PCNSA Practice Test 36 — 15 Questions

Question 1

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

Accepted Answer

Application. The question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Answer

Region

Answer

Address

Answer

Service

Question 2

An administrator configured NTP servers as shown. After committing, the firewall's time is not synchronized. Which additional configuration is required?

Accepted Answer

Enable NTP service under Device > Setup > Services. The NTP service must be explicitly enabled on the firewall under Device > Setup > Services before it will synchronize time with any configured NTP servers. Without enabling the NTP service, the firewall ignores the NTP server configuration entirely, even if the servers are reachable and correctly specified.

Answer

Configure an authentication key

Answer

Set time zone manually

Answer

Specify a source interface for NTP

Answer

Restart NTP service

Question 3

Which TWO of the following are valid log types on a Palo Alto Networks firewall?

Accepted Answer

Traffic logs. Traffic logs are a core log type on Palo Alto Networks firewalls, recording every session that traverses the firewall, including source/destination IPs, ports, and application IDs. Threat logs are also valid, capturing security events such as intrusions, malware, and spyware detected by the firewall's threat prevention engine.

Answer

Authentication logs

Answer

System logs

Answer

DHCP logs

Question 4

A network administrator needs to configure certificate-based authentication for administrative access to the firewall's web interface. Which two actions are required?

Accepted Answer

Import a CA-signed certificate for the firewall.. For certificate-based authentication of administrative access to the firewall's web interface, you must import a CA-signed certificate for the firewall (Option D) because the browser must trust the certificate presented by the firewall during the TLS handshake. Additionally, you must assign that certificate to the HTTPS management interface (Option E) so the firewall uses it for TLS sessions on the management web interface.

Answer

Generate a self-signed server certificate on the firewall.

Answer

Create a local user with a certificate profile.

Answer

Import a CRL from the issuing CA.

Question 5

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

Accepted Answer

Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.. App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Answer

Ensure the application uses a standard port.

Answer

Ensure SSL decryption is enabled for the application.

Answer

Check if the application override is applied to the correct rule.

Question 6

A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?

Accepted Answer

Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10. Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.

Answer

Search Threat logs for the destination IP

Answer

Search Config logs for any rule changes

Answer

Search System logs for the user's IP

Question 7

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

Accepted Answer

Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.. Virtual routers in different virtual systems (Vsys) are isolated by default. To enable inter-Vsys routing, you must configure either a virtual wire (which bridges the two Vsys at Layer 2) or route redistribution (which allows routes from one virtual router to be shared with the other). This provides the necessary Layer 3 connectivity between the Vsys A and Vsys B subnets.

Answer

Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.

Answer

Ensure both virtual routers are in the same virtual system.

Answer

Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.

Question 8

Refer to the exhibit. An administrator observes that HTTP requests from the 10.0.0.0/24 network to the 172.16.1.0/24 network are being logged but the logs show that the action taken is 'deny'. What is the most likely cause?

Accepted Answer

A different rule with higher priority is matching the traffic and denying it. In Palo Alto Networks firewalls, rules are evaluated in order. If a rule with higher priority (e.g., an implicit deny or a more specific rule) matches first, it will deny the traffic before reaching the 'Allow-Web' rule. The log entry shows the action taken by the first matching rule. Option A is incorrect because if the rule were disabled, it would not produce a log entry at all. Option B is incorrect because the rule already has application 'web-browsing' configured; identification issues would not cause a deny action. Option C is incorrect because if the rule had action 'deny', it would not be named 'Allow-Web' and would not log as deny due to a different rule.

Answer

The rule 'Allow-Web' is disabled

Answer

The application 'web-browsing' is not correctly identified

Answer

The rule 'Allow-Web' is configured with action 'deny'

Question 9

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Accepted Answer

Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.. By default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Answer

Configure a zone protection profile on the DMZ zone.

Answer

Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.

Answer

Create a rule allowing traffic from DMZ to Untrust with a deny action.

Question 10

A company uses Palo Alto Networks firewalls and wants to decrypt inbound traffic to their web server. Which decryption type should be configured?

Accepted Answer

SSL Inbound Decryption. SSL Inbound Decryption is the correct decryption type for decrypting inbound traffic to a web server. It allows the firewall to decrypt traffic destined for a server by presenting a certificate that the client trusts, enabling inspection of the payload for threats. This is distinct from forward proxy decryption, which is used for outbound traffic from internal clients.

Answer

SSL Inbound Inspection

Answer

SSH Proxy

Answer

SSL Forward Proxy

Question 11

An administrator configures a custom App-ID signature using a packet buffer override. What is the implication?

Accepted Answer

The firewall will use the custom signature instead of the default.. When a custom App-ID signature is configured with a packet buffer override, the firewall is instructed to use the custom signature's definition to identify the application instead of relying on the default built-in App-ID signature. This override ensures that the custom signature takes precedence over any existing default signature for the same application, allowing the administrator to enforce a specific application identification behavior.

Answer

The custom signature will only match on specific ports.

Answer

The custom signature will be ignored if it conflicts with built-in.

Answer

The custom signature requires a separate license.

Question 12

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Accepted Answer

Generate or import a CA certificate for the firewall. SSL Forward Proxy decryption requires the firewall to act as a trusted intermediary. To do this, the firewall must generate or import a CA certificate that client browsers will trust, allowing it to dynamically generate and sign server certificates for decrypted sessions. Without this CA certificate, clients will receive untrusted certificate warnings, and decryption will fail.

Answer

Import the server's private key

Answer

Import the server certificate

Answer

Enable SSH decryption

Question 13

An administrator configures log forwarding to send traffic logs to a syslog server. After applying the log forwarding profile to the security policy, logs are not appearing at the syslog server. The administrator verifies that the syslog server is reachable from the firewall's management IP by using ping, and that the syslog service is running on the server. What is the most likely cause?

Accepted Answer

The syslog server is not configured in the Server Profiles.. Log forwarding in Palo Alto Networks firewalls requires a syslog server profile to be configured under Device > Server Profiles > Syslog. Without this profile, the firewall has no destination address or port to send logs to, even if the syslog server is reachable via ping. The log forwarding profile references the server profile; if the server profile is missing or misconfigured, logs will not be forwarded.

Answer

The security policy matching the traffic does not have logging enabled.

Answer

The firewall's data port IP is not used for logging.

Answer

The log forwarding profile is not committed.

Question 14

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Accepted Answer

Schedule. Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.

Answer

User

Answer

Application group

Question 15

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

Accepted Answer

The traffic lacks enough signatures to identify the sub-application.. App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.

Answer

The firewall has not received the latest App-ID update.

Answer

SSL decryption is not configured.

Answer

A security rule is blocking the sub-application.