PCNSA Practice Test 37 — 15 Questions

Question 1

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Accepted Answer

The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.. The most likely cause is that the new subnet is routed through a different virtual router (VR) than the one used by the Internal zone's interface. The security policy is zone-based, but if the traffic ingresses via an interface in a different VR, the zone association may change, preventing the rule from matching. Option A correctly identifies this scenario.

Answer

The application is not correctly identified because the SSH server uses a non-standard port.

Answer

There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.

Answer

The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.

Question 2

A network administrator is tasked with implementing a policy that allows traffic from the 'Sales' zone to the 'Internet' zone only for web-browsing (application: web-browsing) and blocks all other traffic. The administrator creates a rule at the top of the security policy with source zone Sales, destination zone Internet, application web-browsing, action allow. Below that, a rule with source zone Sales, destination zone Internet, application any, action deny. After committing, users in Sales can browse the web normally. However, the administrator discovers that some users are able to use applications like YouTube and Facebook which use web-browsing as part of their app-id. The administrator wants to ensure that only HTTP/HTTPS traffic for general web browsing is allowed, not other web-based applications. What should the administrator do?

Accepted Answer

Use URL filtering to block the social networking and streaming media categories.. Using URL filtering to block social media categories is effective and does not interfere with general web browsing. Changing the allow rule's application to HTTP/HTTPS would still allow Facebook and YouTube because they use HTTPS. Custom application filters or deny rules are less precise or affect allowed traffic.

Answer

Change the allow rule's application to include only HTTP and HTTPS.

Answer

Add a custom application filter to block social media applications.

Answer

Change the deny rule to block social media applications.

Question 3

A small business has a Palo Alto Networks firewall with a single security policy rule that allows all traffic from the 'Trust' zone to the 'Untrust' zone. The business recently experienced a malware infection originating from an internal host that communicated with known malicious IP addresses. The administrator wants to implement a security policy to block traffic to these malicious IP destinations. The administrator has a list of 500 malicious IP addresses that may change frequently. What is the most efficient way to create a policy to block traffic to these IPs?

Accepted Answer

Create an External Dynamic List (EDL) of the malicious IPs and reference it in a security rule as destination address, with action deny, placed above the allow rule.. External Dynamic Lists (EDLs) are designed to manage large, frequently updated lists of IP addresses. They integrate with security rules and can be updated automatically, minimizing administrative overhead.

Answer

Create a security rule with an address group containing the 500 IPs as destination, action deny, placed above the allow rule.

Answer

Create a security rule with source zone Trust, destination zone Untrust, source address list containing the 500 IPs, action deny.

Answer

Create a security rule with source zone Trust, destination zone Untrust, destination address list containing the 500 IPs as separate address objects, action deny, placed above the allow rule.

Question 4

A company with a Palo Alto Networks firewall operating in Layer 2 transparent mode wants to control access to an internal ERP system. The ERP system uses a non-standard TCP port 4444. The security administrator creates a custom application object named 'ERP' with protocol set to 'tcp' and port range 4444-4444. Then, a security policy is configured allowing application 'ERP' from the internal zone to the ERP server zone. Users report they cannot connect to the ERP system. Firewall logs show no traffic matching the application 'ERP'. What should the administrator do to resolve the issue?

Accepted Answer

Create an Application Override policy for port 4444 and assign it to the 'ERP' application.. Option C is correct because in Layer 2 transparent mode, Palo Alto Networks firewalls rely on Application Override policies to bypass App-ID for traffic that uses non-standard ports. Since the custom application 'ERP' is defined with TCP port 4444 but App-ID cannot identify it on that port (as it is non-standard), an Application Override policy explicitly maps the traffic to the 'ERP' application, allowing the security policy to match and permit the traffic.

Answer

Change the security rule to use 'application-default' instead of the custom application.

Answer

Add a service object for port 4444 and include it in the security rule.

Answer

Disable application identification on the firewall.

Question 5

A company has deployed PA-220 firewalls at 50 branch offices, each connected to the corporate headquarters via IPSec VPN tunnels. Recently, users have reported slow file transfers across the VPN, especially for large files. The network team has checked link utilization and found that the VPN tunnel bandwidth is under 20% utilized, and CPU on the firewalls is around 40%. The security policies are basic, with no threat prevention profiles applied to the VPN traffic. The team suspects the issue is related to VPN performance. After reviewing the configuration, they notice that the VPN tunnels are configured with default settings. Which of the following actions would most likely improve VPN throughput without requiring hardware upgrades or changing the security level?

