PCNSA Practice Test 27 — 15 Questions

Question 1

A network engineer needs to apply the same security policy to multiple firewalls. Which tool should be used to centralize policy management?

Accepted Answer

Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, enabling administrators to define, push, and enforce consistent security policies across multiple firewalls from a single interface. It aggregates logs and provides visibility into all managed firewalls, eliminating the need to configure each device individually.

Answer

PanOS Central

Answer

Web interface of each firewall

Answer

Command Line Interface (CLI)

Question 2

A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.

Answer

Custom URL Category

Answer

Address Group

Answer

Application Filter

Question 3

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 4

During a security audit, it is discovered that some traffic from the 'guest' zone to the 'untrust' zone is not being inspected by Threat Prevention profiles. The security rule that matches this traffic has a Threat Prevention profile applied. What is a likely reason for the lack of inspection?

Accepted Answer

An earlier rule with action 'allow' is matching the traffic before reaching this rule. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. The first matching rule is applied to the traffic. Even if a later rule has a Threat Prevention profile applied, if an earlier rule with action 'allow' matches and does not have a Threat Prevention profile (or has a different profile), the later rule's profile will not be applied. Thus, traffic may bypass inspection. Option A is incorrect because a disabled profile would cause lack of inspection, but the profile is applied on the rule. Option C is incorrect because Threat Prevention profiles inspect all supported services; unsupported services would be bypassed, but that is not the likely reason here. Option D is incorrect because a 'deny' action would block the traffic, not allow it without inspection.

Answer

The Threat Prevention profile is disabled on the rule

Answer

The traffic uses a service that is not supported by the Threat Prevention profile

Answer

The security rule action is set to 'deny'

Question 5

Refer to the exhibit. A security engineer observes that SSL decryption is not working for session 1. The policy and session table are shown. What is the most likely reason?

Accepted Answer

The decryption policy requires a certificate that is not installed on the firewall.. The session table shows an SSL session from 10.0.0.1 to 192.168.1.100:443, which matches POL-1 (forward-proxy). However, the decryption statistics show 0 sessions decrypted. The most likely cause is that the decryption policy requires a certificate to be imported and configured, and the firewall cannot perform decryption without a valid certificate. Other options (like policy order or application mismatch) are not supported by the exhibit.

Answer

The security policy is configured to allow SSL, but the decryption policy is not configured to decrypt SSL traffic.

Answer

The destination IP 192.168.1.100 is not in the decryption policy's destination list.

Answer

The firewall is not receiving the SSL handshake because the session is already established.

Question 6

An administrator notices that traffic from a specific IP 10.10.10.5 is not matching the expected security rule that should allow HTTP traffic. The rule uses a source address object defined as '10.10.10.0/24'. Upon investigation, the administrator finds that the traffic is from IP 10.10.10.5, but the rule still does not match. What is the most likely cause?

Accepted Answer

The source address object is defined with a netmask of /32 instead of /24.. The address object uses a /24 netmask, so it should include .5. However, the object might have been defined with a wrong netmask or the rule is not using the object correctly. In this scenario, the issue is that the address object was accidentally set to /32, which matches only .0.

Answer

The traffic is being decrypted by a decryption policy before reaching the security rule.

Answer

The rule's source zone is set to 'DMZ' instead of 'Internal'.

Answer

A rule above this rule shadows it, blocking the traffic before evaluation.

Question 7

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Accepted Answer

KVM. KVM (Kernel-based Virtual Machine) is a supported hypervisor for Palo Alto Networks firewalls, allowing deployment as a virtual machine (VM) on Linux-based virtualization platforms. Palo Alto Networks provides specific VM images (e.g., KVM-compatible QCOW2 format) for KVM environments, making it a valid method for virtualized deployments.

Answer

Microsoft Hyper-V

Answer

Docker

Answer

Oracle VirtualBox

Question 8

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

Accepted Answer

Use a dedicated management interface and restrict access to trusted IP addresses.. Using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.

