PCNSA Practice Test 29 — 15 Questions

Question 1

A security administrator is reviewing the rulebase and notices that a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone has the action set to 'Allow' but is not being hit. The administrator confirms that there is traffic matching the source and destination zones, addresses, and applications. What is the most likely reason the rule is not being hit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rule above it with a broader match is already allowing the traffic, so the lower rule is never evaluated.. A rule is not hit if a rule above it matches the traffic first. The administrator should examine the rules above the one in question to see if any of them match the same traffic. This is the most common reason for a rule not being hit when its criteria seem correct.

Answer

The rule is not being hit because the application is not recognized by App-ID and is being denied by the implicit deny rule.

Answer

The rule is not being hit because the security policy is not committed.

Answer

The rule is not being hit because the source and destination addresses are incorrect.

Question 2

A security administrator is troubleshooting why some SSL Forward Proxy decrypted sessions are failing with 'certificate unknown' errors. The firewall is configured with a self-signed forward trust certificate. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Install the forward trust certificate's root CA on all client systems.. The 'certificate unknown' error occurs because clients do not trust the forward trust certificate used by the firewall to re-sign decrypted traffic. To fix this, the forward trust certificate must be either signed by a trusted CA or its root CA must be installed on clients. These two actions ensure that clients trust the certificates generated by the firewall, allowing decryption to proceed without errors.

Answer

Change the decryption rule action to 'no-decrypt' for affected sites.

Answer

Configure a decryption profile to allow expired certificates.

Answer

Enable SSL decryption on the untrust zone.

Question 3

A network security administrator is configuring a security policy rule to allow DNS traffic from the Trust zone to the Untrust zone. The rule uses application dns and service application-default. Users report that DNS queries to external servers are failing. The administrator notices that the firewall is allowing the DNS queries but the responses are being dropped. What is the most likely cause?

Accepted Answer

The DNS responses are being dropped due to asymmetric routing where the response takes a different path and the firewall does not see the return traffic.. Stateful firewalls require that return traffic for a session traverse the same firewall. If DNS responses take a different path (asymmetric routing), the firewall does not recognize them as part of an existing session and drops them. This is a frequent cause of DNS failures when multiple paths exist. Ensuring symmetric routing or using NAT can resolve the issue.

Answer

The return traffic is being dropped because the security policy rule does not allow the dns application in the reverse direction.

Answer

The firewall is performing DNS sinkholing and dropping the responses.

Answer

The security policy rule does not allow the dns-base application.

Question 4

A network administrator wants to ensure that the firewall sends SNMP traps to a monitoring server at 192.168.1.50. The administrator has already configured the SNMP community string and added the trap destination under Device > Setup > Services. However, traps are not being received. What is the most likely missing configuration?

Accepted Answer

An Interface Management Profile allowing SNMP on the interface used for traps.. SNMP traps are sent from the firewall's management plane, and the interface used must permit SNMP via an Interface Management Profile. If the profile does not allow SNMP, traps are dropped. Security policies and NAT rules do not apply to management traffic. Therefore, the missing configuration is the Interface Management Profile allowing SNMP.

Answer

A security policy rule allowing SNMP traffic from the firewall to the monitoring server.

Answer

A NAT rule to translate the firewall's management IP to a routable address.

Answer

Configuring the SNMP version to v3 with authentication.

Question 5

A security administrator wants to block all peer-to-peer file sharing applications, such as BitTorrent, regardless of the port they use. Which Palo Alto Networks feature should the administrator use to accomplish this?

Accepted Answer

App-ID. App-ID is the feature that identifies applications regardless of port, protocol, or encryption. By using App-ID in a security policy rule, the administrator can deny the BitTorrent application directly, ensuring it is blocked even if it tries to use different ports. This provides accurate application control without relying on port-based rules.

Answer

User-ID

Answer

Content-ID

Answer

Service objects

Question 6

A network administrator needs to configure SNMPv3 on a Palo Alto Networks firewall to allow a monitoring server to query interface statistics. The administrator wants to ensure that SNMP queries are authenticated and encrypted. Which SNMPv3 configuration is required to meet these requirements?

Accepted Answer

Create an SNMPv3 user with auth password and priv password, and assign a view that includes the interface statistics OIDs.. SNMPv3 requires both authentication and encryption to secure queries. This is achieved by configuring an SNMPv3 user with both an auth password and a priv password. Additionally, the user must be associated with a view that permits access to the specific OIDs needed, such as interface statistics. Using the default view with all OIDs is overly permissive and not recommended.

Answer

Create an SNMPv3 user with auth and priv passwords, and assign the default view that includes all OIDs.

Answer

Create an SNMPv3 user with only an auth password, and assign a view that includes the interface statistics OIDs.

Answer

Create an SNMPv3 user with only a priv password, and assign a view that includes the interface statistics OIDs.

Question 7

A network security engineer is configuring a Palo Alto Networks firewall to send SNMP traps to a management server. The engineer has already configured the SNMP community string and the trap destination IP. However, the management server is not receiving any traps. Which additional configuration is required to allow SNMP traps to be sent?

Accepted Answer

Enable SNMP on the management interface by applying an Interface Management Profile that includes SNMP.. SNMP traps are generated by the management plane and sent out the management interface. By default, SNMP is not enabled on that interface. An Interface Management Profile with SNMP enabled must be applied to the management interface. Once that is done, the firewall can send traps to the configured destination. Other options either relate to data plane policies or routing, which are not the cause of the missing traps.

Answer

Configure an SNMPv3 user with authentication and encryption.

Answer

Configure a Security policy rule allowing SNMP traffic from the firewall to the management server.

