PCNSA Practice Test 28 — 15 Questions

Question 1

A network administrator is configuring a Security policy rule on a Palo Alto Networks firewall to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule only allows HTTP traffic on its default port. Which service setting should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

application-default. The 'application-default' service setting is the correct choice because it allows traffic only on the default ports defined for the selected application. For HTTP, the default port is TCP 80. This setting ensures that the rule permits HTTP only on its standard port, aligning with least privilege. It also automatically updates if application definitions change, reducing administrative overhead. Using 'any' would be too permissive, while specific service objects like TCP-80 are static and less flexible.

Answer

service-http

Answer

any

Answer

TCP-80

Question 2

A company uses a Palo Alto Networks firewall to secure outbound internet access. The security team wants to ensure that users cannot access malicious websites. They have configured a URL Filtering profile with the 'malware' category set to 'block' and attached it to a Security policy rule that allows web-browsing. However, users report that they can still access some known malicious sites that are categorized as 'malware'. What is the most likely reason?

Accepted Answer

The 'malware' category is set to 'block', but the site is using HTTPS and the firewall is not decrypting traffic, so the URL Filtering profile cannot inspect the URL.. URL Filtering can only block based on URL categories if the firewall can see the full URL. For HTTPS traffic, the URL is encrypted within the TLS session, so without SSL decryption, the firewall cannot inspect the URL and thus cannot enforce URL Filtering for those sites. The most likely reason users can access malicious HTTPS sites is that SSL decryption is not enabled. Enabling SSL Forward Proxy decryption would allow the firewall to see the URL and apply the URL Filtering profile correctly.

Answer

The URL Filtering profile is attached to the wrong Security policy rule; there is a more specific rule above that allows the traffic without URL Filtering.

Answer

The URL Filtering profile is not applied because the Security policy rule does not have the correct source and destination zones.

Answer

The URL Filtering profile is configured to block the 'malware' category, but the firewall's URL database is outdated and does not contain those sites.

Question 3

A network security administrator needs to create a rule that allows DNS traffic from the Trust zone to the Untrust zone. Which application should be selected in the security rule to allow DNS?

Accepted Answer

dns. The correct application to allow DNS traffic is 'dns'. This application is predefined in PAN-OS and matches DNS queries and responses on port 53. Selecting it in a security rule ensures that DNS traffic from Trust to Untrust is permitted, allowing clients to resolve domain names.

Answer

ssl

Answer

ping

Answer

web-browsing

Question 4

A security administrator needs to ensure that employees cannot post credit card numbers on social media websites. The company uses Palo Alto Networks firewalls with SSL decryption configured for outbound traffic. Which Content-ID feature should be used to detect and block the credit card numbers in HTTP POST requests to social media sites?

Accepted Answer

Data Filtering profile with a custom pattern for credit card numbers.. Data Filtering profiles are specifically designed to detect and control sensitive data such as credit card numbers. By applying a Data Filtering profile with a custom pattern to the security rule that allows social media applications, the firewall can inspect decrypted HTTP POST requests and block those containing credit card numbers. This is the correct Content-ID feature for this scenario.

Answer

File Blocking profile that blocks the 'any' file type in the upload direction.

Answer

Vulnerability Protection profile that blocks HTTP POST requests containing numeric patterns.

Answer

Antivirus security profile with a custom signature for credit card numbers.

Question 5

An administrator notices that the firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which feature should be used to selectively bypass decryption for certain traffic?

Accepted Answer

Decryption policy with 'no-decrypt' action for specific URL categories.. To reduce CPU load from SSL decryption without disabling it entirely, administrators should create decryption policy rules with the 'no-decrypt' action for specific URL categories or traffic that is less critical for inspection. This selective bypass reduces the volume of decrypted sessions, lowering CPU utilization while maintaining decryption for high-risk traffic.

Answer

Configure a decryption profile to disable decryption for untrusted certificates.

Answer

Enable hardware acceleration for SSL decryption.

Answer

SSL decryption exclusion based on source IP address.

