PCNSA Practice Test 28 — 15 Questions

Question 1

A large enterprise operates multiple data centers with a Palo Alto Networks firewall pair in each data center in active/passive HA. The firewalls are managed by Panorama. Recently, after a power outage in Data Center A, both firewalls in that data center came back online but are not passing traffic. The network team confirms that the switches and routers are operational. The Panorama administrator sees that both firewalls are connected and show green in the Managed Devices tab. However, the active firewall in Data Center A shows "HA state: passive" and the other firewall also shows "passive". The administrator suspects a configuration issue. What is the most likely cause and corrective action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Both firewalls have the same priority and no preemptive is enabled; configure different priorities and enable preemptive.. In an active/passive HA pair, if both firewalls show 'passive', it typically means they cannot determine which should be active. This occurs when both have the same priority and preemptive is disabled, so neither can claim the active role after a reboot. Configuring different priorities and enabling preemptive ensures one firewall becomes active based on its higher priority (lower numerical value).

Answer

The HA firewall link is down; check and reconnect the Layer 2 link between the firewalls.

Answer

The HA configuration is missing a heartbeat interface; add a dedicated heartbeat interface.

Answer

The preemptive settings are misconfigured; change the priority to make one firewall active.

Question 2

Refer to the exhibit. An administrator notices that some HTTPS sessions are not being decrypted. Which configuration change would address the most common cause of decryption failures shown?

Accepted Answer

Enable 'allow expired certificates' in the SSL decryption profile.. The log shows a warning about an expired server certificate causing decryption failure. By enabling 'allow expired certificates' in the decryption profile, the firewall will continue to decrypt traffic even if the server certificate is expired.

Answer

Configure a forward trust certificate that is valid and trusted.

Answer

Increase the session timeout for decryption.

Answer

Enable support for SSLv3 in the decryption profile.

Question 3

Refer to the exhibit. A security analyst wants to ensure that all HTTPS traffic from internal users to the internet is decrypted for inspection. However, traffic from the 'corp-users' group is being blocked instead of decrypted. Which configuration change should be made?

Accepted Answer

Move rule 2 above rule 1.. In a Palo Alto Networks firewall, decryption policies are evaluated in order from top to bottom, and the first matching rule is applied. Since rule 1 (which blocks corp-users traffic) is above rule 2 (which decrypts traffic), the block action is taken before the decryption rule can be evaluated. Moving rule 2 above rule 1 ensures that decryption is applied first to corp-users traffic, allowing inspection before any blocking action.

Answer

Add a new rule above rule 1 to decrypt corp-users traffic.

Answer

Change rule 4 to 'allow' instead of 'block'.

Answer

Change rule 2 to use 'any' for source user.

Question 4

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Accepted Answer

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.. It uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

Answer

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Answer

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Answer

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Question 5

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

Accepted Answer

The rule has 'Log at Session End' disabled. The 'Log at Session End' setting on a security policy rule controls whether traffic matching that rule generates a Traffic log entry when the session closes. If this setting is disabled, the firewall will allow the traffic per the rule but will not record it in the Traffic logs, which matches the scenario where traffic is permitted but not logged.

Answer

Zone Protection profile is set to 'Log at Session Start'

Answer

The Log Forwarding profile is not applied

Answer

Disable Server Response Inspection on the rule

Question 6

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Accepted Answer

Tags can be applied to address objects. Tags are metadata labels that can be applied to address objects in Palo Alto Networks firewalls. This allows you to categorize objects flexibly, and dynamic address groups use these tags to automatically include or exclude objects based on tag membership.

Answer

A static address group can also use tags for matching

Answer

Tags are case-sensitive

Question 7

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

Accepted Answer

Management profile HTTP permission revoked. The management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Answer

HTTP certificate expired

Answer

HTTP is disabled by default after upgrade

Answer

Browser caching issue

Answer

HTTP port conflict

Question 8

Refer to the exhibit. An administrator notices that SSH traffic from the trust zone to the untrust zone is being blocked. The administrator expected it to be allowed by rule 2. What is the most likely reason?

Accepted Answer

Rule 1 matches the traffic and is evaluated before rule 2. Rule 1 matches any SSH traffic (source and destination zones 'any') and is evaluated before rule 2. Since rule 1's action is 'deny', it blocks the traffic before rule 2 can allow it. Option A is incorrect because the service setting does not affect rule matching priority; rule order determines evaluation. Option C is incorrect because the action of rule 1 is 'deny', not 'allow'. Option D is incorrect because even if rule 2's source zone is correct, rule 1 still matches first and blocks the traffic.

Answer

Rule 2's application is set to 'ssh' but the service is not 'application-default'

Answer

Rule 1 is configured with action 'allow'

Answer

Rule 2's source zone is incorrectly set to 'dmz'

Question 9

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Accepted Answer

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action. A security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Answer

Source Zone, Destination Zone, Application, and User

Answer

Source Zone, Destination Zone, Application, and Service

Answer

Source Zone, Destination Zone, Service, and Action

Question 10

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Accepted Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.. It uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Answer

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Question 11

During troubleshooting, a firewall shows a large number of SSL decryption failures with error 'certificate_unknown'. The firewall is configured for forward proxy decryption. What is the most likely cause?

Accepted Answer

The firewall cannot reach the CRL or OCSP responder to validate the server certificate.. In forward proxy decryption, the firewall must validate the server certificate against a Certificate Revocation List (CRL) or via OCSP to ensure it hasn't been revoked. A 'certificate_unknown' error specifically indicates that the firewall cannot determine the revocation status of the server certificate, often because it cannot reach the CRL distribution point or OCSP responder. This is distinct from a certificate that is simply expired or untrusted by the client.

Answer

The client does not trust the firewall's CA certificate.

Answer

The server certificate is expired.

Answer

The decryption policy has an incorrect source zone.

Question 12

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Accepted Answer

There are a few sessions failing due to TLS version mismatch.. The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Answer

The firewall is rejecting many sessions due to certificate errors.

Answer

The decryption policy is not being hit because of low policy hits.

Answer

The current decryption session count is at its peak.

Question 13

An administrator is troubleshooting decryption-related connectivity issues. Which two log types should be examined to gather information about decryption actions and errors?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record details about SSL/TLS decryption actions, including handshake failures, certificate validation errors, and decryption policy matches. When troubleshooting connectivity issues related to decryption, these logs provide the most direct insight into why a session might be blocked or failing due to decryption errors.

Answer

System logs

Answer

URL Filtering logs

Answer

Threat logs

Question 14

An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?

Accepted Answer

Create an address group and a service group. Creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.

Answer

Use a single address object with a subnet

Answer

Create separate rules for each server

Answer

Use a dynamic address group with tags

Question 15

A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?

Accepted Answer

The traffic will be allowed because Rule1 matches before Rule2.. Palo Alto Networks firewalls use first-match policy evaluation: the first rule that matches the traffic's source zone, destination zone, source/destination IP, application, and user determines the action. Since Rule1 (allow) appears before Rule2 (deny), traffic from Engineering to Servers matches Rule1 first and is allowed, regardless of later deny rules.

Answer

To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.

Answer

Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.

Answer

The firewall evaluates all rules and applies the most restrictive action (deny).