PCNSA Practice Test 34 — 15 Questions

Question 1

Which TWO are required to configure a Forward Proxy Decryption rule?

Accepted Answer

A Certificate. A certificate is required for a Forward Proxy Decryption rule because the firewall must generate and sign a certificate on-the-fly to impersonate the destination server to the client. Without a valid certificate (typically from an internal CA or a decryption-specific CA), the client browser will reject the connection with a certificate error. The certificate is used to establish a trusted TLS session between the client and the firewall, allowing the firewall to decrypt and inspect the traffic.

Answer

A Destination Zone

Answer

A Source Zone

Answer

A URL Category

Question 2

Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?

Accepted Answer

Deny. The firewall first checks Rule 1, which only matches traffic with application 'ms-office365'. Since the traffic uses 'ssl', it does not match. The firewall then checks Rule 2, which denies all traffic from Sales to Finance zone. Therefore, the firewall takes the action Deny. Option A is incorrect because while the firewall does evaluate the next rule, the action taken is Deny, not 'continue to the next rule'. Option B is incorrect because the traffic is not allowed. Option D is incorrect because there is no security profile involved; the deny rule blocks it without any profile.

Answer

The firewall will continue to the next rule

Answer

Allow

Answer

Allow only if no security profile blocks it

Question 3

A security engineer is creating a security policy that should allow access to Salesforce.com for the sales team. The engineer configures the policy to allow application 'ssl' with no restriction on URL category. How can the engineer ensure that only traffic to Salesforce.com is allowed and not all SSL traffic?

Accepted Answer

Use App-ID to identify the 'salesforce' application and add a URL category for Salesforce domains.. Using App-ID to identify the 'salesforce' application and adding a URL category for Salesforce domains ensures only traffic to Salesforce.com is allowed, not all SSL traffic. Option A is wrong because allowing all SSL traffic is too broad and does not restrict to Salesforce. Option B is wrong because 'web-browsing' is not specific to Salesforce and URL category alone cannot enforce application control. Option D is wrong because SSL decryption inspects traffic but does not restrict access to specific sites without additional policy configuration.

Answer

Use a destination address object for the known Salesforce IP addresses.

Answer

Change the application to 'web-browsing' and restrict by URL category.

Answer

Enable SSL decryption to inspect the traffic.

Question 4

Which THREE actions can a Security policy rule perform on traffic?

Accepted Answer

Drop. A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Answer

Reset

Answer

Block

Question 5

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Dynamic IP and Port (DIPP) NAT allows multiple internal users to share a pool of public IP addresses by using port address translation, which is ideal for outbound internet access. Option B (Bidirectional NAT) is typically used for static 1-to-1 mappings that allow both inbound and outbound translation, not for sharing a pool of addresses. Option C (Static NAT with source NAT) is used for static mapping of a private IP to a public IP, primarily for inbound traffic, not for sharing a pool. Option D (Destination NAT with port forwarding) is used to forward specific inbound traffic to internal servers, not for outbound internet access.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 6

An administrator needs to perform a scheduled reboot of the firewall for maintenance. Which method provides the most control over the reboot timing?

Accepted Answer

Use the CLI command 'request restart system' with a scheduled time. The CLI command 'request restart system' with a scheduled time provides the most control because it allows you to specify an exact date and time for the reboot, ensuring the maintenance window is precisely managed without manual intervention. This method is designed for granular scheduling, unlike other options that either lack scheduling capability or are intended for different purposes.

Answer

Schedule a commit with the 'reboot at' option

Answer

Use the GUI 'Restart' button

Answer

Use the CLI command 'request shutdown system'

Question 7

Which THREE actions are valid when configuring App-ID in a security policy? (Choose three.)

Accepted Answer

Reset-Client. A is correct because 'Reset-Client' is a valid action in App-ID security policy rules that terminates the client session by sending a TCP reset (RST) packet. This action is used to block traffic while providing immediate feedback to the client that the connection was refused, rather than silently dropping packets.

Answer

Apply

Answer

Decrypt

Question 8

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

Accepted Answer

The security rule that allows the traffic does not include the custom application.. The security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Answer

SSL decryption is not enabled for the custom application.

Answer

The custom application needs to be added to the 'ssl' application group.

Answer

The application override was not committed.

Question 9

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Accepted Answer

Privacy regulations. Privacy regulations such as GDPR, HIPAA, or PCI DSS often restrict the decryption of traffic containing personally identifiable information (PII) or protected health information (PHI). Decrypting such traffic without proper safeguards can lead to legal penalties and data breach exposure. Palo Alto Networks firewalls can apply decryption policies that exclude traffic to specific URL categories or IP ranges to remain compliant with these regulations.