Question 6

An administrator needs to create a service object for a custom application that uses TCP port 8080 and UDP port 8080. What is the most efficient way to create this service object?

Accepted Answer

Create a single service object, add TCP and UDP protocols, and specify destination port 8080 for each.. PAN-OS service objects can contain multiple protocol entries. To cover both TCP and UDP on port 8080, the administrator should create one service object and add two protocol entries: one for TCP with destination port 8080 and one for UDP with destination port 8080. This single object can then be referenced in security policies, providing a clean and efficient configuration.

Answer

Create a service object with protocol UDP and destination port 8080.

Answer

Create two service objects: one for TCP port 8080 and one for UDP port 8080, then create a service group containing both.

Answer

Create a service object with protocol TCP and destination port 8080.

Question 7

A security administrator is troubleshooting why SSL decryption is not working for certain websites. The administrator notices that the firewall is generating a certificate signed by the Forward Untrust certificate for these sites. What is the most likely cause?

Accepted Answer

The websites' certificates are not trusted by the firewall's list of trusted CAs.. The Forward Untrust certificate is used when the firewall does not trust the server's certificate. This can happen if the server's certificate is self-signed or issued by a CA not in the firewall's trusted list. The firewall then signs the certificate presented to the client with the Forward Untrust certificate, triggering a warning. Other options would result in different behaviors.

Answer

The decryption policy is set to 'no-decrypt' for these websites.

Answer

The Forward Trust certificate is not installed on the firewall.

Answer

The websites are using certificate pinning.

Question 8

An administrator needs to allow DNS traffic from the Trust zone to the Untrust zone. The security policy rule uses the application 'dns' and service 'application-default'. Which port will be allowed by default?

Accepted Answer

TCP and UDP port 53. The 'dns' application in Palo Alto Networks firewalls uses both TCP and UDP port 53. When 'application-default' is selected, the firewall automatically allows these ports. This ensures that DNS queries, responses, and zone transfers function properly without manual service definition.

Answer

TCP port 53 only

Answer

UDP port 53 only

Answer

TCP port 853

Question 9

An administrator is creating address objects in PAN-OS and needs to ensure that they can be used in security policies to identify specific sources and destinations. Which two of the following are valid address object types that can be directly referenced in a security policy rule? (Choose two.)

Accepted Answer

FQDN. IP Netmask and FQDN are both valid address object types that can be directly referenced in security policy rules. IP Netmask defines a subnet, and FQDN resolves a domain name to IPs. The other options are not address objects: Region is used for geographic targeting, while Service and Application Filter are used in other policy fields. Thus, the correct choices are IP Netmask and FQDN.

Answer

Region

Answer

Service

Answer

Application Filter

Question 10

A security administrator at a branch office needs to allow a remote vendor to access the firewall's web management interface only from IP address 203.0.113.50. The firewall's management interface is in the Management zone. Which Palo Alto Networks feature should the administrator use to restrict access?

Accepted Answer

Configure an Interface Management Profile with HTTPS allowed and permitted IP addresses set to 203.0.113.50, then apply it to the management interface.. The Interface Management Profile is the correct tool because it explicitly enables management services on an interface and can restrict them to specific source IP addresses. Applying it to the management interface with HTTPS enabled and the vendor's IP permitted ensures only that address can reach the web UI. Other options either do not affect management plane access or address routing/authentication rather than IP-based restriction.

Answer

Create a Security policy rule allowing traffic from 203.0.113.50 to the Management zone on port 443.

Answer

Configure an authentication profile that requires the vendor to authenticate with a certificate before accessing the web UI.

Answer

Add a static route for 203.0.113.50 pointing to the management interface.

Question 11

An administrator must ensure that outbound SSL decryption is applied to user web traffic while excluding banking and healthcare sites that break under inspection. The administrator wants the firewall to skip decryption for these sensitive categories without disabling decryption globally. What should the administrator configure in the decryption policy?