Accepted Answer

Enable hardware acceleration for the VPN tunnel on the branch firewalls.. The PA-220 firewall includes hardware acceleration for IPsec VPN processing, but this feature is not enabled by default. Enabling hardware acceleration offloads cryptographic operations to dedicated hardware, significantly improving throughput for large file transfers without requiring hardware upgrades or reducing security. Since the VPN tunnel bandwidth is underutilized and CPU is moderate, the bottleneck is likely software-based encryption, which hardware acceleration directly addresses.

Answer

Upgrade the branch office firewalls to PA-800 series appliances.

Answer

Change the VPN IPSec cipher suite to use AES-256-GCM for stronger encryption.

Answer

Increase the MTU on the VPN tunnel interface to 1500 bytes to reduce fragmentation.

Question 6

A small company runs a Palo Alto Networks PA-220 firewall with three zones: trust (internal users), untrust (internet), and dmz (public-facing services). They host a web server on IP 10.0.1.10 in the dmz zone, serving HTTPS content. The administrator created a security policy rule that allows traffic from untrust to dmz with source 'any', destination 10.0.1.10, service HTTPS, and action allow. No security profiles are applied to this rule. Users outside the company can access the web server successfully. However, the administrator notices from log reports that certain application-based attacks, such as SQL injection and cross-site scripting, are reaching the web server undetected. The firewall has the required threat prevention licenses installed. What is the best course of action to improve security posture?

Accepted Answer

Add a decryption policy to decrypt HTTPS traffic for inspection.. The correct answer is A because the traffic is HTTPS, which is encrypted. Without decryption, the firewall cannot inspect the payload for application-based attacks like SQL injection or XSS, even with threat prevention licenses. Adding a decryption policy allows the firewall to decrypt the traffic, apply threat prevention profiles, and detect these attacks.

Answer

Change the rule's security profile group to include threat prevention profiles.

Answer

Move the web server to the trust zone and adjust routing.

Answer

Enable vulnerability protection profile on the existing rule.

Question 7

A company has a pair of PA-5220 firewalls configured in an active/passive high-availability (HA) cluster. The devices are managed via Panorama, which also manages other firewalls. The security team reports that after a recent commit on Panorama, the passive firewall in the HA pair stops responding to management pings. The active firewall continues to pass traffic and is manageable. Upon investigation, the passive firewall shows the following on its console: 'Management plane is down.' The administrator suspects the passive firewall might have received a configuration that disables the management interface. What should the administrator do to restore management access to the passive firewall without affecting production traffic?

Accepted Answer

Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.. Option B is correct because when the passive firewall's management plane is down and it is unresponsive to management pings, console access is the only way to interact with it. Password recovery mode allows the administrator to reset the management interface configuration without affecting the active firewall or production traffic, as the passive firewall is not forwarding data traffic in an active/passive HA cluster.

Answer

From the active firewall CLI, run 'request high-availability sync-to-remote running-config'.

Answer

Disconnect the HA link and reset the passive firewall to factory defaults.

Answer

Reboot the passive firewall to load the previous running configuration.

Question 8

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

Accepted Answer

Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.. Option C is correct because the traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Answer

Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.

Answer

Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.

Answer

Modify the rule to use application 'any' to allow all applications.

Question 9

A company has multiple branch offices connected via IPsec tunnels to a central datacenter. The central datacenter has a PA-5250 running PAN-OS 10.1. The security team wants to enforce that traffic between branches is inspected by the central firewall, not directly between branches. They configure security policies to allow inter-branch traffic through the central firewall. However, they notice that traffic between two branches (Branch A and Branch B) is not traversing the central firewall and is instead going directly between the branches via the IPsec tunnels which are configured as route-based VPNs. The security team has verified that the security policies are correctly configured to require the traffic to go through the central datacenter. What is the most likely cause?

