PCNSA Practice Test 6 — 10 Questions

Question 1

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rule with a broader match exists above the blocking rule in the rulebase.. In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Answer

The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

Answer

The custom object containing the malicious IP was not committed.

Answer

The device clock is out of sync, causing time-based rules to fail.

Question 2

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Accepted Answer

Apply the log forwarding profile to a security policy rule.. A log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Answer

Set the syslog server to use TCP port 514.

Answer

Specify the syslog facility code in the log forwarding profile.

Question 3

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Accepted Answer

Block the social-networking category and allow a custom URL category containing LinkedIn URLs.. To block all social media except LinkedIn, you must block the social-networking URL category and allow a custom URL category containing LinkedIn URLs. URL filtering evaluates custom categories with higher priority than predefined categories, so the allow action for LinkedIn overrides the block for social-networking. This achieves the granular exception without unblocking the entire category.

Answer

Alert the social-networking category and block a custom URL category for LinkedIn.

Answer

Block the social-networking category and block a custom URL category for LinkedIn.

Answer

Allow the social-networking category and block a custom URL category for LinkedIn.

Question 4

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

Accepted Answer

Asymmetric routing. The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Answer

Application override configured for HTTP

Answer

DNS resolution failure

Answer

NAT policy mismatch

Question 5

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. Option A is correct because a security rule that references the application by name (via App-ID) and sets the action to 'deny' blocks all traffic identified as that application regardless of which ports it uses, which is exactly what is needed for a multi-port application. Option E is correct because an Application Override policy lets the firewall reclassify traffic on specified ports as a known application, after which a security rule can deny that application, providing a way to block traffic that App-ID might not otherwise identify across its multiple ports. Option B is not ideal because blocking only the common ports leaves the application free to use other ports, so it does not reliably block all traffic from the application. Option C is wrong because disabling App-ID removes the ability to identify and control the application by name. Option D is wrong because allowing the application with a limit still permits traffic rather than blocking it.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 6

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 7

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Accepted Answer

Create a decryption exclusion rule for specific URLs or categories.. Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites. Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Answer

Rely on the browser's security settings to prevent decryption.

Answer

Disable SSL Decryption globally when the user visits sensitive sites.

Answer

Use a policy to decrypt only HTTP traffic.

Question 8

A network engineer is configuring a new PA-220 firewall in a small branch office. The firewall must be managed centrally from Panorama. What is the first step after physically installing the firewall?

Accepted Answer

Configure the management IP address and authenticate to Panorama.. The correct first step after physically installing a Palo Alto Networks firewall is to configure the management IP address and authenticate to Panorama. Without a reachable management IP, the firewall cannot communicate with Panorama for registration, device group assignment, or configuration pushes. This foundational step establishes the initial network connectivity required for all subsequent centralized management operations.

Answer

Register the firewall with Panorama using the serial number.

Answer

Create a device group in Panorama and add the firewall.

Answer

Push the initial configuration from Panorama to the firewall.

Question 9

Which TWO statements about App-ID are correct? (Choose two.)

Accepted Answer

App-ID can identify applications even if they use standard ports for other services.. Option A is correct because App-ID performs application identification through deep packet inspection and protocol decoding rather than relying on TCP/UDP port numbers, so it can detect an application even when it runs on a port normally associated with a different service (for example, SSH tunneled over port 80 or peer-to-peer traffic on port 443). Option D is correct because App-ID relies on a signature- and context-based engine that matches known application traffic patterns, protocol behaviors, and heuristics to classify applications accurately. Options B, C, and E are incorrect: App-ID is not limited to well-known commercial applications (it also identifies custom, evasive, and unknown applications), it does not primarily identify applications by port numbers (that is the legacy port-based approach App-ID replaces), and it does not require a fixed minimum of 10 packets, since identification can occur after the first few packets or even the first packet depending on the protocol.

Answer

App-ID is only effective for well-known commercial applications.

Answer

App-ID primarily identifies applications based on port numbers.

Answer

App-ID requires at least 10 packets to identify an application.

Question 10

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

Accepted Answer

The service group should not include service-https. The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Answer

The application web-browsing should not be in the rule

Answer

The rule action should be deny

Answer

The source IP should be an address group