Answer

The cost of SSL certificates

Answer

User productivity

Question 10

A company uses destination NAT to translate a public IP to an internal server. They need to ensure that traffic sourced from the internal network to the public IP is also translated correctly. What is the best practice to achieve this?

Accepted Answer

Implement a source NAT rule for internal traffic destined to the public IP, translating it to the internal server IP.. When internal users access the public IP that is destination NATed to an internal server, the traffic must be source NATed to ensure symmetric routing. Without source NAT, the server sees the source as the internal client IP and sends the response directly to the client, causing asymmetric routing and connection failures. Implementing a source NAT rule for internal traffic destined to the public IP (hairpin NAT) ensures the firewall translates the source to its own internal IP, so the response goes back through the firewall. Option A is incorrect because disabling NAT on the loopback interface does not address the issue. Option B is incorrect because policy-based forwarding (PBF) is used for routing decisions, not NAT. Option C is incorrect because an additional destination NAT rule would not change the source address; source NAT is required.

Answer

Disable NAT on the internal zone's loopback interface.

Answer

Configure a policy-based forwarding rule to redirect internal traffic.

Answer

Add an additional destination NAT rule for internal traffic.

Question 11

Refer to the exhibit. Based on the session information, which type of NAT is being performed?

Accepted Answer

Source NAT. The session information shows the source IP address being translated from a private IP (e.g., 10.0.0.1) to a public IP (e.g., 203.0.113.1), which is characteristic of Source NAT (SNAT). Destination NAT (D) would change the destination IP, not the source. Port Address Translation (C) is a form of SNAT that also translates port numbers, but the question asks for the type of NAT, and based on the source IP change, the answer is Source NAT. No NAT (A) would leave the source IP unchanged, which is not the case.

Answer

No NAT is being performed

Answer

Port Address Translation (PAT)

Answer

Destination NAT

Question 12

An administrator wants to protect the firewall management interface from unauthorized access. The management interface is on a separate management network. Which of the following is the best security practice to restrict access?

Accepted Answer

Configure 'Permitted IP Addresses' under Device > Setup > Management.. Configuring 'Permitted IP Addresses' under Device > Setup > Management is the best security practice to restrict access to the firewall management interface. This setting allows only specified IP addresses or subnets to access the management interface, effectively creating an ACL. Option C is incorrect because interface management profiles are applied to dataplane interfaces, not the out-of-band management interface. Option B is incorrect because security policies do not apply to management plane traffic; they only control dataplane traffic. Option D is incorrect because 'Trusted Management Stations' is not a configuration option; the correct setting is 'Permitted IP Addresses' on the Management Access Settings page.

Answer

Create a security policy rule that blocks traffic to the management interface.

Answer

Apply an interface management profile to the management interface.

Answer

Enable 'Trusted Management Stations' under firewall settings.

Question 13

A company uses Active Directory for user authentication. They want to enforce security policies based on user identity. What is the required first step to enable User-ID on the Palo Alto Networks firewall?

Accepted Answer

Configure a server monitoring profile to connect to the domain controller.. The first step to enable User-ID on a Palo Alto Networks firewall when using Active Directory is to configure a server monitoring profile that connects to the domain controller. This allows the firewall to retrieve user-to-IP mappings from the AD security event logs. Option A is incorrect because an LDAP server profile is used for retrieving user attributes (like group membership) after the mapping is established, not for the initial mapping. Option B is incorrect because GlobalProtect is a client-based VPN solution that can provide user identity but is not required for internal AD integration. Option D is incorrect because Captive Portal is an authentication method that can be used for user identification but is not the first step when AD is already in place; the server monitoring profile is the foundational step.

Answer

Add an LDAP server profile to authenticate users.

Answer

Deploy GlobalProtect agents on all endpoints.

Answer

Enable captive portal on the internal zone.

Question 14

Which THREE are default security profile groups in PAN-OS? (Choose three.)

Accepted Answer

Strict. The default security profile groups in PAN-OS are Strict, Alert, and Best Practice. These are predefined groups that can be applied to security policies. Option A (Strict) is a default group that applies strict security profiles. Option C (Alert) is a default group that applies alert-only profiles. Option E (Best Practice) is a default group based on best practice recommendations. Option B (Server) is not a default security profile group. Option D (Custom) is also not a default group; custom groups are user-created.

Answer

Server

Answer

Custom

Question 15

Which THREE of the following actions are valid actions for a security policy rule on a Palo Alto Networks firewall? (Choose THREE.)

Accepted Answer

Deny. Options A, D, and E are correct: Deny, Drop, and Allow are valid actions for a security policy rule. Option B (Log) is not an action; logging is configured separately. Option C (Reset) is not a valid action; instead, Reset-Client and Reset-Server are available but not a simple 'Reset'.

Answer

Log

Answer

Reset