PCNSA Practice Test 5 — 10 Questions

Question 1

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. The most likely cause is that the new rule is placed at the bottom of the security policy rulebase. Palo Alto Networks firewalls evaluate rules from top to bottom. If an existing deny rule that matches the same traffic (e.g., any-any deny) is placed above the new allow rule, the deny rule will match first and block the traffic. Therefore, the new allow rule never gets evaluated. Option C correctly identifies this issue.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.

Question 2

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

Accepted Answer

Policy Optimizer. Policy Optimizer (Option A) is the correct answer because it analyzes existing firewall rules and provides recommendations to consolidate, merge, or remove redundant and unused rules, making it ideal for simplifying legacy policies before migration to a Palo Alto Networks firewall. Option B, WildFire, is a cloud-based threat analysis service and does not simplify rules. Option C, Application Override, is used to bypass application identification for specific traffic, not for policy simplification. Option D, User-ID, maps users to IP addresses for user-based policies, which does not address rule simplification.

Answer

WildFire

Answer

Application Override

Answer

User-ID

Question 3

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options with null label, A, and D are correct. The null option is correct because if the destination address object is not in the rule's referenced address group, the rule will not match the traffic. Option A is correct because the traffic must match the source zone specified in the rule; otherwise, the rule is skipped. Option D is correct because a disabled rule is not evaluated and thus will not be hit. Option B is incorrect because a high hit count indicates the rule is being hit, not that it is not matched. Option C is incorrect because log forwarding configuration does not affect rule matching. Option E is incorrect because even though the action is set to drop, the rule can still be matched (and then drops traffic), so it can be hit.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 4

A network administrator is migrating from a legacy firewall to a new Palo Alto Networks firewall. The current firewall has a large number of ACL rules that allow traffic based on source/destination IP and port. The administrator wants to convert these rules to App-ID based policies on the Palo Alto firewall. What is the recommended best practice to ensure a smooth migration while maintaining security?

Accepted Answer

Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.. The recommended best practice for migrating from legacy firewall rules to App-ID based policies is to first replicate the existing port-based rules on the Palo Alto firewall to ensure no disruption to traffic. Then, enable App-ID in learning mode (or 'log and learn') to observe the actual applications being used. This allows the administrator to identify applications without blocking them. After sufficient data is collected, the administrator can create App-ID based policies. Option A is incorrect because Policy Optimizer is used for optimization after migration, not as the first step. Option B is risky as it leaves no security policies. Option D could cause outages by immediately enforcing App-ID.

Answer

Use the Policy Optimizer feature in Panorama to analyze existing logs and generate App-ID based policy recommendations.

Answer

Deploy the Palo Alto firewall inline with no policies first, and let it learn the traffic patterns automatically for a week.

Answer

Convert all existing rules to App-ID by using the application default ports and immediately enforce application blocking.

Question 5

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny

Question 6

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Accepted Answer

The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.. The Anti-Malware profile set to 'default' relies on known signatures and may not detect malware using a custom packer that is not recognized. The default profile does not include advanced analysis like WildFire, which could identify unknown threats. Option A is incorrect because using application 'ssl' is appropriate for decrypted SSL traffic; the traffic is correctly identified. Option B is incorrect because while content updates for WildFire are important, the primary issue is the profile not leveraging WildFire analysis; the default profile may not send samples to WildFire even with latest updates. Option C is incorrect because the decryption exclusion list does not include the domain; the malware source is not in the financial services category.

Answer

The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Answer

The firewall is missing the latest content updates for WildFire.

Answer

The decryption exclusion list includes the domain of the malware source.

Question 7

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Accepted Answer

Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses. The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.

Answer

Ensure that the HA2 interfaces are also connected and configured correctly

Answer

Change the HA2 IP addresses to be on the same subnet as HA1

Answer

Enable HA ping on the HA1 interface to test connectivity

Question 8

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Accepted Answer

The firewall's root CA certificate deployed to client browsers. In forward proxy decryption, the firewall acts as a trusted intermediary by generating a certificate for each HTTPS site the user visits, signed by the firewall's own root CA. For this to work without browser security warnings, the firewall's root CA certificate must be deployed to every client browser's trusted root store. This allows the browser to trust the firewall's dynamically generated server certificates, enabling seamless decryption and inspection of outbound SSL/TLS traffic.

Answer

The server's private key

Answer

A security policy rule allowing decrypted traffic

Question 9

A company with a Palo Alto Networks firewall operating in Layer 2 transparent mode wants to control access to an internal ERP system. The ERP system uses a non-standard TCP port 4444. The security administrator creates a custom application object named 'ERP' with protocol set to 'tcp' and port range 4444-4444. Then, a security policy is configured allowing application 'ERP' from the internal zone to the ERP server zone. Users report they cannot connect to the ERP system. Firewall logs show no traffic matching the application 'ERP'. What should the administrator do to resolve the issue?

Accepted Answer

Create an Application Override policy for port 4444 and assign it to the 'ERP' application.. In Layer 2 transparent mode, Palo Alto Networks firewalls rely on Application Override policies to bypass App-ID for traffic that uses non-standard ports. Since the custom application 'ERP' is defined with TCP port 4444 but App-ID cannot identify it on that port (as it is non-standard), an Application Override policy explicitly maps the traffic to the 'ERP' application, allowing the security policy to match and permit the traffic.

Answer

Change the security rule to use 'application-default' instead of the custom application.

Answer

Add a service object for port 4444 and include it in the security rule.

Answer

Disable application identification on the firewall.

Question 10

An administrator notices that the firewall's time is incorrect. Based on the exhibit, what is the most likely cause?

Accepted Answer

NTP service is stopped. The firewall's time is incorrect because the NTP service is stopped. NTP (Network Time Protocol) is responsible for synchronizing the system clock with an external time source. Without NTP, the firewall relies on its internal hardware clock, which can drift over time, leading to an incorrect time.

Answer

DNS proxy is running

Answer

Management service is down

Answer

SNMP is running

Answer

Syslog is running