PCNSA Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A network administrator notices that SSL decryption performance has degraded. Based on the exhibit, which factor is most likely contributing to the performance issue?

Accepted Answer

The decryption policy matches (12000) are high relative to the number of SSL/TLS proxy sessions (5000), indicating many sessions are being decrypted but then possibly dropped or not fully processed.. The exhibit shows 12000 decryption policy matches but only 5000 SSL/TLS proxy sessions, indicating that many sessions matched the decryption policy but were not fully decrypted (e.g., due to unsupported ciphers or certificate issues), leading to wasted processing and degraded performance.

Answer

The firewall has been running for too long without a reboot.

Answer

The session utilization is at 95%, nearing the capacity limit, but decryption sessions are only a small fraction.

Answer

The data plane CPU and memory are both high, indicating resource exhaustion.

Question 2

Refer to the exhibit. An administrator notices that some HTTPS sessions are not being decrypted. Which configuration change would address the most common cause of decryption failures shown?

Accepted Answer

Enable 'allow expired certificates' in the SSL decryption profile.. The log shows a warning about an expired server certificate causing decryption failure. By enabling 'allow expired certificates' in the decryption profile, the firewall will continue to decrypt traffic even if the server certificate is expired.

Answer

Configure a forward trust certificate that is valid and trusted.

Answer

Increase the session timeout for decryption.

Answer

Enable support for SSLv3 in the decryption profile.

Question 3

A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?

Accepted Answer

The Data Filtering profile does not include the specific applications that are transferring files.. Option A is correct because Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.

Answer

The Data Filtering profile is not attached to the security rule.

Answer

The security rule is not logging the Data Filtering alerts.

Answer

SSL decryption is not enabled for the traffic.

Question 4

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Accepted Answer

Create a more specific decryption policy to only decrypt necessary traffic.. The correct answer is A because the firewall is decrypting unnecessary traffic (social media sites) in addition to critical medical cloud services. By refining the decryption policy to exclude non-essential traffic, the administrator reduces the CPU load from SSL/TLS handshake and encryption processing, directly addressing the spike without requiring hardware changes. This aligns with Palo Alto Networks best practices of minimizing decryption scope to only traffic that requires inspection.

Answer

Increase the decryption session timeout value.

Answer

Replace the firewall with a higher-end model.

Answer

Enable SSL acceleration hardware offloading.

Question 5

A company purchases a new PA-410 firewall and installs it in a branch office. After configuring basic network settings, the administrator attempts to install the threat prevention license. The firewall is connected to the internet via a NAT device. The administrator registers the firewall with the Palo Alto Networks support portal using the serial number. The license is successfully added to the account. However, when checking the firewall's license status via the web interface, it shows 'Authentication Failed' for the license. The administrator can ping a well-known DNS server from the firewall's management IP. What is the most likely cause?

Accepted Answer

The firewall's clock is not synchronized, causing authentication failure.. The 'Authentication Failed' error for a license on a Palo Alto Networks firewall typically indicates a certificate or time-stamp validation issue. Since the firewall can reach the internet (pinging a DNS server works) and the license is already added to the support portal, the most likely cause is that the firewall's system clock is not synchronized. Palo Alto Networks license validation relies on accurate time to verify the certificate chain and license expiry; an unsynchronized clock causes the SSL/TLS handshake to fail, resulting in an authentication failure.

Answer

The license is not yet activated on the support portal.

Answer

The management interface is configured with the wrong DNS server.

Answer

The firewall cannot reach the Palo Alto Networks update server due to a firewall rule blocking HTTPS outbound.

Question 6

A small business uses a Palo Alto Networks PA-220 firewall. The administrator needs to create a security policy to allow inbound VPN connections from remote employees using IPsec. The remote employees connect using dynamic IP addresses. The administrator creates an address object "Remote-VPN-Users" of type "IP Range" but that doesn't work because the IPs are not known. What address object type should be used instead?

Accepted Answer

Any (0.0.0.0/0). The correct answer is B because when remote employees connect using dynamic IP addresses, the source IP is unknown and cannot be defined by a static address object. Using 'Any' (0.0.0.0/0) as the source address in the security policy allows the firewall to accept IPsec VPN traffic from any source IP, which is necessary for clients with dynamic addresses. This is a common practice for remote access VPN configurations where the peer IP is not predetermined.

