PCNSA Practice Questions 1 — 50 Questions

Question 1

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

Accepted Answer

File Blocking profile. The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Answer

Data Filtering profile

Answer

Application filter in security rule

Answer

URL Filtering profile

Question 2

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad. Option D allows all traffic.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 3

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 4

Refer to the exhibit. A security rule is configured with destination address group 'internal-servers'. A packet with destination IP 10.10.20.5 arrives. Will the rule match?

Accepted Answer

Yes, because 10.10.20.5 is within the range of server2.. 10.10.20.5 is within the IP range defined by server2 (10.10.20.1-10.10.20.10). Option B is wrong because address groups can contain multiple objects. Option C is wrong because the group does not include all internal addresses. Option D is wrong because destination can be a range or subnet.

Answer

No, because the destination must be a single IP address.

Answer

Yes, because the address group includes all internal addresses.

Answer

No, because the address group uses multiple objects.

Question 5

An administrator wants to require users in the Internal zone to authenticate via User-ID before accessing the Internet. Which policy configuration is necessary to enforce this requirement?

Accepted Answer

Configure a security rule with a user-id condition set to 'known-user' and action 'allow' with 'require authentication' selected.. To require authentication, the security rule must include a user-id condition with the 'require authentication' action.

Answer

Create an authentication policy that maps users to roles.

Answer

Configure a captive portal on the firewall to prompt for credentials.

Answer

Enable User-ID on the Internal zone under Zone properties.

Question 6

An administrator is reviewing the rulebase and finds a rule with a hit count of 0 over the past 30 days. What action should the administrator consider?

Accepted Answer

Consider removing the rule as it is not being used.. A rule with no hits is unused and can be cleaned up to improve policy performance. Option A is wrong because increasing logging won't help if the rule is not matching. Option C is wrong because moving the rule higher won't cause matches if the rule doesn't match traffic. Option D is wrong because disabling the rule is not as good as removal for cleanup.

Answer

Move the rule higher in the rulebase.

Answer

Increase the log setting to capture more data.

Answer

Disable the rule to see if any traffic matches.

Question 7

A security administrator notices that a newly added security rule, designed to allow SSH traffic from the engineering department to a Linux server, is not being matched. The rule is placed above an existing 'deny all' rule. What is the most likely cause?

Accepted Answer

The rule's source zone or address does not match the engineering department traffic.. If the zone or source address is misconfigured, the traffic will not match the intended rule and will be matched by later rules. Option A is wrong because rule ordering is correct (rule above deny all). Option C is wrong because hit count is irrelevant to the cause of no match. Option D is wrong because the rule is placed in the correct position.

Answer

The rule is placed below the deny all rule.

Answer

The rule has a low hit count.

Answer

The rule is placed after the deny all rule.

Question 8

A company wants to block all traffic from the Guest zone to the Corporate zone except DNS. What is the best practice for configuring the security policy?

Accepted Answer

Create an allow rule for DNS from Guest to Corporate, placed above a deny rule for any other traffic.. Best practice is to place the allow rule before the deny rule to ensure permitted traffic is not blocked by a broader deny rule.

Answer

Create a deny rule for any traffic from Guest to Corporate, placed above an allow rule for DNS.

Answer

Rely on the interzone default rule, which blocks all traffic, and add a rule to allow DNS.

Answer

Create a universal rule that applies to all zones with action 'allow' for DNS and 'deny' for everything else.

Question 9

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Accepted Answer

Dashboard. The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

Answer

Policy Optimizer

Answer

Log Viewer

Answer

Reports

Question 10

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

Accepted Answer

Suspend the passive firewall, then re-suspend it to trigger a full configuration synchronization.. Suspending and then re-suspending the passive firewall forces a full configuration synchronization from the active to the passive node. This is the most efficient method to resync after a software upgrade, as it triggers a complete config push without requiring a reboot or factory reset, preserving the HA state and minimizing disruption.

Answer

Restart both firewalls to automatically trigger a configuration sync.

Answer

Perform a factory reset on the passive firewall and re-join it to the HA pair.

Answer

Suspend the active firewall to make the passive take over, then restore the config.

Question 11

Refer to the exhibit. A user at IP 10.1.1.5 on the untrust zone is trying to access a server on the trust zone. The traffic is being blocked by a default deny rule instead of being allowed by rule1. What is the most likely reason?

