PCNSA Practice Test 32 — 15 Questions

Question 1

A medium-sized enterprise recently deployed a pair of PA-5250 firewalls in an active/passive high-availability configuration. The network team notices that after a failover event, the new active firewall does not pass any traffic for about 30 seconds, even though the session table is synchronized. Users report that existing connections break and need to be re-established. The firewall is configured to use session state synchronization and failover triggers based on link state and ping to the next-hop gateway. Which action should the administrator take to minimize traffic disruption during failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure asymmetric path bypass on the high-availability settings.. Asymmetric path bypass allows the new active firewall to accept and forward packets for existing sessions even before the session table is fully synchronized or the routing converges. In an active/passive HA pair, after failover, the new active firewall may receive packets for flows that were originally processed by the previous active unit; without asymmetric path bypass, these packets are dropped because the firewall does not recognize them as part of an existing session. Enabling this feature ensures that the firewall temporarily bypasses session lookup for such packets, reducing the 30-second traffic blackout.

Answer

Increase the packet buffer size on the firewall to handle burst traffic.

Answer

Reduce the hold timer for path monitoring to the next-hop gateway.

Answer

Enable preemptive mode for the active/passive HA pair.

Question 2

Which three of the following are valid commit options in the PAN-OS GUI? (Choose three.)

Accepted Answer

Validate commit. The PAN-OS GUI provides a 'Validate commit' option that checks the configuration for errors before applying it. This is a standard commit option that ensures the candidate configuration is syntactically and semantically valid, reducing the risk of committing a broken configuration.

Answer

Force commit

Answer

Commit to Panorama

Question 3

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

Accepted Answer

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed. For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Answer

The VLAN interface needs an IP address configured

Answer

The VLAN interface must be assigned to a virtual router

Answer

The firewall needs a commit to apply the changes

Question 4

A security engineer must ensure that all traffic from a specific branch office to the internet is inspected by the company's Palo Alto firewall before reaching the internet. However, the branch office has a local router that routes directly to the ISP. What architectural change is required to enforce this?

Accepted Answer

Route all traffic from the branch to the hub site through a VPN tunnel where the firewall is located.. It describes a hub-and-spoke VPN topology where all branch office traffic is tunneled to a central hub site that hosts the Palo Alto firewall. This ensures the firewall can inspect all outbound traffic before it reaches the internet, bypassing the branch's direct ISP route. The VPN tunnel (e.g., IPsec) forces traffic through the firewall at the hub, providing centralized security enforcement without requiring a local firewall at the branch.

Answer

Use global VPN to backhaul all traffic to the data center.

Answer

Install a Palo Alto firewall at the branch office and configure policy-based forwarding.

Answer

Configure NAT on the branch router to force traffic through the firewall.

Question 5

Two Palo Alto Networks firewalls are configured in an active/passive high-availability pair. During a failover event, the passive firewall becomes active but the session table is empty. What is the most likely cause?

Accepted Answer

Session synchronization is not configured. In an active/passive high-availability pair, session synchronization must be explicitly configured to replicate session state from the active firewall to the passive firewall. Without this configuration, the passive firewall has no session table when it becomes active, causing all existing connections to be dropped. This is the most direct cause of an empty session table after failover.

Answer

The preemptive mode is disabled

Answer

Heartbeat failure caused the failover to be incomplete

Answer

The sessions timed out during the failover

Question 6

An administrator is configuring active/passive HA for two PA-3020 firewalls. Which TWO conditions would trigger a failover? (Choose two.)

Accepted Answer

Path monitoring detects unreachable target. Path monitoring actively probes a target IP address (e.g., a next-hop router) using ICMP or ARP. If the target becomes unreachable, the firewall considers the network path failed and triggers a failover to the passive unit, ensuring traffic continuity even if the control plane is healthy.

Answer

Active firewall CPU usage exceeds 80%

Answer

Active firewall's power supply failure

Answer

Passive firewall loses connectivity to management network

Question 7

An organization has multiple virtual routers on a single firewall. Traffic between two virtual routers must be inspected by security policies. How should this be configured?

