PCNSA Practice Test 30 — 15 Questions

Question 1

A network administrator is troubleshooting a connectivity issue where users in the 192.168.1.0/24 subnet cannot reach a server at 10.0.0.10. The firewall has a rule that allows traffic from source zone 'Trust' to destination zone 'DMZ' with source address 192.168.1.0/24 and destination address 10.0.0.10. The traffic is matching the rule, but the packets are being dropped. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall does not have a route to the 10.0.0.0/24 network.. The traffic matches the security rule, but the firewall drops the packet because it cannot find a route to the destination network 10.0.0.0/24. In Palo Alto Networks firewalls, even if a security rule permits traffic, the firewall must have a valid route in its routing table to forward the packet to the next hop. Without a route, the firewall has no way to deliver the packet to the server at 10.0.0.10, resulting in a drop.

Answer

The security rule is not placed at the top of the rulebase.

Answer

A zone protection profile is blocking the traffic.

Answer

The destination server does not have a route back to the 192.168.1.0/24 subnet.

Question 2

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Accepted Answer

The firewall's CA certificate is not installed in the trusted root store on user endpoints.. SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Answer

The decryption policy uses 'No Decrypt' for the internal application's URL category.

Answer

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

Answer

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Question 3

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Best practices for SSL Forward Proxy decryption include excluding sensitive traffic to financial and healthcare sites to avoid compliance issues and performance overhead, and installing the firewall's CA certificate on all client devices to prevent certificate errors and ensure trust. Therefore, options C and E are correct. Option A is incorrect because using a self-signed certificate can cause trust issues; a CA-signed certificate is recommended. Option B is incorrect because decrypting all internal traffic, including server-to-server, can create unnecessary overhead and privacy concerns. Option D is incorrect because decrypting all outbound traffic without exclusions can lead to performance degradation and legal issues.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 4

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Accepted Answer

Enable Session Setup and State Synchronization under HA configuration. Session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Answer

Configure HA1 and HA2 interfaces with appropriate IPs

Answer

Enable Config Sync on the HA General tab

Answer

Configure Path Monitoring to detect link failures

Question 5

How many address objects are members of the 'web-servers' address group?

Accepted Answer

2. The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.

Answer

3

Answer

1

Answer

4

Question 6

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

Accepted Answer

Dataplane resources are exhausted. The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Answer

The firewall has been recently rebooted

Answer

System CPU is too high

Answer

The session limit is being reached

Question 7

Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?

Accepted Answer

Renew the decryption CA certificate before expiry. The decryption CA certificate is used by the firewall to generate and sign internal server certificates for SSL decryption. When it expires, the firewall can no longer create new decryption certificates, causing SSL decryption to fail for new sessions. Renewing the decryption CA certificate before expiry ensures uninterrupted decryption and avoids certificate validation errors for clients.

Answer

Ignore the warning as it is only informational

Answer

Import a new server certificate

Answer

Disable decryption until renewal

Question 8

A security administrator is configuring an address object for a web server accessible from the internet. The server has a public IP of 203.0.113.10/32 and a private IP of 10.0.1.10/32. The administrator needs to create a security policy that allows inbound HTTPS traffic to the server. Which address object type should be used for the destination?

Accepted Answer

IP Netmask (e.g., 203.0.113.10/32). The security policy destination must match the IP address that the firewall sees in the packet header. For inbound traffic from the internet, the destination IP is the public IP 203.0.113.10/32, so an IP Netmask object with that exact address is the appropriate type. Using a /32 netmask ensures a single host match, which is precise and efficient for firewall rule evaluation.

Answer

FQDN (e.g., webserver.example.com)

Answer

IP Range (e.g., 10.0.1.10-10.0.1.10)

Answer

IP Wildcard Mask (e.g., 203.0.113.0/0.0.0.255)

Question 9

An organization is experiencing performance degradation on their PA-5250 firewall after enabling SSL decryption for all traffic. The firewall's CPU usage is consistently above 80%. The decision is made to offload SSL decryption to a dedicated appliance. Which deployment architecture allows the Palo Alto firewall to inspect decrypted traffic while the decryption occurs elsewhere?

Accepted Answer

Configure the firewall to receive decrypted traffic from an external SSL decryptor on a specific zone.. It describes a deployment where an external SSL decryptor handles the decryption, and the Palo Alto firewall receives the already-decrypted traffic on a dedicated zone. This offloads the CPU-intensive decryption process from the firewall, allowing it to inspect the decrypted payload using its security policies without performing SSL/TLS termination itself.

Answer

Enable SSL proxy with certificate chaining to reduce CPU.

Answer

Use a decryption broker that sends decrypted traffic to the firewall via a virtual wire.

Answer

Deploy a forward proxy where the firewall decrypts and then re-encrypts.

Question 10

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. What is the most likely cause?

Accepted Answer

The custom application uses HTTP but no specific App-ID signature.. When a custom application uses HTTP but lacks a specific App-ID signature, Palo Alto Networks firewalls default to classifying the traffic as web-browsing (HTTP). App-ID relies on a combination of protocol decoders and application signatures; without a custom App-ID signature defined for the application, the firewall cannot distinguish it from generic HTTP traffic.

Answer

The application signature database is outdated.

Answer

App-ID is disabled on the security rule.

Answer

Content-ID is blocking the application.

Question 11

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 12

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

Accepted Answer

Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.. The traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Answer

Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.

Answer

Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.

Answer

Modify the rule to use application 'any' to allow all applications.

Question 13

Refer to the exhibit. A user in the trust zone attempts to access https://www.example.com. The traffic matches rule 2 first. What is the expected behavior?

Accepted Answer

The traffic is denied because of rule 2.. HTTPS traffic is identified as application ssl, which matches rule 2 (deny). Since rule 2 has no schedule, it matches immediately, and the traffic is denied. Rule 3 (allow for web-browsing) is not evaluated because rule 2 matched first. Option A is wrong because rule 2 matches. Option C is wrong because there is a deny rule. Option D is wrong because the session is not allowed; it is denied.

Answer

The traffic is allowed due to the implicit allow at the end.

Answer

The traffic is allowed because rule 3 allows web-browsing.

Answer

The traffic is allowed because no explicit deny is configured.

Question 14

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. 'No Decrypt' is a valid action in a decryption policy rule that explicitly excludes traffic from decryption, often used for traffic that cannot be decrypted (e.g., certificate pinning) or should not be inspected for compliance reasons. This action ensures the firewall forwards the traffic without attempting SSL/TLS interception.

Answer

Block

Answer

Forward

Question 15

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.