PCNSA Practice Test 29 — 15 Questions

Question 1

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Accepted Answer

A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.. In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Answer

The traffic is using TLS 1.3 which is not supported by the firewall.

Answer

The firewall's encryption algorithm settings do not match the server's cipher suite.

Answer

The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

Question 2

Refer to the exhibit. What is the status of the commit job?

Accepted Answer

Pending. The commit job status is 'Pending' because the commit operation has been initiated but not yet completed. In Palo Alto Networks firewalls, when a commit is in progress, the job status shows as 'Pending' until the configuration is successfully applied or an error occurs. The exhibit likely shows a commit job with a status of 'Pending', indicating that the system is still processing the configuration changes.

Answer

Completed

Answer

Canceled

Answer

Failed

Question 3

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

Accepted Answer

Path monitoring.. Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Answer

Heartbeat backup.

Answer

Session replication.

Answer

Link monitoring on all interfaces.

Question 4

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Option A is correct because Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 5

After making configuration changes, an administrator clicks 'Commit' but the changes are not applied. What is the most likely cause?

Accepted Answer

Configuration validation errors exist. When an administrator clicks 'Commit' but the changes are not applied, the most likely cause is that configuration validation errors exist. The Palo Alto Networks firewall performs a validation check before committing; if any errors are found (e.g., invalid IP addresses, missing required fields, or conflicting rules), the commit is blocked and an error message is displayed. This ensures that only syntactically and semantically correct configurations are applied to the running state.

Answer

The commit is scheduled for a later time

Answer

The commit was canceled by another admin

Answer

The firewall is in multi-vsys mode and only the current vsys is committed

Question 6

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. Option C is correct because the 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 7

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. Option D is correct because PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.

Question 8

An administrator wants to synchronize the firewall's clock with a central NTP server. Where is this configured?

Accepted Answer

Under Device > Setup > Services, NTP tab. Option B is correct because NTP (Network Time Protocol) client configuration on a Palo Alto Networks firewall is performed under Device > Setup > Services, where the NTP tab allows you to specify primary and secondary NTP servers. This synchronizes the firewall's system clock, which is critical for accurate log timestamps, certificate validation, and security policy enforcement. The firewall acts as an NTP client, sending periodic NTP requests (typically using UDP port 123) to the configured servers.

Answer

Under Objects > Regions

Answer

Under Device > Licenses

Answer

Under Network > Interfaces, Management Interface

Question 9

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

Accepted Answer

Install multiple User-ID agents in a redundancy group, each serving multiple sites.. Option D is correct because deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Answer

Install a single centralized User-ID agent that polls all domain controllers across sites.

Answer

Use the built-in User-ID agent on each firewall and point it to local domain controllers.

Answer

Install one User-ID agent at each site, each configured to communicate only with the local firewall.

Question 10

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. Option A is correct because a Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 11

Which three of the following are valid commit options in the PAN-OS GUI? (Choose three.)

Accepted Answer

Validate commit. Option A is correct because the PAN-OS GUI provides a 'Validate commit' option that checks the configuration for errors before applying it. This is a standard commit option that ensures the candidate configuration is syntactically and semantically valid, reducing the risk of committing a broken configuration.

Answer

Force commit

Answer

Commit to Panorama

Question 12

Which license is required for the firewall to use URL filtering?

Accepted Answer

URL Filtering. URL filtering requires a dedicated URL Filtering license on Palo Alto Networks firewalls to enable the firewall to query the PAN-DB cloud or use a locally installed URL database for categorizing URLs. Without this license, the firewall cannot perform URL-based access control, even if other security subscriptions like Threat Prevention or WildFire are active.

Answer

DNS Security

Answer

GlobalProtect

Answer

WildFire

Answer

Threat Prevention

Question 13

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 14

During troubleshooting, an administrator needs to review firewall system events such as user logins, configuration changes, and commit failures. Which log type should be examined?

Accepted Answer

System logs. System logs in Palo Alto Networks firewalls capture administrative and system-level events, including user logins, configuration changes, and commit failures. These logs are generated by the management plane and are essential for auditing and troubleshooting device management activities.

Answer

Threat logs

Answer

Traffic logs

Answer

URL filtering logs

Question 15

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

Accepted Answer

Management profile HTTP permission revoked. Option C is correct because the management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Answer

HTTP certificate expired

Answer

HTTP is disabled by default after upgrade

Answer

Browser caching issue

Answer

HTTP port conflict