PCNSA Practice Test 4 — 10 Questions

Question 1

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 2

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies. WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 3

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Accepted Answer

Verify that the policy has the correct source zone.. Options B and C are correct. Verifying the source zone (B) ensures the policy is applied to the correct traffic flow. Checking the traffic log (C) shows whether the session matched a security policy. Option A (CPU usage) does not verify policy matching. Option D (Threat log) is for blocked malicious traffic, not for verifying allowed traffic. Option E (URL filtering profile) is a content inspection feature, not directly for verifying policy matching.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 4

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule. This is a standard method of creating an exception to a broader deny rule.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 5

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 6

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Placing the most specific rules at the top of the rulebase (option B) ensures that traffic is matched quickly and correctly, reducing latency. Regularly reviewing and removing unused rules using hit counts (option D) improves performance and reduces security risks. Option A is wrong because enabling logging on all rules can overwhelm storage and impact performance, not increase visibility effectively. Option C is wrong because using a single 'allow all' rule defeats the purpose of a security policy and allows any traffic. Option E is wrong because disabling unused rules leaves clutter and can cause confusion; it's better to remove them.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 7

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options C and D are correct. To ensure traffic is inspected by threat prevention features, you need a security rule that allows the traffic and includes a security profile group with threat prevention (C). Additionally, the rule's action must be set to 'allow' (D) for the traffic to pass through and be inspected; otherwise, traffic would be blocked. Option A (decryption) is only required for encrypted traffic, but the question does not specify that all traffic is encrypted, so it is not universally required. Option B (NAT) is for address translation, not inspection. Option E (application override) is not necessary for threat prevention.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 8

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. Logging at session start records the session creation, which corresponds to when the session is established. This meets the administrator's requirement to log traffic from engineering to server zone only when a session is established. Option A (log at both session start and end) is incorrect because it would create duplicate logs and potentially excessive logging. Option B (no log) is incorrect because it provides no audit trail. Option C (log at session end) is incorrect because it logs only when the session terminates, not at establishment.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 9

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection. Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 10

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.