Accepted Answer

The rule uses negation on the source address.. When a rule uses negation on the source address (e.g., 'not 10.1.1.5'), the firewall treats the source as 'any IP except 10.1.1.5'. This means traffic from 10.1.1.5 will not match the rule, causing it to fall through to the default deny rule. Negation in Palo Alto Networks policies explicitly excludes the specified address from matching, which is a common misconfiguration.

Answer

The rule's destination is set to 'any' which is too broad.

Answer

The rule does not specify any application or service.

Answer

The rule has not been committed.

Question 12

Drag and drop the steps to configure a NAT policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Navigate to Policies > NAT, add rule > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Configure Translated Packet (Translated Source, Translated Destination) > Commit. NAT policy configuration requires specifying original and translated addresses, service, and committing.

Answer

Navigate to Policies > NAT, add rule > Configure Translated Packet (Translated Source, Translated Destination) > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Commit

Answer

Configure Original Packet > Navigate to Policies > NAT, add rule > Configure Translated Packet > Commit

Answer

Navigate to Policies > NAT, add rule > Configure Original Packet > Commit > Configure Translated Packet

Question 13

After making configuration changes, an administrator clicks 'Commit' but the changes are not applied. What is the most likely cause?

Accepted Answer

Configuration validation errors exist. When an administrator clicks 'Commit' but the changes are not applied, the most likely cause is that configuration validation errors exist. The Palo Alto Networks firewall performs a validation check before committing; if any errors are found (e.g., invalid IP addresses, missing required fields, or conflicting rules), the commit is blocked and an error message is displayed. This ensures that only syntactically and semantically correct configurations are applied to the running state.

Answer

The commit is scheduled for a later time

Answer

The commit was canceled by another admin

Answer

The firewall is in multi-vsys mode and only the current vsys is committed

Question 14

Based on the log excerpt, which object is used for the destination address?

Accepted Answer

Address 'any'. The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.

Answer

Zone 'untrust'

Answer

Application 'web-browsing'

Answer

Service 'service-http'

Question 15

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. A security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 16

What is the most likely reason the traffic is being denied?

Accepted Answer

A threat prevention profile is blocking the application due to its 'evasive-behavior' characteristic.. The question describes a scenario where traffic is denied despite the application being identified by App-ID. A threat prevention profile can block applications that exhibit 'evasive-behavior' characteristics, such as using non-standard ports or encryption to evade detection. This is a common security control in Palo Alto Networks firewalls to prevent malicious or evasive applications from bypassing policy.

Answer

The application is not actually matching the rule.

Answer

A DoS protection policy is blocking the traffic.

Answer

App-ID is incorrectly identifying the traffic.

Question 17

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Accepted Answer

rule 2 (allow-dns). Rule 2 (allow-dns) specifically allows DNS application from trust zone to untrust zone. Option A is incorrect because rule 2 does match. Option B (deny-all) would only match if no prior rule matches, but rule 2 matches first. Option D (allow-http) only allows web-browsing, not DNS.

Answer

No rule will match

Answer

rule 3 (deny-all)

Answer

rule 1 (allow-http)

Question 18

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit. VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Answer

Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit

Answer

Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit

Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy

Question 19

A company uses Panorama to manage multiple firewalls. The administrator wants changes made in Panorama to be automatically pushed to managed firewalls without manual intervention. Which setting should be enabled?

Accepted Answer

Auto Commit in Panorama Push Settings. The 'Auto Commit on Panorama Push Settings' feature enables Panorama to automatically commit and push configuration changes to managed firewalls immediately after an administrator commits on Panorama, eliminating the need for manual intervention. This setting is specifically designed for automated deployment workflows where changes must be propagated without delay.

Answer

Scheduled Config Update

Answer

Auto Push on Panorama

Answer

Schedule Commit

Answer

Commit on Startup

Question 20

Refer to the exhibit. Which profile group is applied to this security rule?

Accepted Answer

strict-profile-group. The exhibit shows the security rule's 'Profile Group' field set to 'strict-profile-group', which applies a predefined set of security profiles (antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking) to the rule. This is visible in the rule configuration where the profile group is explicitly selected, not set to 'none' or a custom group.

Answer

No profile group is applied

Answer

log-profile-group

Answer

default-profile-group