PCNSA Practice Test 33 — 15 Questions

Question 1

A company has multiple branch offices connected via IPsec tunnels to a central datacenter. The central datacenter has a PA-5250 running PAN-OS 10.1. The security team wants to enforce that traffic between branches is inspected by the central firewall, not directly between branches. They configure security policies to allow inter-branch traffic through the central firewall. However, they notice that traffic between two branches (Branch A and Branch B) is not traversing the central firewall and is instead going directly between the branches via the IPsec tunnels which are configured as route-based VPNs. The security team has verified that the security policies are correctly configured to require the traffic to go through the central datacenter. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route-based VPN tunnels are using static routes that are more specific than the routes advertised by the central firewall.. The most likely cause is that the route-based VPN tunnels between branches use static routes with a more specific prefix (e.g., /24) than the routes advertised by the central firewall (e.g., /16). In route-based VPNs, the firewall makes forwarding decisions based on the routing table; more specific routes have a higher priority regardless of administrative distance or metric. Therefore, Branch A's traffic destined for Branch B matches the more specific static route pointing directly to Branch B's IPsec tunnel, bypassing the central firewall despite security policies requiring inspection.

Answer

The IPsec tunnel between branches is configured with a higher metric than the tunnel to the central firewall.

Answer

The security policy rules are not in the correct order; a rule allowing direct traffic is matched first.

Answer

The route-based VPN tunnels between branches are in the same virtual router and have a higher administrative distance than the central tunnel, causing a routing loop.

Question 2

An administrator wants to view logs related to decryption failures. Which log type should they use?

Accepted Answer

Traffic logs. Traffic logs capture all session-level events, including decryption failures, because they record the action taken by the firewall (e.g., 'decrypt', 'no-decrypt', or 'decrypt-error'). When decryption fails due to issues like certificate validation errors, unsupported cipher suites, or handshake failures, the firewall logs the session as a traffic log entry with a specific reason code. This makes Traffic logs the correct source for troubleshooting decryption failures.

Answer

Threat logs

Answer

URL Filtering logs

Answer

System logs

Question 3

A large enterprise uses Palo Alto Networks firewalls with SSL Forward Proxy to inspect all HTTPS traffic (port 443) from internal users. Recently, users have reported slow web browsing and intermittent failures when accessing certain financial and healthcare websites. The firewall's dataplane CPU consistently reaches 85-95% during business hours. The decryption policy is configured with a single rule that decrypts all outbound HTTPS traffic using the default SSL Forward Proxy settings. The firewall is a PA-5250 with ample license capacity. What should the administrator do to resolve the performance issues while maintaining security posture?

Accepted Answer

Implement decryption exclusion rules for financial and healthcare websites.. Financial and healthcare websites often use certificate pinning or require specific cipher suites that may not be compatible with the firewall's default SSL Forward Proxy settings. By excluding these sites from decryption, the administrator reduces the decryption load on the dataplane CPU and avoids breaking connectivity to sensitive sites, while still decrypting the majority of HTTPS traffic to maintain security posture.

Answer

Increase the maximum number of concurrent SSL sessions allowed.

Answer

Disable decryption for high-bandwidth websites such as video streaming services.

Answer

Enable hardware acceleration for SSL decryption.

Question 4

Refer to the exhibit. A user at 10.0.0.5 is accessing https://internal-server (192.168.1.50:443). The administrator wants to decrypt this traffic but notices it is not being decrypted. What is the most likely reason?

Accepted Answer

The security policy order is incorrect; POL-1 matches the traffic first and disables decryption.. The session matches the destination 192.168.1.50, which is within the destination range of POL-2 (192.168.1.0/24) and has decrypt action forward-proxy. However, the session is matching POL-1 first because security policies are evaluated top-down. POL-1 has no-decrypt and matches all destinations, so the traffic hits POL-1 and is not decrypted.

Answer

The user's IP is not in the source range of POL-2.

Answer

The application is not correctly identified as SSL.

Answer

The decryption policy is not configured for the destination.

Question 5

An administrator needs to back up the firewall configuration before making changes. Which method creates a complete backup that can be restored to the same or a different firewall?

Accepted Answer

Use the 'Device > Setup > Operations > Export named configuration snapshot' and select 'running-config.xml'. Exporting the running-config.xml via 'Device > Setup > Operations > Export named configuration snapshot' creates a complete XML backup of the entire running configuration. This file can be imported and restored to the same or a different firewall of the same model and PAN-OS version, ensuring full recovery of all settings, including network, policy, and object configurations.

Answer

Use the 'Device > Setup > Operations > Save named configuration snapshot' option

Answer

Use the 'Save Candidate Config' option in the GUI

Answer

Use the CLI command 'show config running' and copy the output

Question 6

A company is expanding its network and needs to add a new data center. The two data centers will be connected via a WAN link. To protect the traffic between data centers, the security team wants to use site-to-site VPNs. Which Palo Alto Networks feature is used to route traffic between VPN tunnels and security zones?

Accepted Answer

Virtual routers. Virtual routers are the correct feature because they function as Layer 3 routing instances within Palo Alto Networks firewalls, enabling the routing of traffic between VPN tunnels (which terminate on tunnel interfaces) and security zones. When a site-to-site VPN is configured, the tunnel interface is assigned to a virtual router, which then uses static or dynamic routing protocols (e.g., BGP, OSPF) to forward traffic between the tunnel and the zone's egress interface. This allows the firewall to make forwarding decisions between the encrypted VPN path and the protected internal network segments.