Accepted Answer

Place each virtual router's interfaces into different zones, then create inter-zone security rules.. Inter-zone security rules are required to enforce security policies on traffic between different virtual routers. Each virtual router's interfaces must be assigned to distinct zones, and inter-zone rules inspect traffic crossing from one zone to another, ensuring the firewall applies security controls (e.g., App-ID, User-ID) to the traffic between the virtual routers.

Answer

Configure static routes between the virtual routers.

Answer

Enable inter-virtual router routing under the global settings.

Answer

Apply security policies that match the virtual router as a source or destination.

Question 8

An administrator sees this log repeatedly. Which configuration change will allow 10.0.0.1 to access the management interface?

Accepted Answer

Add 10.0.0.1 to the allowed IP list in the management profile. The log indicates that the management interface is rejecting access attempts from 10.0.0.1 due to an IP-based access restriction. By adding 10.0.0.1 to the allowed IP list within the management profile, the administrator explicitly permits that host to reach the management interface, resolving the repeated denial.

Answer

Enable HTTP on the management interface

Answer

Disable management access restriction

Answer

Change the management interface to a different IP

Answer

Create a security policy allowing HTTP from 10.0.0.1

Question 9

A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?

Accepted Answer

The firewall's decryption certificate is not signed by the installed root CA.. In forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.

Answer

The decryption profile is set to block sessions with untrusted certificates.

Answer

The firewall is performing inbound inspection instead of forward proxy.

Answer

No decryption profile is attached to the decryption rule.

Question 10

Refer to the exhibit. An administrator wants to block all traffic that does not match a specific application (e.g., only allow 'web-browsing'). What should be done?

Accepted Answer

Change action to 'deny' and create a new rule with application ['web-browsing'] above it.. To enforce an allow-list approach for a specific application like 'web-browsing', you must first create a rule that denies all traffic (action 'deny') and then place a higher-priority rule above it that explicitly allows only 'web-browsing'. This ensures that any traffic not matching the allowed application is blocked by the default-deny rule, leveraging App-ID's ability to identify applications regardless of port or protocol.

Answer

Use a file blocking profile.

Answer

Change application to ['unknown-tcp', 'unknown-udp'].

Answer

Change category to ['misccategory'].

Question 11

Which TWO of the following are required to configure a site-to-site VPN using IKEv2 on Palo Alto Networks firewalls? (Choose TWO.)

Accepted Answer

An IKE gateway configuration. For a site-to-site VPN using IKEv2 on Palo Alto Networks firewalls, an IKE gateway configuration (options A) is required to define the peer and authentication parameters, and a tunnel interface with a valid IP address (option C) is required for the IPSec tunnel. A pre-shared key or certificate (option B) is indeed necessary but is part of the IKE gateway configuration, so it is not a separate required component when choosing two.

Answer

A pre-shared key or certificate for authentication

Answer

A loopback interface for the VPN gateway

Answer

A dedicated virtual router for the VPN

Question 12

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Define separate security zones for Engineering and Finance.. Security zones are the fundamental building blocks for segmenting traffic in Palo Alto Networks firewalls. By placing Engineering and Finance interfaces into separate zones, you create a trust boundary that allows you to enforce inter-zone security rules. Option E is correct because applying Threat Prevention profiles (e.g., antivirus, anti-spyware, vulnerability protection) to the inter-zone rule enables the firewall to inspect and block malicious traffic between the segmented departments.

Answer

Configure NAT policies to translate internal addresses.

Answer

Create a single security zone for all internal traffic.

Answer

Enable QoS policies between the zones.

Question 13

Match each protocol to its default port used by Palo Alto Networks.

Accepted Answer

HTTPS: 443. The correct matches are HTTPS:443, SSH:22, and HTTP:80. Common confusions include swapping ports between HTTPS and SSH or HTTP, as all are used for management access.

Answer

HTTPS: 22

Answer

SSH: 80

Answer

HTTP: 443

Question 14

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

Accepted Answer

Address group. An address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.

Answer

Tag

Answer

Schedule

Answer

Service group

Question 15

What is the primary benefit of using Content-ID in a security policy?

Accepted Answer

It enables threat prevention and file blocking on allowed applications.. Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Answer

It blocks malicious URLs.

Answer

It prioritizes traffic for specific applications.

Answer

It identifies applications regardless of port.