Accepted Answer

The route-based VPN tunnels are using static routes that are more specific than the routes advertised by the central firewall.. The most likely cause is that the route-based VPN tunnels between branches use static routes with a more specific prefix (e.g., /24) than the routes advertised by the central firewall (e.g., /16). In route-based VPNs, the firewall makes forwarding decisions based on the routing table; more specific routes have a higher priority regardless of administrative distance or metric. Therefore, Branch A's traffic destined for Branch B matches the more specific static route pointing directly to Branch B's IPsec tunnel, bypassing the central firewall despite security policies requiring inspection.

Answer

The IPsec tunnel between branches is configured with a higher metric than the tunnel to the central firewall.

Answer

The security policy rules are not in the correct order; a rule allowing direct traffic is matched first.

Answer

The route-based VPN tunnels between branches are in the same virtual router and have a higher administrative distance than the central tunnel, causing a routing loop.

Question 10

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

Accepted Answer

The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.. Option C is correct because App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Answer

The firewall needs to have Application Override enabled for the custom signature to work.

Answer

The firewall must be restarted to apply the new custom signature.

Answer

The signature must be imported from the Palo Alto Networks application database.

Question 11

A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?

Accepted Answer

Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.. The core issue is that inbound decryption is incorrectly applied to traffic from internal clients to the internal server, causing double decryption when the server subsequently initiates outbound connections. By ensuring the inbound decryption rule only applies to traffic from external sources (i.e., source zone is untrust), internal-to-internal traffic bypasses inbound decryption, eliminating the double-decryption loop. This aligns with best practices where inbound decryption is scoped to traffic originating outside the network.

Answer

Create a decryption exclusion rule for traffic between internal clients and the internal server.

Answer

Disable outbound decryption for the subnet of the internal server.

Answer

Use a no-decrypt rule for traffic from the internal server's IP to the internet.

Question 12

A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?

Accepted Answer

Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.. Option B is correct because the firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.

Answer

Configure User-ID and enable User-ID mapping for the web traffic.

Answer

Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.

Answer

Create custom App-ID signatures for the web servers.

Question 13

A university uses a Palo Alto firewall for outbound SSL decryption. The IT helpdesk receives complaints that students cannot access certain educational resource websites (e.g., online libraries, research databases) after decryption was enabled. The firewall logs show 'decryption failure' for these sites with reason 'certificate validation failure'. The decryption profile is set to 'Block sessions with expired certificates' and 'Block sessions with untrusted issuers'. The helpdesk verifies that the root CA certificate is installed on all endpoints. The issue is intermittent and only affects a few sites. What should the administrator do?

Accepted Answer

Use a decryption profile that allows sessions with certificate status unknown.. The correct answer is D because the 'decryption failure' with 'certificate validation failure' and 'certificate status unknown' indicates that the firewall cannot determine the revocation status of the site's certificate (e.g., no CRL or OCSP responder reachable). The current decryption profile blocks sessions with expired certificates and untrusted issuers, but it does not explicitly block sessions with 'certificate status unknown'. By using a decryption profile that allows sessions with certificate status unknown, the firewall will permit the SSL handshake to proceed even when revocation checking fails, resolving the intermittent access issues for those specific educational sites.

Answer

Update the firewall's certificate revocation list (CRL).

Answer

Add the websites to a decryption policy exception rule.

Answer

Disable blocking for untrusted issuers in the decryption profile.

Question 14

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Accepted Answer

The decryption rule is configured with the forward proxy method.. Option D is correct because inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule. Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Answer

The firewall does not support wildcard certificates for inbound decryption.

Answer

The web server is not properly configured to handle decrypted traffic.

Answer

The decryption profile is set to 'Block sessions with untrusted certificates'.

Question 15

An administrator configures log forwarding to send traffic logs to a syslog server. After applying the log forwarding profile to the security policy, logs are not appearing at the syslog server. The administrator verifies that the syslog server is reachable from the firewall's management IP by using ping, and that the syslog service is running on the server. What is the most likely cause?

Accepted Answer

The syslog server is not configured in the Server Profiles.. Option C is correct because log forwarding in Palo Alto Networks firewalls requires a syslog server profile to be configured under Device > Server Profiles > Syslog. Without this profile, the firewall has no destination address or port to send logs to, even if the syslog server is reachable via ping. The log forwarding profile references the server profile; if the server profile is missing or misconfigured, logs will not be forwarded.

Answer

The security policy matching the traffic does not have logging enabled.

Answer

The firewall's data port IP is not used for logging.

Answer

The log forwarding profile is not committed.