Answer

Virtual wires

Answer

Security policies

Answer

Interface management profiles

Question 7

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Accepted Answer

Use a dedicated physical interface or VLAN for HA heartbeat communication. The best practice is to use a dedicated physical interface or VLAN for HA heartbeat communication (Option B). This isolates heartbeat traffic from data traffic, ensuring reliable and fast detection of peer failure. Options A, C, and D are incorrect: A) Setting both firewalls' HA election delay to 0 is not recommended because it can cause flapping if both firewalls have equal priority; a small delay helps prevent unnecessary failovers. C) Enabling preemptive mode is generally not recommended as it can cause unnecessary failovers when the primary comes back online. D) Active/active mode is available on some models but is more complex to configure and not typically recommended for most HA deployments; active/passive is simpler and more reliable.

Answer

Set both firewall's HA election delay to '0' for fast failover

Answer

Enable preemptive mode to ensure the primary firewall always resumes control

Answer

Configure both firewalls in active/active mode to maximize throughput

Question 8

A firewall administrator needs to generate a report that shows the top applications consuming bandwidth over the last week. Which Palo Alto Networks tool should be used?

Accepted Answer

Application Command Center (ACC).. The ACC (Application Command Center) provides a visual overview of application usage and can filter by time. Option A is wrong because the log viewer shows raw logs, not aggregated reports. Option B is wrong because predefined reports are scheduled, not interactive. Option D is wrong because packet capture is for troubleshooting individual flows.

Answer

Predefined reports.

Answer

Traffic log viewer.

Answer

Packet capture (PCAP).

Question 9

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.. Setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Answer

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Answer

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Answer

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Question 10

Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?

Accepted Answer

Rule 1 (Allow-Sales). (Rule 1 – Allow-Sales) is correct. The source 10.1.1.50 belongs to the Sales zone, and the destination 192.168.1.100 belongs to the Servers zone. This is interzone traffic. Rule 1 explicitly permits traffic from Sales to Servers on TCP port 443, so it matches this traffic. The traffic log shows no entries because logging is disabled on Rule 1. The user's inability to connect is likely due to a server-side issue (e.g., the server not listening on port 443) or a routing problem, not because the firewall is dropping the traffic.

Answer

Interzone-default

Answer

Intrazone-default

Answer

Rule 2 (Allow-HR)

Question 11

During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?

Accepted Answer

Create an Application Override rule for FTP on the required source and destination addresses.. The most effective method is to create an Application Override rule for FTP, which forces App-ID to identify traffic as FTP based on source/destination addresses, regardless of port. Option A is wrong because updating databases does not change detection on non-standard ports; App-ID relies on port-based signatures unless overridden. Option B is wrong because disabling App-ID removes all application inspection. Option C is wrong because adding a non-standard port to the FTP service definition does not automatically enable App-ID identification; service definitions are used for policy enforcement, not for application identification. Option D is correct because an Application Override rule explicitly tells the firewall to treat traffic that matches the source and destination addresses as the specified application, bypassing port-based detection.

Answer

Update the App-ID and threat databases to the latest version.

Answer

Set the security policy to 'allow' without App-ID to ensure FTP works.

Answer

Add the non-standard port to the FTP service definition.

Question 12

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. The firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 13

A security analyst notices that a legitimate application is being incorrectly identified as a different application by the firewall. What is the best first step to resolve this issue?

Accepted Answer

Verify the application signature in the App-ID database and submit a false-positive report if needed. The first step in resolving an application misidentification is to verify the application signature in the App-ID database. If the signature is incorrect or missing, submitting a false-positive report allows Palo Alto Networks to update the database, ensuring accurate identification without manual overrides. This aligns with the principle of using the built-in App-ID engine as the primary identification method.

Answer

Reboot the firewall to refresh the application cache

Answer

Disable the application override and use port-based rules

Answer

Create a custom App-ID to override the incorrect identification

Question 14

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

Accepted Answer

Configure User-ID by integrating with Active Directory or using captive portal.. User-ID requires integration with Active Directory, a captive portal, or other user mapping methods to identify users for security policies. Option A is incorrect because SSL decryption is not required; user identification relies on mapping IP addresses to usernames, not decrypting credentials. Option C is incorrect because URL Filtering is used for categorizing web traffic, not for identifying users. Option D is incorrect because App-ID identifies applications, not users.

Answer

Deploy SSL decryption to see user credentials.

Answer

Enable URL Filtering to track user visits.

Answer

Activate App-ID to detect user login events.

Question 15

An administrator needs to apply a security profile that includes anti-malware and vulnerability protection to all traffic from the internal network to the internet. However, there is already a rule that allows this traffic without any profiles. What is the most efficient way to apply the profiles?

Accepted Answer

Create a new rule above the existing rule with the profiles and action 'allow', and ensure the rule is before the existing allow rule.. Creating a new rule above the existing allow rule with the required security profiles and action 'allow' ensures the profiles are applied to all matching traffic without modifying the existing rule. This is the most efficient approach as it preserves the original rule and avoids disruption. Option A is incorrect because an action 'deny' would block traffic, not apply profiles. Option B is inefficient as it requires removing and recreating a rule, and could cause temporary gaps in security. Option D would work but is less efficient because it modifies an existing rule, potentially affecting other traffic or requiring careful testing.

Answer

Create a new rule above the existing rule with the profiles and action 'deny'.

Answer

Remove the existing rule and replace it with a new rule that includes the profiles.

Answer

Edit the existing rule to add the security profiles.