PCNSA Practice Test 35 — 15 Questions

Question 1

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall is not configured with the root CA certificate. When a firewall performs inbound inspection decryption, it re-encrypts traffic using the server's certificate. If the firewall does not have the root CA certificate that issued the server's certificate, the firewall cannot present a complete certificate chain to clients. Clients then see the certificate as untrusted because the issuing CA is not recognized, even though the server's certificate and private key are correctly imported.

Answer

The server's certificate is using an unsupported cipher

Answer

The decryption profile's 'Unsupported Modes' is set to 'Block'

Answer

The decryption policy is not matching the traffic

Question 2

An administrator configures a security policy rule to block traffic from IP address 10.1.1.1 to 10.2.2.2 on any service. However, traffic from 10.1.1.1 to 10.2.2.2 is still passing through the firewall. After checking all rules, what is the most likely cause?

Accepted Answer

The rule is configured in the PBF rulebase instead of the Security rulebase. Policy-Based Forwarding (PBF) rules are evaluated before security rules and can override security policy decisions. If the traffic matches a PBF rule, it may be forwarded without being subject to the security rulebase, even if a security rule explicitly blocks it. This is the most likely cause because the administrator configured the block in the wrong rulebase.

Answer

The rule is placed after an allow rule that matches the traffic

Answer

The source and destination zones are set to 'any'

Answer

There is an implicit allow rule that overrides the block rule

Question 3

An organization uses a Palo Alto Networks firewall to segment its network into three zones: Corp (10.0.1.0/24), Guest (10.0.2.0/24), and Mgmt (10.0.3.0/24). The firewall is running PAN-OS 10.0. The administrator wants to ensure that only devices from the Corp zone can access the management interface of the firewall via SSH from the internal network. The management interface is physically connected to the Mgmt network, and its IP is 10.0.3.1/24. A security policy must be configured to permit this access. Which approach should the administrator take?

Accepted Answer

Configure an interface management profile on the Mgmt interface that allows SSH only from the Corp subnet (10.0.1.0/24), and apply it to the management interface.. Management access to the firewall's control plane is controlled by Interface Management Profiles, not security policies. Security policies govern data plane traffic that passes through the firewall, not traffic destined to the firewall itself. Therefore, the correct method is to configure an Interface Management Profile on the Mgmt interface that permits SSH only from the Corp subnet (10.0.1.0/24) and apply it to the management interface. Option A incorrectly uses a security policy to control management access. Option B is incorrect because the built-in admin access control list is not the standard method; Interface Management Profiles are the proper way. Option C also misapplies security policy.

Answer

Create a policy with source zone Corp, destination zone Mgmt, and service SSH. Ensure that the management interface is included as a destination in the policy.

Answer

Use the built-in admin access control list in firewall settings to permit SSH from Corp subnet, and disable all other management protocols.

Answer

Create a security policy with source zone Corp, destination zone Mgmt, and application SSH, and also create a static route to the Mgmt network.

Question 4

Which TWO of the following are key benefits of using an Application-Based Security Policy compared to a Port-Based Security Policy? (Choose TWO.)

Accepted Answer

Ability to control applications regardless of port or protocol evasion. Options B and D are correct. Application-based policies use App-ID to identify and control applications regardless of the port or protocol used, preventing evasion via non-standard ports. They also provide detailed logging and reporting on application usage, aiding compliance. Option A is wrong because port-based policies are simpler for static protocols; application-based policies require more configuration. Option C is wrong because application-based policies do not inherently increase throughput; they perform deep inspection. Option E is wrong because application-based policies actually require more processing than simple port checking.

Answer

Simpler configuration for traditional protocols like HTTP and FTP

Answer

Easier to allow applications that use dynamic ports

Answer

Increased throughput because firewall does not need to inspect ports

Question 5

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

Accepted Answer

Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow. The correct rule configuration is Option C: Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow. This allows internal users (trust zone) to access the public web server in the DMZ. Option A is wrong because the source zone should be trust, not DMZ. Option B is wrong because specifying Service: any and Application: any is too broad and not best practice. Option D is wrong because the destination zone should be DMZ, not trust.

