PCNSA Practice Test 35 — 15 Questions

Question 1

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

Accepted Answer

Suspend the passive firewall, then re-suspend it to trigger a full configuration synchronization.. Option C is correct because suspending and then re-suspending the passive firewall forces a full configuration synchronization from the active to the passive node. This is the most efficient method to resync after a software upgrade, as it triggers a complete config push without requiring a reboot or factory reset, preserving the HA state and minimizing disruption.

Answer

Restart both firewalls to automatically trigger a configuration sync.

Answer

Perform a factory reset on the passive firewall and re-join it to the HA pair.

Answer

Suspend the active firewall to make the passive take over, then restore the config.

Question 2

Based on the exhibit, what is the most likely cause if the firewall is dropping new connections but existing sessions continue to work?

Accepted Answer

The firewall has reached its session limit.. When a Palo Alto Networks firewall reaches its maximum session capacity (defined by the platform model and license), it will drop new connection attempts while maintaining existing sessions that are already in the session table. This behavior is by design to preserve established traffic. The session limit is a hard resource constraint, not a performance degradation, so existing flows continue uninterrupted until they age out or are terminated.

Answer

The management interface IP (192.168.1.1) is conflicting with another device.

Answer

The firewall is low on CPU memory.

Answer

The software version 10.1.3 is buggy.

Question 3

A security administrator wants to block traffic from a specific country using the firewall. How can this be achieved with minimal administrative overhead?

Accepted Answer

Create a security rule with a source region of the specified country.. Option B is correct because Palo Alto Networks firewalls include a built-in Geolocation database that maps IP addresses to countries. By creating a security rule with the source region set to the specific country, the firewall automatically applies the block without requiring manual IP management or external feeds, minimizing administrative overhead.

Answer

Configure an External Dynamic List (EDL) and reference it in a rule.

Answer

Manually add all IP subnets from that country to a block rule.

Answer

Disable routing to that country through the firewall.

Question 4

Refer to the exhibit. A network engineer executes the "show system info" command and sees the above output. Based on the model and PAN-OS version, which of the following is true about this firewall?

Accepted Answer

It supports maximum sessions of 5 million.. The output shows a PA-5250 firewall running PAN-OS 9.1.3. The PA-5250 is a high-end chassis-based platform that supports up to 5 million concurrent sessions, making option D correct. This session limit is a hardware specification of the PA-5200 series, not determined by the PAN-OS version alone.

Answer

It has redundant power supplies.

Answer

It supports a maximum of 10 virtual systems.

Answer

It can be upgraded to PAN-OS 11.0 directly without an intermediate version.

Question 5

A network engineer is configuring a new PA-220 firewall in a small branch office. The firewall must be managed centrally from Panorama. What is the first step after physically installing the firewall?

Accepted Answer

Configure the management IP address and authenticate to Panorama.. The correct first step after physically installing a Palo Alto Networks firewall is to configure the management IP address and authenticate to Panorama. Without a reachable management IP, the firewall cannot communicate with Panorama for registration, device group assignment, or configuration pushes. This foundational step establishes the initial network connectivity required for all subsequent centralized management operations.

Answer

Register the firewall with Panorama using the serial number.

Answer

Create a device group in Panorama and add the firewall.

Answer

Push the initial configuration from Panorama to the firewall.

Question 6

An organization has multiple virtual routers on a single firewall. Traffic between two virtual routers must be inspected by security policies. How should this be configured?

Accepted Answer

Place each virtual router's interfaces into different zones, then create inter-zone security rules.. Option A is correct because inter-zone security rules are required to enforce security policies on traffic between different virtual routers. Each virtual router's interfaces must be assigned to distinct zones, and inter-zone rules inspect traffic crossing from one zone to another, ensuring the firewall applies security controls (e.g., App-ID, User-ID) to the traffic between the virtual routers.

Answer

Configure static routes between the virtual routers.

Answer

Enable inter-virtual router routing under the global settings.

Answer

Apply security policies that match the virtual router as a source or destination.

Question 7

Which TWO of the following are valid dataplane components in a Palo Alto Networks firewall?

Accepted Answer

Session table. The session table is a core dataplane component because it stores the state of active sessions, enabling the firewall to perform stateful inspection and apply security policies at wire speed. The flow accelerator (FPGA) is a hardware-based dataplane component that offloads packet processing from the CPU, accelerating throughput for established sessions.

Answer

Management Plane

Answer

Routing table

Answer

Panorama

Question 8

A company is expanding its network and needs to add a new data center. The two data centers will be connected via a WAN link. To protect the traffic between data centers, the security team wants to use site-to-site VPNs. Which Palo Alto Networks feature is used to route traffic between VPN tunnels and security zones?

Accepted Answer

Virtual routers. Virtual routers are the correct feature because they function as Layer 3 routing instances within Palo Alto Networks firewalls, enabling the routing of traffic between VPN tunnels (which terminate on tunnel interfaces) and security zones. When a site-to-site VPN is configured, the tunnel interface is assigned to a virtual router, which then uses static or dynamic routing protocols (e.g., BGP, OSPF) to forward traffic between the tunnel and the zone's egress interface. This allows the firewall to make forwarding decisions between the encrypted VPN path and the protected internal network segments.

