PCNSA Practice Test 29 — 15 Questions

Question 1

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

Accepted Answer

URL Filtering profile to block the Social Networking category.. A URL Filtering profile allows the administrator to block access to specific categories of websites, such as Social Networking. By applying this profile to a security policy rule that governs internet access, the firewall can identify and block HTTP/HTTPS traffic to social media sites based on their URL category, without needing to decrypt or inspect the content.

Answer

SSL Decryption policy to decrypt traffic to social media.

Answer

QoS policy to limit bandwidth to social media sites.

Answer

File blocking profile to block executable files from social media.

Question 2

A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.

Accepted Answer

The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'.. The logs show traffic from remote users is being matched to a rule that denies inter-zone traffic from GlobalProtect to internal, meaning the intended allow rule is not matching. If the security rule's source zone is set to 'Trust' instead of 'GlobalProtect', traffic sourced from the GlobalProtect zone will not match that rule and will instead hit the default inter-zone deny rule. Option A is about security profiles, which would not cause a rule mismatch. Option B (User-ID) affects user mapping but not zone-based rule matching. Option C (routes/split-tunneling) affects routing but not policy matching; the users can connect and get IPs, so routing is working, but the traffic is being denied by policy, not routing.

Answer

The internal resources require a specific security profile that is not applied to the rule.

Answer

The User-ID agent is not mapping remote usernames correctly.

Answer

The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings.

Question 3

A small business uses a single PA-220 firewall for internet access and has three internal zones: Trust, DMZ, and Guest. Users in the Trust zone report intermittent connectivity to a public cloud application. The firewall administrator checks the traffic logs and sees that sessions to the cloud application show "Application: ssl" and "Action: allow". The administrator suspects the issue might be related to decryption. The firewall currently has a decryption policy that decrypts all outbound HTTPS traffic for threat inspection. The cloud application uses certificate pinning and breaks when decrypted. What is the best solution to allow this application to function while still decrypting other traffic?

Accepted Answer

Create a decryption exclusion rule for the specific cloud application by source or URL category.. Creating a decryption exclusion rule for the specific cloud application (by source IP, URL category, or destination) allows the firewall to bypass decryption for that traffic while continuing to decrypt all other outbound HTTPS traffic. This resolves the certificate pinning issue without compromising security for other traffic. Decryption exclusion rules are a standard feature in PAN-OS for handling applications that break under decryption.

Answer

Upgrade the firewall to a model that supports certificate key protection.

Answer

Disable SSL decryption entirely.

Answer

Change the decryption policy to decrypt only inbound traffic.

Question 4

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 5

Drag and drop the steps to configure a URL filtering profile on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy, then test and verify.. URL filtering profile involves categories, actions, policy attachment, SSL decryption, and testing.

Answer

Create URL filtering profile, then apply the profile to a security policy, then configure SSL decryption, then test and verify.

Answer

Configure SSL decryption, then apply the profile to a security policy, then create URL filtering profile, then test and verify.

Answer

Test and verify, then create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy.

Question 6

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

Accepted Answer

The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.. App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Answer

The firewall is not connected to the cloud for App-ID updates.

Answer

Decryption is not enabled for Google Drive traffic.

Answer

An application override is configured for Google Drive.

Question 7

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

Accepted Answer

Create a decryption exclusion rule for financial and banking websites.. Excluding financial and banking websites from SSL decryption reduces the processing load on the firewall, alleviating performance degradation while still maintaining security for most outbound traffic. These websites typically use high-grade encryption and are trusted, so decryption is unnecessary and can cause performance issues. Option B is incorrect because increasing session timeouts does not reduce decryption processing overhead. Option C is incorrect because hardware SSL decryption offloading may not be supported on all models or may not fully address the performance impact of decrypting all traffic. Option D is incorrect because requiring only high-strength ciphers increases processing overhead, worsening performance.

Answer

Increase the session timeout values for decrypted traffic.

Answer

Enable hardware SSL decryption offloading on the firewall.

Answer

Change the decryption profile to require only high-strength ciphers.

Question 8

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.

Question 9

A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?

Accepted Answer

IP Netmask. For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.