Answer

Add a static route to the management server via the management interface.

Question 8

An administrator is designing a security policy for a new branch office. The policy must allow outbound web traffic from the Trust zone to the Untrust zone, but only for specific users in the 'Marketing' group. The firewall is integrated with Active Directory. Which TWO configurations are required to enforce this policy? (Choose two.)

Accepted Answer

Create a security rule with source zone Trust, destination zone Untrust, application web-browsing and ssl, and action Allow.. To allow outbound web traffic only for the Marketing group, two things are needed: a security rule that permits web-browsing and ssl from Trust to Untrust, and User-ID configuration to map users to IP addresses so that the Marketing group can be specified as the source user in the rule. Without both, the policy cannot be enforced correctly.

Answer

Configure a decryption policy to decrypt all outbound web traffic.

Answer

Enable SSL decryption to identify users in the Marketing group.

Answer

Create a URL filtering profile that allows only Marketing-related websites.

Question 9

An administrator wants to monitor which applications are being used on the network after SSL decryption. Which Palo Alto Networks feature provides detailed information about applications, including those that use SSL/TLS?

Accepted Answer

App-ID. App-ID is the Palo Alto Networks technology that identifies applications, including those that use SSL/TLS, after decryption. It provides visibility and control over applications. Content-ID, User-ID, and SSL Decryption serve different purposes: Content-ID enforces security, User-ID maps users, and SSL Decryption enables inspection.

Answer

User-ID

Answer

SSL Decryption

Answer

Content-ID

Question 10

An administrator needs to create an External Dynamic List (EDL) that contains a list of malicious IP addresses. The list is hosted on an internal web server at http://192.168.1.50/malicious.txt. The firewall must check for updates every hour. Which configuration is required?

Accepted Answer

Create an EDL object with type 'IP List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.. To create an External Dynamic List for malicious IP addresses hosted on an internal web server via HTTP, the administrator must configure an EDL of type 'IP List' with the correct source URL and set the check interval to 60 minutes. This ensures the firewall retrieves the list hourly, as required. The EDL can then be used in security policies to block traffic from those IP addresses.

Answer

Create an EDL object with type 'IP List', source URL 'https://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.

Answer

Create an EDL object with type 'Domain List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.

Answer

Create an EDL object with type 'IP List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 5 minutes.

Question 11

An administrator is creating an application filter to allow only specific applications while blocking others within a category. The administrator wants to ensure that the filter matches applications based on their risk level. Which attribute should the administrator use in the application filter?

Accepted Answer

Risk. The Risk attribute in an application filter allows matching applications based on their security risk level (1-5). This is the only attribute among the options that directly reflects risk. Using Risk, the administrator can create filters that include or exclude applications by risk, ensuring that only applications with acceptable risk levels are allowed.

Answer

Subcategory

Answer

Category

Answer

Technology

Question 12

A security administrator needs to monitor which applications are being used over encrypted traffic. The firewall is configured to decrypt outbound SSL traffic. Which log type should the administrator review to see the decrypted application details?

Accepted Answer

Traffic log. The traffic log is the central log for all sessions and includes application identification, even for decrypted traffic. After SSL decryption, the firewall can identify the application and log it in the traffic log. Other logs like threat or URL filtering are specialized and do not provide a complete view of application usage.

Answer

Threat log

Answer

URL filtering log

Answer

Decryption log

Question 13

A security administrator is configuring a Palo Alto Networks firewall to send syslog messages to an external syslog server at 203.0.113.10. The syslog server is reachable only through the ethernet1/1 interface, which is in the untrust zone. The administrator has configured the syslog server under Device > Server Profiles > Syslog and attached it to a log forwarding profile. However, syslog messages are not being received by the server. What is the most likely cause?

Accepted Answer

A service route for syslog is not configured to use ethernet1/1 as the source interface.. Syslog messages are sent from the management plane, and their source interface is determined by service routes. When the syslog server is only reachable via a specific interface, a service route must be configured to use that interface. Without it, the firewall may attempt to send syslog messages from the management interface, which cannot reach the server, resulting in no messages being received.

Answer

The syslog server is not configured to accept messages from the firewall's management IP address.

Answer

The syslog server profile is not assigned to the correct log forwarding profile.

Answer

A security policy rule is blocking syslog traffic from the firewall to the syslog server.

Question 14

A security administrator is configuring a Data Filtering profile to prevent sensitive information from leaving the corporate network via web traffic. The administrator wants to detect and block patterns such as credit card numbers and social security numbers in HTTP POST requests. Which two actions can the Data Filtering profile take when a match is found? (Choose two.)

Accepted Answer

Alert. Data Filtering profiles support two primary actions when a pattern match occurs: Alert and Block. Alert generates a log and notification without stopping the traffic, while Block prevents the data from being transmitted. These actions allow administrators to monitor or enforce policies on sensitive data. Other actions like Allow, Reset Client, and Continue are not available in Data Filtering profiles, making Alert and Block the correct choices for this scenario.

Answer

Continue

Answer

Reset Client

Answer

Allow

Question 15

An administrator is configuring a security rule that allows access from the Trust zone to the DMZ zone for a specific application. The administrator wants to ensure that the rule only allows the application on its default port and blocks the application if it attempts to use a non-standard port. Which setting should be used in the Service column of the security rule?

Accepted Answer

application-default. The application-default option in the Service column restricts the rule to the default ports for the selected application. This ensures that the application is only allowed on its standard ports, and any attempt to use a non-standard port will not match the rule, effectively blocking it. This is the correct way to enforce default port usage.

Answer

any

Answer

service-http

Answer

service-https