PCNSA Practice Test 3 — 10 Questions

Question 1

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The internal interface (ethernet1/2) is administratively down. The exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 2

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 3

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Accepted Answer

The traffic will be denied by the implicit deny rule because the application does not match.. The security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it. Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Answer

The traffic will be allowed if the user uses HTTP instead.

Answer

The traffic will be allowed because the rule has log-start enabled.

Answer

The traffic will be allowed because the source and destination zones match.

Question 4

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Policy Optimizer requires a valid support license to access the cloud-based service that analyzes rules. Options A, C, and D are not prerequisites; Policy Optimizer can analyze any rule regardless of security profiles, logging settings, or hit count rank.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 5

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Accepted Answer

Configure Panorama to collect logs.. Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Answer

Use the CLI command 'show log traffic'.

Answer

Use SNMP to retrieve logs.

Answer

View logs in the Monitor tab.

Question 6

A company deploys a Palo Alto Networks firewall in a cloud environment using the VM-Series. The firewall must scale to handle traffic spikes. Which architectural approach provides the best elasticity and management simplicity?

Accepted Answer

Use a VM-Series firewall with auto-scaling group and integration with Panorama.. Using a VM-Series firewall with an auto-scaling group and integration with Panorama provides the best elasticity and management simplicity. Auto-scaling dynamically adjusts the number of firewall instances based on traffic load, while Panorama centralizes configuration, policy management, and monitoring, eliminating the need for manual per-instance management. This approach aligns with cloud-native principles for scaling and operational efficiency.

Answer

Deploy multiple VM-Series firewalls in active/active HA with a virtual load balancer.

Answer

Use a single large VM-Series instance.

Answer

Combine physical and virtual firewalls with a shared configuration.

Question 7

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 8

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

Accepted Answer

The application filter must specify the parent application 'facebook' because 'facebook-base' is a sub-application.. In Panorama, application filters require the parent application name when filtering by sub-application. 'facebook-base' is a sub-application of 'facebook', so the correct filter should be '(app eq facebook) (subapp eq facebook-base)'. Option A correctly identifies that the filter must specify the parent application. Option B is incorrect because Panorama supports both scheduled and ad-hoc queries. Option C is incorrect because the report template does not need to be committed to a device group; reports are run independently. Option D is incorrect because log forwarding to Panorama is configured in the log forwarding profile, but the port is not the issue; the logs are already forwarded.

Answer

Panorama only supports scheduled reports, not ad-hoc queries.

Answer

The report template is not committed to the device group.

Answer

The firewall's log forwarding profile must be set to send logs to Panorama on a separate port.

Question 9

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 10

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Accepted Answer

The traffic is being dropped due to a security policy rule that denies the traffic. If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer

The traffic is intra-zone, not inter-zone

Answer

The firewall is using hardware offload for fast-path processing

Answer

The packet is part of an existing session that has not timed out