Answer

Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow

Answer

Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow

Answer

Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow

Question 6

Which TWO are best practices for securing management access to a Palo Alto firewall? (Select two)

Accepted Answer

Use a dedicated management subnet. Using a dedicated management subnet (out-of-band management) isolates management traffic from production data traffic, reducing the attack surface and ensuring management access remains available even if the data plane is compromised. This is a foundational security best practice for any network device, including Palo Alto firewalls.

Answer

Use HTTPS with self-signed certificates

Answer

Use SNMP v1 for monitoring

Answer

Disable ping on the management interface

Question 7

Refer to the exhibit. What is the default gateway of the firewall?

Accepted Answer

10.0.0.1. The default gateway for a firewall is the IP address of the next-hop router that the firewall uses to reach networks not directly connected. In the exhibit, the route with destination 0.0.0.0/0 (the default route) points to next-hop 10.0.0.1, making 10.0.0.1 the default gateway. This is the standard behavior in PAN-OS: the default gateway is defined by the static default route, not by an interface IP.

Answer

ethernet1/1

Answer

10.0.0.0

Answer

0.0.0.0

Question 8

An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?

Accepted Answer

Use separate virtual systems (vsys) for each tenant.. Virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.

Answer

Use prefix-based naming conventions for address objects.

Answer

Use separate device groups in Panorama.

Answer

Use tags to isolate objects per tenant.

Question 9

Which TWO of the following are valid methods to centrally manage multiple Palo Alto Networks firewalls?

Accepted Answer

Deploy a dedicated Log Collector to aggregate logs from multiple firewalls. A dedicated Log Collector aggregates logs from multiple Palo Alto Networks firewalls, enabling centralized log storage and analysis without managing firewall configurations. This is a valid method for centralizing log data, though it does not manage firewall policies or settings directly. Option D is correct because Panorama is the primary centralized management server for Palo Alto Networks firewalls, allowing administrators to push policies, templates, and configurations to multiple firewalls from a single interface.

Answer

Use the web interface of one firewall to manage others

Answer

Manually configure each firewall and synchronize via TFTP

Answer

Use CLI scripting to push configurations

Question 10

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Accepted Answer

Create a decryption exclusion rule for specific URLs or categories.. Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites. Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Answer

Rely on the browser's security settings to prevent decryption.

Answer

Disable SSL Decryption globally when the user visits sensitive sites.

Answer

Use a policy to decrypt only HTTP traffic.

Question 11

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

Accepted Answer

A file blocking profile is blocking the upload.. A file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Answer

The application 'webapp' is not allowed due to an application override.

Answer

SSL decryption is not enabled.

Answer

App-ID is not identifying the application correctly.

Question 12

A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)

Accepted Answer

Source address. In Palo Alto Networks security policy rules, the source and destination addresses are mandatory because the firewall must know which traffic to evaluate. Without a source or destination address, the rule cannot define the traffic flow and would be invalid. The 'allow' action requires at least these two address objects to create a valid rule.

Answer

Application

Answer

User

Answer

Service

Question 13

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Accepted Answer

An application override is configured that misidentifies the app.. An application override explicitly forces the firewall to classify traffic as a specific application, bypassing App-ID's signature-based identification. If the override is misconfigured, the firewall will consistently misidentify the traffic, leading to incorrect policy enforcement. This is a common cause of App-ID misidentification when administrators manually override the default identification process.

Answer

Packet size exceeds the maximum transmission unit.

Question 14

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

Accepted Answer

The rule order is incorrect; the allow rule is below the 'Deny All' rule.. In Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Answer

The application 'web-browsing' is not being properly identified by App-ID.

Answer

The source address object for the allow rule is misconfigured with a wrong subnet mask.

Answer

The User-ID agent is overriding the allow rule and triggering a block action.

Question 15

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.