PCNSA Practice Test 3 — 10 Questions

Question 1

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Accepted Answer

Check the traffic log to see if the policy is matched. The first step in troubleshooting a decryption policy that is not decrypting traffic is to check the traffic log to confirm whether the policy is actually being matched. If the traffic does not match the decryption rule, no decryption will occur regardless of certificate validity or other settings. This aligns with the systematic troubleshooting approach of verifying policy application before investigating deeper configuration issues.

Answer

Verify that the decryption certificate is valid

Answer

Disable the SSL/TLS service profile

Answer

Ensure that the server's certificate is imported

Question 2

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 3

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings

Question 4

Which Palo Alto Networks subscription service provides real-time threat intelligence about unknown files and links?

Accepted Answer

WildFire. WildFire is the correct answer because it is Palo Alto Networks' cloud-based threat analysis service specifically designed to detect and block unknown malware, zero-day exploits, and advanced persistent threats. It analyzes files and links in a sandboxed environment, correlating behavioral indicators with real-time threat intelligence to generate signatures that protect the entire network.

Answer

URL Filtering

Answer

DNS Security

Answer

Threat Prevention

Question 5

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Accepted Answer

Enable Session Setup and State Synchronization under HA configuration. Session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Answer

Configure HA1 and HA2 interfaces with appropriate IPs

Answer

Enable Config Sync on the HA General tab

Answer

Configure Path Monitoring to detect link failures

Question 6

What is the purpose of the 'Telemetry' feature in PAN-OS?

Accepted Answer

To send anonymous device health and usage data to Palo Alto Networks. The Telemetry feature in PAN-OS sends anonymous device health and usage data to Palo Alto Networks to help improve product development and threat detection. This data includes information such as system resource utilization, feature usage statistics, and aggregate threat information, but does not include sensitive or personally identifiable information. It is an opt-in feature that enhances Palo Alto Networks' ability to provide proactive support and security updates.

Answer

To send logs to Panorama

Answer

To enable DNS proxy

Answer

To configure User-ID agent

Question 7

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Accepted Answer

Pattern matching (signatures). App-ID identifies applications primarily through pattern matching (signatures) (D), which inspects packet payloads against a database of application-specific signatures to recognize known applications, and protocol decoding (E), which decodes the application-layer protocol to understand its behavior and enforce policy even when traffic is encrypted or evasive. These two techniques are the core detection mechanisms Palo Alto Networks documents for App-ID, working alongside behavioral heuristics and decryption. URL filtering (A) is a separate security profile that controls web access by category, not an App-ID identification method. Source port number (B) and source IP address (C) are Layer 3/4 header attributes used in traditional firewall rules, not application identification techniques.

Answer

URL filtering

Answer

Source port number

Answer

Source IP address

Question 8

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

Accepted Answer

Data Filtering. Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Answer

URL Filtering

Answer

File Blocking

Answer

WildFire

Question 9

Which THREE are default security profile groups in PAN-OS? (Choose three.)

Accepted Answer

Strict. In PAN-OS, the predefined Security Profile Groups are Strict, Alert, and Best Practice, so options A, C, and E are correct. The Strict group (A) applies aggressive block/drop actions across Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and WildFire profiles, making it suitable for high-security enforcement. The Alert group (C) is designed for monitoring rather than blocking, using alert/allow actions so administrators can observe traffic before enforcing policy. The Best Practice group (E) bundles Palo Alto Networks-recommended settings for each profile type to provide balanced, vendor-recommended protection. Option B (Server) is not a default profile group; it is a common custom grouping name, and option D (Custom) is merely a label for user-created groups, not a predefined PAN-OS default.

Answer

Server

Answer

Custom

Question 10

During troubleshooting, an administrator needs to review firewall system events such as user logins, configuration changes, and commit failures. Which log type should be examined?

Accepted Answer

System logs. System logs in Palo Alto Networks firewalls capture administrative and system-level events, including user logins, configuration changes, and commit failures. These logs are generated by the management plane and are essential for auditing and troubleshooting device management activities.

Answer

Threat logs

Answer

Traffic logs

Answer

URL filtering logs