Answer

FQDN

Answer

IP Wildcard Mask

Answer

IP Range

Question 10

An organization has a security policy that requires all outbound HTTP traffic from the 'Corporate' zone to the 'Internet' zone to be inspected by the URL Filtering profile. However, the administrator notices that some users can still access blocked categories. What is the most likely cause?

Accepted Answer

The URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories.. If the URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories, the firewall will log the violation but still allow the traffic to pass. This means users can access blocked categories even though the rule is correctly applied, as the profile does not enforce a blocking action.

Answer

The firewall is configured to use DNS sinkholing, which bypasses URL filtering.

Answer

The rule is placed too low in the rulebase and a higher rule allows traffic without URL filtering.

Answer

The rule uses a source zone of 'Corporate' but the users are in a different zone.

Question 11

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

Accepted Answer

Source NAT (Outbound). Source NAT (Outbound). Source NAT translates the source IP address of internal hosts to a public IP address when traffic goes out to the Internet, effectively hiding internal IP addresses. Option B (Dynamic IP and Port) is a type of source NAT that also hides addresses, but it is a specific method, not the broad category. Option C (Destination NAT) translates destination IP addresses for inbound traffic, not outbound. Option D (Static NAT) provides a one-to-one mapping and does not hide the internal IP because the translation is fixed and often bidirectional.

Answer

Dynamic IP and Port (DIPP)

Answer

Destination NAT

Answer

Static NAT

Question 12

A PA-5250 firewall is experiencing high CPU usage on the dataplane. Analysis shows that a large amount of traffic is being processed by the application identification engine. What can be done to reduce the CPU load?

Accepted Answer

Create security rules that use application-based policies to allow trusted applications without additional inspection.. Creating security rules that use application-based policies to allow trusted applications without additional inspection reduces CPU load because the firewall can skip deep packet inspection for those applications once identified. This offloads processing from the application identification engine by allowing traffic based on application signatures rather than performing full identification on every packet. In contrast, disabling application identification globally would break security policy enforcement, and increasing logging or changing the default rule would not reduce the CPU burden from application identification.

Answer

Disable application identification globally.

Answer

Increase logging to debug which applications are being processed.

Answer

Change the default rule to allow all traffic based on port only.

Question 13

A security administrator is troubleshooting a policy misconfiguration. The firewall is configured with a security rule that allows traffic from the 'Engineering' zone to the 'Servers' zone. However, traffic from an Engineering user to a server in the 'DMZ' zone is being denied. What is the most likely cause?

Accepted Answer

The rule only allows traffic from Engineering to Servers zone, not DMZ.. The security rule explicitly permits traffic from the 'Engineering' zone to the 'Servers' zone. Traffic destined to the 'DMZ' zone is a different zone, so the rule does not apply. By default, Palo Alto Networks firewalls enforce a deny-all policy for any traffic that does not match an explicit allow rule, which is why the traffic is denied.

Answer

The rule is configured as an intrazone rule.

Answer

The rule is disabled in the rulebase.

Answer

SSL decryption is blocking the traffic.

Question 14

Which TWO are capabilities of Content-ID? (Choose two.)

Accepted Answer

Blocking files by type (e.g., .exe, .pdf).. Content-ID is a Palo Alto Networks technology that extends App-ID by inspecting the actual content of traffic. It includes a file blocking capability that can block files by type (e.g., .exe, .pdf) based on the file's signature, not just its extension, providing granular control over file transfers. This is a core feature of Content-ID for data filtering.

Answer

Identifying the application regardless of port.

Answer

Applying QoS policies to applications.

Question 15

Refer to the exhibit. A user on the Trust zone is trying to download a file from an FTP server on the Untrust zone using FTP on TCP port 21. The firewall's security policy is as shown. What will happen?

Accepted Answer

The traffic is denied by the 'Block-FTP' rule.. The security policy explicitly includes a rule named 'Block-FTP' that denies FTP traffic. FTP uses TCP port 21 for control traffic, and the firewall matches this traffic against the policy rules in order. Since 'Block-FTP' matches the FTP application (or port 21) and denies it, the traffic is blocked before reaching any implicit deny rule.

Answer

The traffic is denied by the implicit deny rule at the end.

Answer

The traffic is allowed because 'Allow-Web' matches web-browsing over port 80 or 443.

Answer

The traffic is allowed because no rule explicitly blocks it.