Answer

Enable the default admin account with a strong password.

Answer

Allow HTTP access to the management interface for ease of use.

Answer

Enable SNMP with read-write community strings for monitoring.

Question 9

Refer to the exhibit. A network engineer observes a high number of SSL handshake failures. Which action is most likely to reduce these failures?

Accepted Answer

Ensure the forward trust certificate is trusted by internal clients.. The majority of failures are SSL handshake failures (2000 out of 3000). A common reason is that the forward trust certificate is not trusted by clients, causing the client to reject the connection during the handshake.

Answer

Disable decryption for traffic using unsupported ciphers.

Answer

Reissue the forward untrust certificate with a stronger key size.

Answer

Increase the certificate cache size to accommodate more certificates.

Question 10

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 11

Which THREE of the following are requirements for configuring High Availability (HA) on Palo Alto Networks firewalls?

Accepted Answer

Firewalls in an HA pair must be on the same network segment for failover. For HA failover to function properly, both firewalls must reside on the same Layer 2 network segment. This ensures that when the active firewall fails, the passive firewall can assume the same IP addresses and MAC addresses without requiring ARP updates or routing changes, enabling seamless traffic failover.

Answer

Both firewalls must be from different hardware families

Answer

The firewalls must be connected via a dedicated HA link using the management port

Question 12

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Accepted Answer

The application ssl is not matching because HTTPS traffic may be classified as web-browsing.. HTTPS traffic is typically classified as application 'web-browsing', not 'ssl'. The rule specifies application 'ssl', so the traffic does not match because the application mismatch occurs before the service check. Option B is incorrect because the action 'allow' is valid; security profiles are optional and do not affect rule matching. Option C is misleading: although service 'https' uses TCP 443, the application 'ssl' is for VPN/encryption, not HTTPS; the issue is the application mismatch, not the service. Option D is incorrect because the destination address '10.10.10.0/24' includes the host 10.10.10.5.

Answer

The action should be 'allow with security profile'.

Answer

The service https requires TCP 443, but ssl application is used for encryption.

Answer

The destination address is a specific subnet but the user is accessing a host within that subnet.

Question 13

A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?

Accepted Answer

Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.. The application mismatch error indicates that the firewall's App-ID is not correctly identifying the CRM traffic as 'crm-base'. This could be because the application signatures are outdated, or the CRM application uses protocols or patterns not fully captured by the current App-ID. The correct course of action is to update the application and threat signatures to the latest version. If the issue persists, the administrator should expand the security policy to include a fallback application (like 'ssl' or 'web-browsing') or create a custom App-ID to correctly identify the traffic. Option B is incorrect because SSL decryption would help inspect encrypted traffic but is not the direct cause of application mismatch; the issue is identification, not decryption. Option C is incorrect because using 'web-browsing' would be too broad and weaken security. Option D is incorrect because the destination address is correctly set; the issue is with application identification on the firewall.

Answer

Enable SSL decryption to inspect the traffic and improve application identification.

Answer

Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.

Answer

Check that the destination address object for the CRM server is correct and includes the CDN IPs.

Question 14

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy is correct because it allows the firewall to decrypt outbound SSL/TLS traffic from internal clients to external servers, enabling inspection of encrypted content for threats and data filtering. This is a core decryption feature in Palo Alto Networks firewalls, distinct from inbound inspection.

Answer

SSH Proxy

Answer

TLS 1.3 Decryption

Answer

SSL Reverse Proxy

Question 15

Which three of the following services are commonly permitted on the management interface? (Choose three.)

Accepted Answer

Ping. Ping (ICMP Echo) is commonly permitted on the management interface because it allows network administrators to verify the interface's reachability and responsiveness without exposing management services to unnecessary risk. While ICMP is not a management protocol per se, it is a fundamental troubleshooting tool that is typically allowed on the management plane to test connectivity to the management IP address.

Answer

HTTP

Answer

Telnet