PCNSA Practice Test 2 — 30 Questions

Question 1

Which of the following is a primary benefit of using App-ID in a security policy?

Accepted Answer

It enforces policies based on the actual application, irrespective of port or encryption.. App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Answer

It allows blocking traffic based on port numbers only.

Answer

It only works for known applications.

Answer

It can only be applied to outbound traffic.

Question 2

Which two authentication methods can be used for administrative access to the firewall's web interface? (Choose two.)

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is correct because it enables single sign-on (SSO) for administrative access to the firewall's web interface, allowing integration with external identity providers (IdPs) such as Okta or Microsoft Entra ID. The local database is correct because it is the default authentication method, where administrators are created and stored locally on the firewall, and credentials are verified against the internal user database. Both methods are natively supported in PAN-OS for web interface (GUI) access.

Answer

NTLM

Answer

OAuth

Answer

Kerberos

Question 3

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 4

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.. In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry. The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Answer

OSPF is flapping and causing route instability.

Answer

A DDoS attack is overwhelming the management plane.

Answer

The firewall's licenses have expired, causing feature degradation.

Question 5

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

Accepted Answer

Dataplane resources are exhausted. The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Answer

The firewall has been recently rebooted

Answer

System CPU is too high

Answer

The session limit is being reached

Question 6

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 7

Refer to the exhibit. A security analyst reviews a traffic log entry in JSON format. Which firewall feature is responsible for including the 'user' field in the log?

Accepted Answer

User-ID. The 'user' field in a traffic log is populated by User-ID, which maps IP addresses to usernames by monitoring authentication events from Active Directory, LDAP, or terminal services agents. This allows the firewall to log and enforce policies based on user identity rather than just IP addresses.

Answer

Data Filtering

Answer

Captive Portal

Answer

GlobalProtect

Question 8

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

Accepted Answer

App-ID has not yet completed identification because the session is new or requires more packets.. When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Answer

The security rule is misconfigured because it lacks an application field.

Answer

The firewall does not have an App-ID signature for the website.

Answer

SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

Question 9

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

Accepted Answer

NAT rules are evaluated from top to bottom, and the first match is applied. Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Answer

NAT rules are evaluated after security rules

Answer

NAT rules use longest prefix match on the destination address

Answer

NAT rules cannot combine source and destination NAT in a single rule

Question 10

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Option B is correct because Palo Alto Networks evaluates security rules top-down and stops at the first match, so placing the most specific rules above broader ones ensures precise traffic handling and prevents a general rule from shadowing a narrower one. Option D is correct because the firewall tracks hit counts per rule, and periodically reviewing those counters to identify and delete rules with zero hits reduces rulebase bloat and shrinks the attack surface. Option A is not a best practice since logging every rule, including high-volume allow rules, generates excessive log traffic and storage overhead; logging should be targeted to security-relevant events. Option C is wrong because a single 'allow all' rule defeats the purpose of a least-privilege, zone-based policy and provides no visibility or control. Option E is wrong because disabling rather than removing unused rules leaves dead configuration in the rulebase, and proper hygiene calls for deletion after confirming zero hits.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 11

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. In PAN-OS, committing a candidate configuration pushes the new policy into the running configuration, but security policy evaluation happens at session setup. Existing sessions continue to be evaluated against the policy that was in force when the session was created, so users with long-lived or already-established sessions keep the old behavior while users opening new sessions get the new rule. This explains why only some users report issues after the commit.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 12

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Accepted Answer

The rule is positioned below an allow rule that matches the same traffic.. The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

Answer

The source IP is negated in the rule.

Answer

The rule is placed at the top of the rulebase and overridden by a later rule.

Answer

The rule is disabled in the rulebase.

Question 13

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 14

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

Accepted Answer

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed. For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Answer

The VLAN interface needs an IP address configured

Answer

The VLAN interface must be assigned to a virtual router

Answer

The firewall needs a commit to apply the changes

Question 15

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Accepted Answer

The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.. After a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Answer

The firewall's CPU and memory are insufficient for the new PAN-OS version.

Answer

The firewall is performing a backup of the configuration.

Answer

The rulebase has grown too large.

Question 16

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. The firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 17

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Accepted Answer

SSH Proxy. SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Answer

SSL Forward Proxy

Answer

Inbound Inspection

Answer

Decryption Mirror

Question 18

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

Accepted Answer

Use Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Answer

Use CLI scripts

Answer

Use a dedicated management server

Answer

Use SNMP

Question 19

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

SSL Inbound Inspection. SSL Inbound Inspection (C) is a valid decryption method: the firewall is configured with the server's certificate and private key so it can decrypt traffic destined to an internal server, which is the standard approach for protecting inbound connections to your own web servers. SSL Forward Proxy (E) is also valid: the firewall acts as a man-in-the-middle, generating a forged certificate signed by a trusted CA and decrypting outbound client-initiated SSL/TLS sessions to inspect them. The other options are not decryption methods for SSL/TLS: IPsec Decryption (A) applies to IPsec VPN traffic, not SSL/TLS; SSH Proxy (B) is for controlling SSH sessions, not decrypting SSL/TLS; and Decryption Mirror (D) is a feature for copying decrypted traffic to a destination for analysis, not a method to decrypt SSL/TLS itself.

Answer

IPsec Decryption

Answer

SSH Proxy

Answer

Decryption Mirror

Question 20

Users report that some internal services are not accessible when connected via VPN, but they work when on the local network. The firewall has a policy allowing all traffic from the VPN zone to the internal zone. What should the administrator check first?

Accepted Answer

Check if there are NAT rules that affect the VPN zone traffic, such as missing reverse NAT.. When internal services work on the local network but fail over VPN, and the security policy allows VPN-to-internal traffic, the most likely culprit is NAT. If the VPN zone traffic is being source-NATed (e.g., to an interface IP) or if reverse NAT is missing for return traffic, the internal servers may not have a route back or may reject the connection. Checking NAT rules affecting the VPN zone, including reverse NAT, is the first logical step.

Answer

Check if SSL decryption is breaking the traffic.

Answer

Check if the zone protection profile is dropping traffic.

Answer

Check if the security policy rule order is correct.