PCNSA Practice Test 37 — 15 Questions

Question 1

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 2

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

Accepted Answer

rule3.. Rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Answer

rule2.

Answer

rule1.

Answer

None, because rule1 and rule2 have specific applications.

Question 3

Drag and drop the steps to configure a GlobalProtect portal and gateway on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Configure Authentication Policy, then Assign Gateway to Portal and Commit. GlobalProtect requires portal, gateway, security policy, assignment, and testing.

Answer

Configure GlobalProtect Gateway, then Configure GlobalProtect Portal, then Configure Authentication Policy, then Assign Gateway to Portal and Commit

Answer

Configure Authentication Policy, then Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit

Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit, then Configure Authentication Policy

Question 4

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Enable User-ID on interface, then configure the User-ID agent, then map users, then create security policies, then verify. User-ID setup involves enabling on interface, configuring agent, mapping users, creating policies, and verification.

Answer

Configure the User-ID agent, then enable User-ID on interface, then map users, then create security policies, then verify

Answer

Enable User-ID on interface, then create security policies, then configure the User-ID agent, then map users, then verify

Answer

Map users, then enable User-ID on interface, then configure the User-ID agent, then create security policies, then verify

Question 5

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Answer

Device groups

Answer

Shared policy

Answer

Template stacks

Question 6

A firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which action should be taken?

Accepted Answer

Create a decryption bypass for traffic to high-bandwidth sites with low security risk.. Creating a decryption bypass for traffic to high-bandwidth, low-risk sites reduces the CPU load from SSL decryption by exempting that traffic from decryption, while still allowing decryption for higher-risk traffic. This targeted approach maintains security posture without completely disabling decryption, aligning with best practices for managing decryption resources on Palo Alto Networks firewalls.

Answer

Use decryption mirroring to offload decryption to a dedicated appliance.

Answer

Change decryption policy to 'no-decrypt' for all traffic.

Answer

Enable SSL/TLS protocol settings to disable weak ciphers.

Question 7

A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?

Accepted Answer

The Security policy rule has a DoS Protection profile applied that is dropping traffic.. When a Security policy rule permits traffic but it is still blocked, the most likely cause is that a DoS Protection profile is applied to the rule. DoS Protection profiles can drop traffic based on session rate thresholds or other attack signatures, even when the base Security rule allows the session. This is a common misconfiguration because the profile operates as an additional enforcement layer above the permit action.

Answer

A Zone Protection profile is dropping the traffic.

Answer

A decryption policy is blocking the traffic.

Answer

The Security policy rule has a source zone mismatch.

Question 8

Which TWO logs are most useful for troubleshooting SSL decryption issues? (Select exactly two.)

Accepted Answer

System log. The System log (B) records decryption-related events, such as certificate validation failures, handshake errors, and unsupported cipher suites, which are critical for diagnosing SSL decryption issues. The Traffic log (D) shows whether traffic was decrypted or bypassed, including the 'Decrypted' flag and details about the SSL/TLS handshake, allowing you to verify decryption policy application.

Answer

GlobalProtect log

Answer

Threat log

Answer

URL Filtering log

Question 9

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications traversing the network regardless of port. The correct matches are: App-ID identifies applications, User-ID maps users, Content-ID inspects content, WildFire analyzes unknown threats. Common confusions involve swapping the definitions of App-ID and User-ID.

Answer

App-ID: Maps users to IP addresses for policy enforcement

Answer

User-ID: Identifies applications traversing the network regardless of port

Question 10

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure HA interfaces (control link and data link), then Set HA mode to Active-Passive, then Configure device priority (lower value = higher priority), then Configure peer IP address, then Enable preemption and session synchronization.. HA configuration requires setting up interfaces, mode, priority, peer IP, preemption, and synchronization.

Answer

Configure device priority, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Enable preemption and session synchronization.

Answer

Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Configure device priority, then Enable preemption and session synchronization.

Answer

Enable preemption and session synchronization, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure device priority, then Configure peer IP address.

Question 11

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Backup configuration, then access CLI, then issue factory-reset command, then confirm, then reboot.. Factory reset requires backup, CLI access, reset command, confirmation, and reboot.

Answer

Access CLI, then issue factory-reset command, then confirm, then reboot, then backup configuration.

Answer

Backup configuration, then access CLI, then confirm, then issue factory-reset command, then reboot.

Answer

Reboot, then access CLI, then backup configuration, then issue factory-reset command, then confirm.

Question 12

After enabling SSL decryption, users report that some websites fail to load. The firewall logs show 'decryption error' for these sites. Which decryption profile setting should the administrator check first?

Accepted Answer

Block sessions with untrusted issuers. When SSL decryption is enabled, the firewall acts as a man-in-the-middle and must re-sign the server's certificate with its own CA. If the server's certificate is issued by an untrusted CA (i.e., not in the firewall's trusted CA list), the firewall cannot verify the chain of trust and will block the session if the 'Block sessions with untrusted issuers' option is enabled. This is the most common cause of 'decryption error' logs for sites that previously worked without decryption.

Answer

Block sessions with expired certificates

Answer

Block sessions with certificate status unknown

Answer

Block sessions with unsupported cipher suites

Question 13

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

Accepted Answer

The Default-No-Decrypt rule is above Decrypt-Web and matches all traffic. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If the 'Default-No-Decrypt' rule is placed above the 'Decrypt-Web' rule and matches all traffic (e.g., source/destination 'any'), then all traffic, including traffic to the web server, will match this rule first and will not be decrypted, preventing the 'Decrypt-Web' rule from ever being evaluated.

Answer

The 'strict' profile is misconfigured

Answer

The Decrypt-Web rule has a profile that blocks decryption

Answer

The source is set to 'any' in the Decrypt-Web rule

Question 14

Refer to the exhibit. An administrator notices a high number of decryption failures. What is the most likely cause?

Accepted Answer

The firewall's certificate is not trusted by client devices.. When the firewall's certificate is not trusted by client devices, clients will reject the SSL handshake, resulting in decryption failures. This is a common issue in SSL Forward Proxy deployments where the firewall generates a certificate for each session, and clients must trust the firewall's CA certificate. Without this trust, clients display certificate warnings or fail to connect, leading to a high number of decryption failures.

Answer

The SSL session cache size is too small.

Answer

SSL Forward Proxy is not enabled.

Answer

Non-HTTP traffic is being decrypted.

Question 15

A company uses Panorama to manage multiple firewalls. They have configured a template to push NTP settings, DNS, and authentication profiles. However, one firewall is not receiving the template settings. Which of the following is the most likely cause?

Accepted Answer

The firewall's management IP is not reachable from Panorama. Panorama pushes template settings to managed firewalls via a management-plane connection. If the firewall's management IP is not reachable from Panorama (e.g., due to network issues, incorrect IP, or routing problems), the template cannot be applied. This is the most direct cause of a firewall not receiving template settings, as Panorama requires reachability to commit and push configurations.

Answer

The template was not committed to Panorama

Answer

The firewall is not in the template's device group

Answer

The firewall has a local configuration that overrides the template