PCNSA Practice Test 27 — 15 Questions

Question 1

An administrator is configuring a security policy rule and needs to reference a service that uses both TCP port 80 and TCP port 443. The administrator wants to minimize the number of objects in the policy. What should the administrator create to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A service group containing service-http and service-https.. A service group is designed to bundle multiple service objects for use in security policies. By creating a service group that contains service-http and service-https, the administrator can reference both ports with a single object. This minimizes the number of objects and simplifies policy management. Custom service objects cannot contain multiple ports, and address or application groups serve different purposes.

Answer

An application group containing web-browsing and ssl.

Answer

A custom service object with both ports defined.

Answer

An address group containing the server's IP address.

Question 2

A security administrator wants to allow access to a SaaS application but block specific high-risk functions within that application, such as file uploads. The application uses HTTP and HTTPS. Which Palo Alto Networks feature should the administrator use to granularly control application functions?

Accepted Answer

App-ID with application functions. App-ID can identify not only the application but also specific functions within it, such as file upload or posting. By using these application functions in security policy rules, the administrator can allow the SaaS application while blocking high-risk actions like file uploads. This provides granular control without blocking the entire application.

Answer

App-ID with application filters

Answer

Content-ID with Data Filtering

Answer

App-ID with application override

Question 3

A network security administrator is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The administrator wants to exclude employee access to healthcare portals from decryption to comply with privacy regulations, while still decrypting all other HTTPS traffic. Which decryption policy configuration should the administrator use?

Accepted Answer

Create a decryption policy rule with action 'no-decrypt' for the healthcare portal URLs, placed above the general decrypt rule.. Decryption policies are separate from security policies and are evaluated top-down. A no-decrypt rule for specific URLs, placed above a general decrypt rule, allows the administrator to exclude healthcare portals from decryption while decrypting all other HTTPS traffic. This satisfies privacy compliance without blocking access.

Answer

Configure a URL Filtering profile to block the healthcare portals, preventing any access.

Answer

Add the healthcare portal IP addresses to the SSL Decryption Exclusion list under Device > Setup > Session.

Answer

Create a security policy rule with action 'allow' and attach a decryption profile that disables decryption for those URLs.

Question 4

A security administrator notices that a Security policy rule permitting the application 'ssl' also allows users to access unauthorized SaaS applications that tunnel their traffic inside TLS on TCP 443. The administrator wants to block these applications without disrupting legitimate TLS traffic. Which Palo Alto Networks feature should be used to identify and control these applications?

Accepted Answer

SSL Decryption with a Forward Proxy certificate and a Decryption policy. The unauthorized SaaS applications are hidden inside TLS, so App-ID alone cannot see them. SSL Decryption with a Forward Proxy certificate allows the firewall to decrypt the traffic, after which App-ID can identify the actual applications. A Decryption policy determines what to decrypt, and Security policy can then block the specific SaaS applications while allowing legitimate TLS. This combination provides granular control without disrupting all TLS traffic.

Answer

QoS policy to rate-limit traffic on port 443

Answer

Application Override policy to force traffic to a custom application

Answer

URL Filtering profile to block the SaaS applications by their web categories

Question 5

A security administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants to ensure that the firewall blocks only the download direction and not the upload direction, while still logging the event. Which configuration should be used?

Accepted Answer

Set the File Blocking profile action to 'block' for the 'exe' file type in the download direction only.. A File Blocking profile can be configured with specific actions per file type and direction. To block only executable downloads while logging, the action for 'exe' should be set to 'block' in the download direction. This prevents executable files from being downloaded, logs the event, and leaves uploads and other file types unaffected. This precise configuration meets the security requirement without unnecessary restrictions.

Answer

Set the File Blocking profile action to 'block' for all file types in the download direction.

Answer

Set the File Blocking profile action to 'alert' for the 'exe' file type in both directions.

Answer

Set the File Blocking profile action to 'continue' for the 'exe' file type in the upload direction only.

Question 6

An administrator configures SSL Forward Proxy decryption on a Palo Alto Networks firewall. Internal users report that when they browse to https://portal.hr.example.com, the browser presents a certificate issued by the firewall's forward trust CA instead of the website's real certificate. The administrator wants the browser to trust this dynamically generated certificate without user warnings. What should the administrator do?

