14

A security administrator is troubleshooting why a custom application is not being identified by App-ID. The application uses a proprietary protocol over TCP and is not recognized. Which two actions can the administrator take to enable App-ID to identify this application? (Choose two.)

Accepted Answer

Create a custom App-ID signature using the Application Objects interface.. To enable App-ID to identify a proprietary application, the administrator can create a custom App-ID signature, which defines patterns for the application, or use Application Override to force traffic to a custom application based on IP and port. Both methods allow the firewall to recognize and control the application. SSL decryption, URL Filtering, and IP/port-based Security rules do not provide application identification for non-web, non-TLS proprietary protocols.

Answer

Enable SSL decryption for the application's traffic.

Answer

Configure a URL Filtering profile to categorize the application's traffic.

Answer

Create a Security policy rule to allow the application's IP address and port.

Question 15

A network security administrator has configured SSL Forward Proxy decryption on a Palo Alto Networks firewall. During routine review, the administrator notices that sessions to banking websites are being decrypted, and users are receiving certificate errors. The administrator wants to stop decrypting these sessions while still decrypting all other HTTPS traffic. Which action should the administrator take?

Accepted Answer

Create a no-decrypt policy rule for the banking sites and place it above the decrypt rule.. Decryption policy rules are evaluated in order, and a no-decrypt rule placed above a decrypt rule will match banking traffic first, preventing decryption. The decrypt rule below continues to decrypt all other HTTPS traffic. This approach is granular, efficient, and maintains security visibility for the majority of traffic while respecting privacy or compliance requirements for financial sites.

Answer

Add the banking sites to the SSL Decryption Exclusion list in the decryption profile.

Answer

Change the decryption rule action from 'decrypt' to 'no-decrypt' for all traffic, then create a new rule to decrypt everything except banking.

Answer

Modify the decryption profile to disable decryption for the banking sites.