PCNSA Practice Test 32 — 15 Questions

Question 1

A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?

Accepted Answer

443. The correct answer is B (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.

Answer

80

Answer

22

Answer

8080

Question 2

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

Accepted Answer

Verify the SNMP community string and allowed management IPs in the SNMP server profile. The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Answer

Check that the SNMP manager supports SNMPv3

Answer

Verify that the firewall's management IP is reachable from the SNMP manager

Answer

Ensure the SNMP manager is running on the same subnet as the firewall

Question 3

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Accepted Answer

Apply the log forwarding profile to a security policy rule.. Option A is correct because a log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Answer

Set the syslog server to use TCP port 514.

Answer

Specify the syslog facility code in the log forwarding profile.

Question 4

A company uses Panorama to manage multiple device groups. They want to push a set of global security policies to all firewalls. Where should the administrator configure these policies in Panorama?

Accepted Answer

As pre-rules in the 'shared' device group. In Panorama, the 'shared' device group is designed for policies that must apply globally across all managed firewalls. Configuring security policies as pre-rules in the shared device group ensures they are evaluated before any device-group-specific rules, providing a consistent global baseline that cannot be overridden by local rules.

Answer

As pre-rules in each regional device group

Answer

In the default rule base of each device group

Answer

As post-rules in the 'shared' device group

Question 5

Which object type is used to group multiple service objects together for use in a security policy?

Accepted Answer

Service group. A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Answer

Schedule

Answer

Tag

Answer

Address group

Question 6

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Accepted Answer

Address. To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Answer

Schedule

Answer

Service

Answer

Tag

Question 7

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

Accepted Answer

Application. The correct answer is D because the question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Answer

Region

Answer

Address

Answer

Service

Question 8

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Option D is correct because Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 9

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Answer

Device groups

Answer

Shared policy

Answer

Template stacks

Question 10

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

Accepted Answer

Address group. Option D is correct because an address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.

Answer

Tag

Answer

Schedule

Answer

Service group

Question 11

How many address objects are members of the 'web-servers' address group?

Accepted Answer

2. The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.

Answer

3

Answer

1

Answer

4

Question 12

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

Accepted Answer

The EDL cache time is set higher than the refresh interval. The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Answer

The EDL URL is invalid

Answer

The EDL is not registered as a dynamic list

Answer

The firewall's DNS resolution fails

Question 13

Based on the log excerpt, which object is used for the destination address?

Accepted Answer

Address 'any'. The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.

Answer

Zone 'untrust'

Answer

Application 'web-browsing'

Answer

Service 'service-http'

Question 14

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Accepted Answer

Schedule. Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.

Answer

User

Answer

Application group

Question 15

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

Accepted Answer

The address object has multiple tags including the wrong one. Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Answer

The group is configured as static

Answer

The dynamic group uses 'match all' and the object lacks some tags

Answer

The administrator added the object directly to the group

PCNSA Practice Test 32 — 15 Questions

Exhibit

PCNSA Practice Test 32 — 15 Questions

Exhibit