PCNSA Practice Test 31 — 15 Questions

Question 1

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Troubleshooting > Generate Tech Support File. The Palo Alto Networks firewall GUI provides a dedicated path under Device > Troubleshooting > Generate Tech Support File to generate and download a comprehensive technical support file. This file bundles logs, configuration, and system state data essential for troubleshooting.

Answer

Using the CLI command 'save config to tftp'

Answer

Using the GUI under Monitor > Packet Capture

Answer

Using the CLI command 'show tech-support'

Question 2

Which THREE of the following are valid features of Palo Alto Networks active/passive HA?

Accepted Answer

Session synchronization from active to passive.. In Palo Alto Networks active/passive HA, session state information is synchronized from the active firewall to the passive firewall. This ensures that when a failover occurs, the passive device can take over with minimal disruption, maintaining existing sessions without requiring clients to re-establish connections.

Answer

Prevention of link monitoring on passive device.

Answer

Load sharing of traffic between both devices.

Question 3

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Accepted Answer

Deny the traffic because rule 2 matches and denies social-networking.. The firewall evaluates rules in order from top to bottom. Rule 2 explicitly denies the application 'social-networking', and since the user at 192.168.1.10 is attempting to access a social-networking site, rule 2 matches before any subsequent rule. Therefore, the traffic is denied. Option D is correct because rule 2 matches and denies the traffic.

Answer

Allow the traffic because rule 1 matches and allows all web traffic.

Answer

Allow the traffic because rule 3 allows all traffic.

Answer

Deny the traffic because no rule allows social-networking.

Question 4

A small business uses a Palo Alto Networks PA-220 firewall. The administrator needs to create a security policy to allow inbound VPN connections from remote employees using IPsec. The remote employees connect using dynamic IP addresses. The administrator creates an address object "Remote-VPN-Users" of type "IP Range" but that doesn't work because the IPs are not known. What address object type should be used instead?

Accepted Answer

Any (0.0.0.0/0). When remote employees connect using dynamic IP addresses, the source IP is unknown and cannot be defined by a static address object. Using 'Any' (0.0.0.0/0) as the source address in the security policy allows the firewall to accept IPsec VPN traffic from any source IP, which is necessary for clients with dynamic addresses. This is a common practice for remote access VPN configurations where the peer IP is not predetermined.

Answer

IP Netmask

Answer

FQDN

Answer

IP Wildcard Mask

Question 5

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

Accepted Answer

Asymmetric routing. The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Answer

Application override configured for HTTP

Answer

DNS resolution failure

Answer

NAT policy mismatch

Question 6

An organization uses GlobalProtect for remote access. Users report that they cannot connect to the portal. The firewall's GlobalProtect portal configuration is correct, and the firewall has a valid certificate. What is the most likely cause of the issue?

Accepted Answer

The firewall's external interface does not have a security policy rule allowing HTTPS traffic to the portal IP.. The most likely cause is that the firewall's external interface lacks a security policy rule permitting HTTPS (TCP/443) traffic to the GlobalProtect portal IP. Even with correct portal configuration and a valid certificate, the firewall will drop the client's connection attempt if no rule explicitly allows inbound HTTPS traffic to the portal's IP address. This is a common oversight when deploying GlobalProtect remote access.

Answer

The authentication profile is set to RADIUS but the RADIUS server is unreachable.

Answer

The certificate is self-signed and not trusted by the client.

Answer

The GlobalProtect gateway is not configured with a matching tunnel interface.

Question 7

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Accepted Answer

Rule 1: source-nat-1. Rule 1 matches first because the source 10.0.0.5 falls within the source range (10.0.0.0/8) and the destination 8.8.8.8 is not excluded by the exception rule (which only excludes 192.168.1.0/24). Therefore, Rule 1 is applied and performs source NAT to the interface IP. Option A is incorrect because Rule 2 is a no-NAT rule that would only apply if the destination matched 192.168.1.0/24, which it does not. Option B is incorrect because only the first matching rule is applied; NAT rules are processed in order. Option C is incorrect because Rule 1 does match.

Answer

Rule 2: no-nat-for-servers

Answer

Both rules are applied.

Answer

No NAT rule matches; traffic is not translated.

Question 8

A security administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The Phase 1 proposal includes AES-256, SHA-256, and DH Group 14 with a lifetime of 28800 seconds. The Phase 2 proposal includes AES-256, SHA-256, and PFS with DH Group 14. The tunnel is established and traffic is flowing, but intermittently the tunnel drops and re-establishes. The logs show the following error: 'Phase 2 negotiation failed because no suitable proposal found.' Both firewalls have IKE gateway and IPsec crypto profile configurations that match for encryption, authentication, and DH groups. Which option is the most likely cause of this issue?

Accepted Answer

The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.. The error 'Phase 2 negotiation failed because no suitable proposal found' occurs when the IPsec SA parameters do not match during rekey. Although both firewalls have matching IKE gateway and IPsec crypto profiles for encryption, authentication, and DH groups, the IPsec SA lifetime is a separate parameter that might not be identical if not explicitly configured. If one firewall has a different default lifetime or an explicitly configured different lifetime, the mismatch causes rekey failures. This is the most likely cause because the tunnel initially establishes but fails intermittently when the lifetime timer expires and renegotiation occurs.