Answer

Virtual wires

Answer

Security policies

Answer

Interface management profiles

Question 9

A large enterprise operates multiple data centers with a Palo Alto Networks firewall pair in each data center in active/passive HA. The firewalls are managed by Panorama. Recently, after a power outage in Data Center A, both firewalls in that data center came back online but are not passing traffic. The network team confirms that the switches and routers are operational. The Panorama administrator sees that both firewalls are connected and show green in the Managed Devices tab. However, the active firewall in Data Center A shows "HA state: passive" and the other firewall also shows "passive". The administrator suspects a configuration issue. What is the most likely cause and corrective action?

Accepted Answer

Both firewalls have the same priority and no preemptive is enabled; configure different priorities and enable preemptive.. In an active/passive HA pair, if both firewalls show 'passive', it typically means they cannot determine which should be active. This occurs when both have the same priority and preemptive is disabled, so neither can claim the active role after a reboot. Configuring different priorities and enabling preemptive ensures one firewall becomes active based on its higher priority (lower numerical value).

Answer

The HA firewall link is down; check and reconnect the Layer 2 link between the firewalls.

Answer

The HA configuration is missing a heartbeat interface; add a dedicated heartbeat interface.

Answer

The preemptive settings are misconfigured; change the priority to make one firewall active.

Question 10

An administrator needs to deploy a Palo Alto Networks firewall in a location where the network infrastructure does not support routing. The firewall must be transparent to the existing network. Which deployment mode should be used?

Accepted Answer

Virtual wire. Virtual wire mode allows the firewall to be deployed transparently without requiring any routing configuration, as it operates at Layer 2 by binding two interfaces together and forwarding traffic based on MAC addresses. This mode is ideal when the existing network infrastructure does not support routing and the firewall must be invisible to the network, as it does not participate in routing protocols or require IP addresses on the connected interfaces.

Answer

HA mode

Answer

Layer 3

Answer

Tap mode

Question 11

A PA-5250 firewall is experiencing high CPU usage on the dataplane. Analysis shows that a large amount of traffic is being processed by the application identification engine. What can be done to reduce the CPU load?

Accepted Answer

Create security rules that use application-based policies to allow trusted applications without additional inspection.. Creating security rules that use application-based policies to allow trusted applications without additional inspection reduces CPU load because the firewall can skip deep packet inspection for those applications once identified. This offloads processing from the application identification engine by allowing traffic based on application signatures rather than performing full identification on every packet. In contrast, disabling application identification globally would break security policy enforcement, and increasing logging or changing the default rule would not reduce the CPU burden from application identification.

Answer

Disable application identification globally.

Answer

Increase logging to debug which applications are being processed.

Answer

Change the default rule to allow all traffic based on port only.

Question 12

A company wants to ensure that all internet-bound HTTP traffic is decrypted for inspection before being forwarded to the next-generation firewall for policy enforcement. Which deployment method should be used?

Accepted Answer

Explicit proxy with SSL Forward Proxy decryption. B is correct because an explicit proxy deployment requires clients to be configured to send HTTP traffic to the firewall's proxy IP, which allows the firewall to terminate the client connection, perform SSL Forward Proxy decryption using a forward trust certificate, and then re-encrypt the traffic for inspection before forwarding it to the next-generation firewall for policy enforcement. This method ensures that all internet-bound HTTP traffic is decrypted for inspection, as the firewall acts as an intermediary between the client and the destination server.

Answer

Virtual wire mode with SSL Forward Proxy

Answer

Transparent proxy with a forward trust certificate

Answer

Layer 3 mode with a policy-based forwarding rule

Question 13

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Accepted Answer

Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings. Option C is correct because FTP uses separate control (TCP 21) and data channels, and the firewall must inspect both to enforce security policies. Enabling 'FTP Alg' in the Application Override settings allows the Palo Alto Networks firewall to dynamically open pinholes for the data channel and perform deep inspection of FTP commands, ensuring proper stateful handling of active and passive modes.

Answer

Create a rule with service 'tcp-21' and application 'any'

Answer

Create a rule with application 'ftp' and disable Application Override

Answer

Create a rule with application 'ftp' and service 'application-default'

Question 14

Refer to the exhibit. A network engineer observes a high number of SSL handshake failures. Which action is most likely to reduce these failures?

Accepted Answer

Ensure the forward trust certificate is trusted by internal clients.. The majority of failures are SSL handshake failures (2000 out of 3000). A common reason is that the forward trust certificate is not trusted by clients, causing the client to reject the connection during the handshake.

Answer

Disable decryption for traffic using unsupported ciphers.

Answer

Reissue the forward untrust certificate with a stronger key size.

Answer

Increase the certificate cache size to accommodate more certificates.

Question 15

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Accepted Answer

Change the 'ssl-protocol-settings' max-version to 'tls1-3'.. The decryption profile specifies max-version as tls1-2, which prevents decryption of TLS 1.3 traffic. Updating the max-version to tls1-3 allows decryption of TLS 1.3 sessions.

Answer

Change the min-version to 'tls1-3'.

Answer

Add a new rule for TLS 1.3 traffic.

Answer

Enable 'decrypt-unknown-protocol' to capture all traffic.