Answer

IP Netmask

Answer

FQDN

Answer

IP Wildcard Mask

Question 7

A company has a single Palo Alto Networks firewall protecting its internet connection. The IT team wants to allow remote employees to access internal resources using GlobalProtect. They have already configured the portal and gateway on the firewall, and users can successfully connect and obtain an IP address from the IP pool assigned to the gateway. However, remote users report that they cannot access any internal servers after connecting. The firewall has security policies that allow traffic from the GlobalProtect gateway's IP pool to the internal servers. Which additional configuration step is most likely required?

Accepted Answer

Configure a static route on the internal router pointing the GlobalProtect IP pool subnet back to the firewall's internal interface.. Option C is correct because the remote users can connect and obtain an IP address from the GlobalProtect gateway's IP pool, but the internal servers do not have a route back to that IP pool subnet. Without a static route on the internal router pointing the GlobalProtect IP pool subnet to the firewall's internal interface, return traffic from the internal servers is sent to the default gateway (the firewall's internal interface) only if the firewall is the default gateway for those servers; if not, the traffic is dropped or misrouted. This is the most common missing step when remote users can authenticate and get an IP but cannot reach internal resources.

Answer

Increase the GlobalProtect gateway's session timeout value.

Answer

Enable NAT on the GlobalProtect gateway to translate the remote user IP to the firewall's internal interface IP.

Answer

Install a client certificate on each remote user's device for authentication.

Question 8

A company has a Palo Alto Networks firewall in a data center, connecting internal users (zone: Internal) to the internet (zone: Untrust). Recently, users report that they cannot access the corporate HR portal hosted on a server in the DMZ (zone: DMZ, IP 10.10.10.10) using HTTPS. The firewall has a security policy that allows traffic from Internal to DMZ with application web-browsing and service https-ssl. The policy is in place and committed. The administrator verifies that the web server is running and reachable from within the DMZ. From the firewall, a ping from the management interface to the server is successful. However, when a user tries to access https://10.10.10.10, the connection times out. Traffic logs show no sessions logged for that traffic. What is the most likely cause?

Accepted Answer

The policy is missing the source zone; the traffic is being blocked by an implicit deny rule before any policy match.. Option A is correct. Since there are no sessions in the traffic log, the traffic is being dropped by the implicit deny rule, meaning no security policy matched. The most likely reason is that the policy's source zone is not set to Internal; if it were set to another zone (e.g., Untrust), the traffic from Internal would not match. Option B would likely produce sessions if matched by another policy. Option C would show sessions but no return traffic. Option D is incorrect because SSL decryption is not required for HTTPS to be allowed through the firewall.

Answer

There is a routing issue preventing return traffic from reaching the firewall.

Answer

The policy has the wrong destination zone; the server is actually in the Internal zone.

Answer

The firewall is not configured to perform SSL decryption; thus HTTPS traffic is being blocked.

Question 9

An organization uses a Palo Alto Networks firewall to segment its network into three zones: Corp (10.0.1.0/24), Guest (10.0.2.0/24), and Mgmt (10.0.3.0/24). The firewall is running PAN-OS 10.0. The administrator wants to ensure that only devices from the Corp zone can access the management interface of the firewall via SSH from the internal network. The management interface is physically connected to the Mgmt network, and its IP is 10.0.3.1/24. A security policy must be configured to permit this access. Which approach should the administrator take?

Accepted Answer

Configure an interface management profile on the Mgmt interface that allows SSH only from the Corp subnet (10.0.1.0/24), and apply it to the management interface.. Option B is correct. Management access to the firewall's control plane is controlled by Interface Management Profiles, not security policies. Security policies govern data plane traffic that passes through the firewall, not traffic destined to the firewall itself. Therefore, the correct method is to configure an Interface Management Profile on the Mgmt interface that permits SSH only from the Corp subnet. Option A incorrectly uses a security policy. Option C also misapplies security policy. Option D describes an alternative method (Management Access List), but Interface Management Profiles are the standard and more flexible approach, and the question specifically asks for the correct one in this context.

Answer

Create a policy with source zone Corp, destination zone Mgmt, and service SSH. Ensure that the management interface is included as a destination in the policy.