Answer

The DH group used in Phase 2 is not supported by the firewall model.

Answer

The Phase 2 proposal uses a different DH group than Phase 1.

Answer

The Phase 1 lifetime is shorter than the Phase 2 lifetime.

Question 9

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

Accepted Answer

Consolidate rules using Security Profile Groups (SPGs) and broader application groups.. Consolidating rules using Security Profile Groups (SPGs) and broader application groups reduces rule count while maintaining visibility. SPGs allow multiple rules to share the same security profiles, reducing duplication, and application groups bundle related applications to minimize rule entries. Option A is incorrect as using default ports bypasses App-ID, losing application visibility. Option B is incorrect because converting to service objects removes application visibility and does not reduce rule count. Option D is incorrect; placing specific rules at the top does not reduce rule count—it only affects rule matching order.

Answer

Use only default ports for services to avoid creating service objects.

Answer

Convert all application-based rules to use service objects instead.

Answer

Place the most specific rules at the top of the rulebase.

Question 10

A network administrator is designing a Palo Alto Networks firewall deployment for a large enterprise with multiple branch offices. The requirement is to ensure that if the primary firewall at headquarters fails, the branch offices can still access the internet via a local breakout using a redundant firewall at the branch. Which architecture best meets this requirement with minimal complexity?

Accepted Answer

Deploy active/passive HA at headquarters and active/passive HA at each branch with local internet breakout. Deploying active/passive HA at each branch with local internet breakout ensures that if the primary firewall at headquarters fails, branch offices can still access the internet directly through their redundant firewall without relying on the hub. This design minimizes complexity by using simple HA pairs and local breakout policies, avoiding the need for complex routing or full mesh VPNs.

Answer

Use a hub-and-spoke VPN topology with headquarters as the hub

Answer

Use a full mesh VPN topology between all firewalls

Answer

Deploy active/active HA at headquarters and use IPsec VPN tunnels to each branch

Question 11

Refer to the exhibit. A packet arrives with source IP 192.168.1.10, destination IP 203.0.113.10, destination port 80, from zone trust. After this NAT rule is applied, what will be the destination IP and port of the packet?

Accepted Answer

Destination IP 10.0.0.5, Destination port 80. This is a destination NAT (DNAT) rule that translates the destination IP from 203.0.113.10 to 10.0.0.5, while leaving the destination port unchanged at 80. The source IP and port are not affected by this rule; no source NAT is configured. Option A is incorrect because the source IP is not changed. Option B is incorrect because the destination port is not changed to 8080. Option C is incorrect because the source port is not modified.

Answer

Destination IP 10.0.0.5, Destination port 80, Source IP changed to firewall IP

Answer

Destination IP 203.0.113.10, Destination port 8080

Answer

Destination IP 203.0.113.10, Destination port 80, Source port changed to 5000

Question 12

Match each log type to its description.

Accepted Answer

Traffic: Logs of all network traffic sessions. Common mistakes involve confusing System logs (configuration changes, system events) with WildFire Submissions logs (files sent for analysis). Traffic, Threat, and URL Filtering logs are correctly matched to their standard definitions.

Answer

WildFire Submissions: Logs of system events

Answer

System: Logs of files submitted for malware analysis

Question 13

A security administrator notices that traffic from an internal user to a specific external web application is being blocked unexpectedly. The user's IP is 10.10.1.50 and the destination is 203.0.113.5 on port 443. The administrator has already verified that there is a security rule allowing the traffic. Which two logs should the administrator check first to diagnose the issue?

Accepted Answer

Check the Traffic log and the URL Filtering log.. Even if a security rule explicitly allows traffic, secondary policies such as URL filtering can block the session. The Traffic log shows whether the session was allowed or denied, and the URL Filtering log reveals if the destination URL was blocked by a URL filtering profile. Option B is also correct because Intrusion Prevention System (IPS) / Threat Prevention signatures applied via a Security policy rule can block traffic that would otherwise be allowed. The Threat log records any such signature matches that resulted in blocking. Therefore, the administrator should check both the Traffic log and URL Filtering log (A) and the Threat log (B) first to diagnose the unexpected blocking.

Answer

Check the System log for configuration changes that might have added a rule.

Answer

Check the HIP Match log to see if the user's device lacks required security software.

Question 14

Refer to the exhibit. A security analyst reviews a traffic log entry in JSON format. Which firewall feature is responsible for including the 'user' field in the log?

Accepted Answer

User-ID. The 'user' field in a traffic log is populated by User-ID, which maps IP addresses to usernames by monitoring authentication events from Active Directory, LDAP, or terminal services agents. This allows the firewall to log and enforce policies based on user identity rather than just IP addresses.

Answer

Data Filtering

Answer

Captive Portal

Answer

GlobalProtect

Question 15

A security administrator wants to block traffic from a specific country using the firewall. How can this be achieved with minimal administrative overhead?

Accepted Answer

Create a security rule with a source region of the specified country.. Palo Alto Networks firewalls include a built-in Geolocation database that maps IP addresses to countries. By creating a security rule with the source region set to the specific country, the firewall automatically applies the block without requiring manual IP management or external feeds, minimizing administrative overhead.

Answer

Configure an External Dynamic List (EDL) and reference it in a rule.

Answer

Manually add all IP subnets from that country to a block rule.

Answer

Disable routing to that country through the firewall.