Accepted Answer

A decryption policy rule with action 'no-decrypt' and a URL Category match for the sensitive categories. Decryption policy rules determine which sessions are decrypted or bypassed, and they can match on URL Category. To exclude sensitive categories while decrypting other web traffic, the administrator should create a no-decrypt rule for those categories and place it above the general decrypt rule. Security policy, decryption profiles, and URL filtering profiles do not control whether a session is decrypted, so they cannot satisfy the requirement.

Answer

A decryption profile with 'Block Untrusted Issuers' enabled for the sensitive categories

Answer

A security policy rule with action 'allow' and application 'ssl' for the sensitive categories

Answer

A URL Filtering profile with action 'alert' for the sensitive categories

Question 12

A security administrator at a healthcare company needs to detect and block outbound emails that contain patient Social Security numbers. The company uses Microsoft Exchange over SMTP, and the firewall is running PAN-OS 10.1 with the appropriate subscriptions. Which Content-ID feature should the administrator configure to inspect the email body and attachments for sensitive data patterns?

Accepted Answer

Data Filtering profile. Data Filtering profiles are designed to detect and control sensitive information such as credit card numbers, Social Security numbers, and custom patterns within allowed traffic. When applied to a security rule that permits SMTP, the firewall inspects the email body and attachments for these patterns and can block or alert. This is the correct Content-ID feature for preventing outbound emails with patient SSNs.

Answer

Antivirus security profile

Answer

File Blocking profile

Answer

URL Filtering profile

Question 13

An administrator is creating a new address object in PAN-OS and needs to ensure that the object can be used in security policies to match traffic from a specific subnet and also from a specific range of IP addresses within that subnet. Which two address object types should the administrator consider? (Choose two.)

Accepted Answer

IP Netmask. To match a specific subnet, the administrator should use an IP Netmask object, which defines a network and mask. To match a specific range of IP addresses within that subnet, an IP Range object is appropriate, as it allows a start and end IP. Both types can be referenced in security policies. The other types are either for domain names or dynamic membership, which do not fit the static requirements.

Answer

FQDN

Answer

Dynamic Address Group

Answer

IP Wildcard Mask

Question 14

An administrator is reviewing the security policy and notices a rule that allows all traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that only web browsing (HTTP and HTTPS) is allowed, while all other traffic is blocked. What should the administrator do?

Accepted Answer

Modify the existing rule to allow only the 'web-browsing' and 'ssl' applications, and ensure the rule is placed above any other permissive rules.. To restrict traffic to only HTTP and HTTPS, the existing permissive rule should be modified to allow only the 'web-browsing' and 'ssl' applications. The implicit deny at the bottom will block all other traffic. It is also important to ensure the rule is positioned correctly in the rulebase, above any other rules that might allow broader traffic. Creating unnecessary deny rules is not best practice.

Answer

Create a new rule to deny all traffic from Trust to Untrust, and place it above the existing allow rule.

Answer

Modify the existing rule to allow only the 'web-browsing' and 'ssl' applications, and add a deny rule below for all other traffic.

Answer

Leave the rule as is and create a new rule to deny all non-web traffic, placing it below the allow rule.

Question 15

An administrator is troubleshooting why a security rule is not being hit. The rule is for traffic from the 'Trust' zone to the 'Untrust' zone, source address 10.1.1.0/24, destination address any, application 'web-browsing', service 'application-default', action allow. The traffic in question is from 10.1.1.5 to 8.8.8.8 on port 80. The administrator checks the traffic logs and sees that the session is being denied by the interzone default rule. What is the most likely cause?

Accepted Answer

The zone assigned to the ingress interface for the traffic is not 'Trust'.. The traffic is denied by the interzone default rule, meaning the custom rule was not matched. The most likely cause is that the ingress interface is not assigned to the 'Trust' zone. The source zone in the rule must match the zone of the incoming interface. If the interface is in a different zone, the rule will not be evaluated. Checking the zone configuration on the interface would resolve this.

Answer

The rule is disabled.

Answer

The source address in the rule does not match the actual source IP of the traffic.

Answer

The application 'web-browsing' is not matching because the traffic is actually HTTPS on port 80.