Answer

Use the built-in admin access control list in firewall settings to permit SSH from Corp subnet, and disable all other management protocols.

Answer

Create a security policy with source zone Corp, destination zone Mgmt, and application SSH, and also create a static route to the Mgmt network.

Question 10

A network administrator is migrating from a legacy firewall to a new Palo Alto Networks firewall. The current firewall has a large number of ACL rules that allow traffic based on source/destination IP and port. The administrator wants to convert these rules to App-ID based policies on the Palo Alto firewall. What is the recommended best practice to ensure a smooth migration while maintaining security?

Accepted Answer

Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.. Option A is correct. The recommended approach is to first replicate the existing port-based rules on the Palo Alto firewall to preserve connectivity, then enable App-ID in learning mode (or log and learn) to observe actual applications. This allows the administrator to identify applications without disruption and then gradually create App-ID based policies. Option B is risky as it leaves no policies, allowing all traffic. Option C could cause outages by enforcing App-ID immediately. Option D refers to Policy Optimizer, which is useful later but not the first step.

Answer

Use the Policy Optimizer feature in Panorama to analyze existing logs and generate App-ID based policy recommendations.

Answer

Deploy the Palo Alto firewall inline with no policies first, and let it learn the traffic patterns automatically for a week.

Answer

Convert all existing rules to App-ID by using the application default ports and immediately enforce application blocking.

Question 11

A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?

Accepted Answer

Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.. Option D is correct. The application mismatch indicates the firewall is not identifying the traffic as the expected application. Likely the application signature needs to be updated or the policy should use a broader application. Option A is wrong because decryption would not cause a mismatch; it would help identify applications. Option B is wrong because the policy is already allowing ssl; changing to web-browsing would be too broad and could bypass intent. Option C is wrong because the destination is correctly set; the issue is application identification.

Answer

Enable SSL decryption to inspect the traffic and improve application identification.

Answer

Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.

Answer

Check that the destination address object for the CRM server is correct and includes the CDN IPs.

Question 12

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Accepted Answer

The log forwarding profile is not configured to forward logs for denied sessions.. Option A is correct because log forwarding profiles can be set to forward different log types, and if the profile does not include 'deny' or 'drop' actions, those logs won't be forwarded. Option B is incorrect because the SIEM receives allowed logs, so syslog is working. Option C is incorrect because denied sessions are still logged at session end. Option D is incorrect because threat logs are not the same as denied traffic logs; denied traffic logs fall under traffic logs with a deny action.

Answer

The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Answer

The firewall is logging only at session end and the deny sessions are not completing.

Answer

The SIEM is not configured to receive syslog messages for deny actions.

Question 13

A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.

Accepted Answer

The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'.. Option C is correct because if the security rule's source zone is 'Trust' instead of 'GlobalProtect', traffic from the GlobalProtect zone will not match the intended rule and will fall through to a default deny rule. Option A is incorrect because internal resource routes are for routing, not policy matching. Options B and D are less likely given the log behavior.

Answer

The internal resources require a specific security profile that is not applied to the rule.

Answer

The User-ID agent is not mapping remote usernames correctly.

Answer

The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings.

Question 14

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Accepted Answer

The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.. Option B is correct because the default malware profile may rely on known signatures and may not detect unknown malware; a profile with WildFire analysis is needed. Option A is incorrect because the domain is not in the excluded category. Option C is plausible but less likely given that the malware uses a custom packer; WildFire would help if enabled. Option D is incorrect because 'ssl' is the application for decrypted SSL traffic, and 'web-browsing' would also apply if HTTP is used, but the actual application is detected correctly.

Answer

The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Answer

The firewall is missing the latest content updates for WildFire.

Answer

The decryption exclusion list includes the domain of the malware source.

Question 15

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

Accepted Answer

The rule order is incorrect; the allow rule is below the 'Deny All' rule.. Option A is correct because in Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Answer

The application 'web-browsing' is not being properly identified by App-ID.

Answer

The source address object for the allow rule is misconfigured with a wrong subnet mask.

Answer

The User-ID agent is overriding the allow rule and triggering a block action.

PCNSA Practice Test 36 — 15 Questions

Exhibit

PCNSA Practice Test 36 — 15 Questions

Exhibit