Accepted Answer

Install the forward trust CA certificate into the internal users' browser or operating system trust stores as a trusted root.. SSL Forward Proxy generates a substitute certificate for each decrypted server, signed by the firewall's forward trust CA. Clients will only accept that certificate without warnings if the forward trust CA certificate is present in their trust store. The firewall-side configuration is already correct; the missing piece is client-side trust distribution.

Answer

Configure the decryption policy to use the forward untrust certificate for the affected destination and add the site to the SSL Exclude list.

Answer

Enable SSL Forward Proxy only for the specific URL category and disable certificate pinning on the firewall.

Answer

Import the forward trust certificate and its private key into the firewall and enable SSL Forward Proxy in the decryption policy.

Question 7

A security administrator wants to block all peer-to-peer file sharing applications while allowing web browsing. Which type of security policy rule should they configure?

Accepted Answer

An application-based rule that denies the 'peer-to-peer' application group.. An application-based security policy rule using App-ID can identify and block the 'peer-to-peer' application group, which includes known P2P file sharing applications. This approach is effective regardless of the ports or protocols used. Service-based rules are port-dependent and easily bypassed. URL filtering and decryption rules do not directly block P2P applications. Thus, the application-based rule is the correct choice.

Answer

A URL filtering rule that blocks P2P websites.

Answer

A decryption rule that blocks encrypted P2P traffic.

Answer

A service-based rule that denies TCP ports 6881-6889.

Question 8

A security engineer is deploying a PA-5220 firewall in a high-availability active/passive pair. The engineer wants to ensure that the management interface of the passive firewall is reachable for out-of-band management. The firewalls are configured with HA1 and HA2 links. Which statement accurately describes the management interface behavior in this HA configuration?

Accepted Answer

The management interface on the passive firewall remains active and can be accessed independently, provided it has a unique IP address and is configured with a default gateway.. In an active/passive HA pair, the management interface of the passive firewall remains active and independently accessible, provided it has a unique IP and a default gateway. This allows out-of-band management of both firewalls. The management IP is not shared, and its availability does not depend on HA link status. Thus, the passive firewall's management interface can be used for direct administrative access.

Answer

The management interface on the passive firewall is disabled and can only be accessed by failing over the active firewall.

Answer

The management interface on the passive firewall only allows traffic if the HA1 link is down, as a fallback mechanism.

Answer

The management interface IP address is shared between the active and passive firewalls, and traffic is redirected to the active firewall.

Question 9

A security administrator needs to ensure that users cannot upload files containing malware to cloud storage applications. The administrator has enabled SSL decryption and wants to use WildFire to inspect files. Which configuration is required to submit files to WildFire for analysis?

Accepted Answer

Configure a WildFire Analysis profile and apply it to the Security policy rule that allows the cloud storage applications.. To submit files to WildFire for analysis, a WildFire Analysis profile must be configured and applied to the relevant Security policy rule. This profile defines which file types and directions are sent to WildFire. With SSL decryption enabled, the firewall can inspect encrypted uploads to cloud storage and forward files to WildFire. Other profiles like File Blocking, Antivirus, or Data Filtering do not provide WildFire submission.

Answer

Configure a Data Filtering profile to inspect file contents for malware patterns.

Answer

Configure an Antivirus profile to scan file uploads and block malware.

Answer

Configure a File Blocking profile to block all file uploads to cloud storage applications.

Question 10

A security administrator is configuring a Security policy rule to allow access to a SaaS application. The administrator wants to ensure that the application is identified correctly even if it uses dynamic IP addresses and multiple ports. Which App-ID characteristic allows the firewall to identify the application regardless of IP address and port?

Accepted Answer

App-ID uses protocol and behavior-based signatures that are independent of IP addresses and ports.. App-ID identifies applications by their unique protocol and behavioral signatures, independent of IP addresses and ports. This allows the firewall to recognize applications even when they use dynamic IPs or non-standard ports. For SaaS applications, App-ID can also leverage TLS SNI and certificate information. Relying on IP lists or port-based identification would be ineffective because these attributes change frequently. Therefore, the protocol and behavior-based signature approach is the correct characteristic.

Answer

App-ID uses port-based identification for known applications and falls back to signature-based identification for unknown ones.

Answer

App-ID requires the administrator to manually define the IP addresses and ports for each SaaS application in a custom application object.

Answer

App-ID relies on a dynamic IP address list that is updated by Palo Alto Networks to track SaaS providers.

Question 11

A security administrator needs to ensure that files downloaded by users are scanned for malware. The administrator has already configured a File Blocking profile to block malicious files. Which additional Palo Alto Networks security profile must be applied to the Security policy rule to inspect the file contents for known threats?

Accepted Answer

Antivirus. To inspect file contents for malware, the Antivirus security profile must be applied to the Security policy rule. The Antivirus profile scans files and data streams for viruses, spyware, and other malicious code. While File Blocking profiles can block files by type, they do not analyze content. Anti-Spyware, Vulnerability Protection, and URL Filtering serve different purposes and do not perform file content scanning for known threats.

Answer

URL Filtering

Answer

Vulnerability Protection

Answer

Anti-Spyware

Question 12

A network security administrator wants to review which users are accessing decrypted HTTPS sites and what URL categories those sites belong to. The administrator needs to see the username, source IP address, destination URL, and the applied decryption policy rule for each session. Which log type should the administrator consult?

Accepted Answer

Traffic log. The Traffic log is the primary session log on Palo Alto Networks firewalls and includes user identification, URLs, applications, and policy rule matches. For decrypted HTTPS sessions, it shows the URL and the decryption policy rule, enabling administrators to review user access to decrypted sites. Other log types serve different purposes and do not provide this combined session view.

Answer

Decryption log

Answer

Configuration log

Answer

Threat log

Question 13

A security administrator is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall to inspect outbound HTTPS traffic. The administrator wants to ensure that the firewall can generate certificates for decrypted sites and that internal users do not receive browser warnings. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Install the forward trust CA certificate as a trusted root in the internal users' browser or operating system trust stores.. Successful SSL Forward Proxy decryption requires the firewall to have a forward trust certificate and private key to sign re-issued certificates, and clients must trust the forward trust CA to accept those certificates silently. The decryption policy rule and decryption profile are important but do not directly address certificate generation and client trust.

Answer

Enable SSL Forward Proxy in a decryption policy rule that matches outbound HTTPS traffic.

Answer

Import the forward untrust certificate into the firewall's trust store for the destination servers.

Answer

Configure a decryption profile to block sessions with unsupported cipher suites.

Question 14

A Palo Alto Networks firewall is configured with SSL Forward Proxy decryption for outbound traffic. The administrator notices that some sessions to a banking website are being decrypted even though the organization's policy requires that financial sites be excluded from decryption. The decryption policy rule for financial URL categories is set to 'no-decrypt'. Which action should the administrator take to ensure these sessions are not decrypted?

Accepted Answer

Place the no-decrypt rule above the decrypt rule in the decryption policy rulebase and verify that the URL category is correctly matched.. Decryption policy rules are order-dependent, and the first match wins. If a decrypt rule precedes the no-decrypt rule, financial sites can be decrypted despite the no-decrypt rule's presence. Moving the no-decrypt rule above the decrypt rule and verifying the URL category match ensures financial traffic is correctly excluded from decryption.

Answer

Configure the forward untrust certificate for the banking site so the firewall does not decrypt it.

Answer

Disable SSL Forward Proxy globally and rely on SSL Inbound Inspection for outbound traffic.

Answer

Add the banking website's IP addresses to the SSL Exclude list in the decryption profile.

Question 15

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal zones. The security team wants to ensure that all traffic from the Users zone to the Servers zone is inspected for threats, but they also need to allow specific applications that use non-standard ports. They create a Security policy rule with 'application: any' and 'service: any', and attach a Vulnerability Protection profile. However, they notice that some traffic is not being inspected because it is being allowed by a more specific rule higher in the rulebase that allows only web-browsing and ssl. What should the administrator do to ensure all traffic is inspected?

Accepted Answer

Move the rule with 'application: any' and 'service: any' above the more specific rule in the rulebase.. Security policy rules are processed in order, and the first matching rule determines the action and profiles applied. The more specific rule allowing web-browsing and ssl is matched before the broader rule with 'any' application and the Vulnerability Protection profile. To ensure all traffic is inspected, the administrator must move the broader rule with the inspection profile above the specific rule. This way, all traffic from Users to Servers is matched by the inspection rule first, and threat inspection is applied.

Answer

Create a new rule at the top of the rulebase that denies all traffic from Users to Servers, forcing traffic to be inspected by the next rule.

Answer

Enable 'Log at Session Start' on the more specific rule to ensure inspection occurs.

Answer

Modify the more specific rule to include 'application: any' and attach the same Vulnerability Protection profile.