PCNSA Practice Test 6 — 10 Questions

Question 1

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

Accepted Answer

A security policy rule that allows traffic from the internet zone to the DMZ zone and has a threat prevention profile attached.. A security policy rule that allows traffic from the internet zone to the DMZ zone with a threat prevention profile attached is the essential component to inspect all traffic from the internet to the internal web server for threats. The threat prevention profile enables the firewall to perform intrusion prevention system (IPS) and antivirus inspection on the allowed traffic, ensuring malicious content is blocked. Without this profile, traffic would be permitted but not inspected for threats, failing the requirement.

Answer

Destination NAT policy to translate the public IP to the internal server.

Answer

SSL decryption policy to decrypt traffic to the web server.

Answer

A QoS policy to prioritize web traffic.

Question 2

A network engineer is configuring a new PA-220 firewall in a small branch office. The firewall must be managed centrally from Panorama. What is the first step after physically installing the firewall?

Accepted Answer

Configure the management IP address and authenticate to Panorama.. The correct first step after physically installing a Palo Alto Networks firewall is to configure the management IP address and authenticate to Panorama. Without a reachable management IP, the firewall cannot communicate with Panorama for registration, device group assignment, or configuration pushes. This foundational step establishes the initial network connectivity required for all subsequent centralized management operations.

Answer

Register the firewall with Panorama using the serial number.

Answer

Create a device group in Panorama and add the firewall.

Answer

Push the initial configuration from Panorama to the firewall.

Question 3

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 4

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. A Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 5

A security administrator is reviewing best practices for creating security policies on a Palo Alto Networks firewall. Which two of the following are recommended practices?

Accepted Answer

Use security profile groups to apply multiple profiles.. Security profile groups allow administrators to bundle multiple security profiles (e.g., antivirus, anti-spyware, vulnerability protection, URL filtering) into a single object. This simplifies policy management, ensures consistent enforcement, and reduces the risk of misconfiguration by applying a predefined set of protections to a rule.

Answer

Use security policy tags to group rules.

Answer

Use the 'any' zone for source and destination to reduce rule count.

Answer

Disable logging on rules that permit traffic to reduce log volume.

Question 6

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

Accepted Answer

Create an App-ID override for the application's specific IP addresses and ports.. An App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Answer

Disable App-ID for the security policy rule that allows this traffic.

Answer

Upgrade the App-ID database to the latest version.

Answer

Add the application's TCP port to the service definition in the security policy.

Question 7

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

Accepted Answer

Use the Policy Optimizer tool to view rule hit counts.. The Policy Optimizer tool in Palo Alto Networks firewalls provides rule hit counts, allowing administrators to quickly identify which security rules are not being used. Option A, 'show rulebase', displays the rulebase but does not show hit counts. Option B, checking commit logs, reveals recent changes but not usage frequency. Option C, sorting rules by rule number, does not indicate whether rules are used.

Answer

Use the 'show rulebase' command.

Answer

Check the commit logs for recent changes.

Answer

Sort rules by rule number in descending order.

Question 8

Refer to the exhibit. A security analyst notices that URL filtering is blocking some requests, but decryption is working. What can be concluded about the traffic that is being decrypted?

Accepted Answer

The URL filtering profile is applied to the same rule that enables decryption.. The URL filtering statistics show total requests and blocked counts, but decryption statistics show 1200 sessions decrypted. The exhibit does not provide a direct correlation between decrypted sessions and URL filtering. However, since URL filtering inspects HTTP/HTTPS traffic, decryption enables it to see encrypted payloads. The blocked URLs (malware, spyware) likely come from decrypted sessions.

Answer

The firewall is decrypting traffic but not inspecting it for threats.

Answer

All decrypted traffic is inspected by URL filtering.

Answer

GlobalProtect is required for decryption to work.

Question 9

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Accepted Answer

Create a security rule with a URL category set to 'internal-ip'.. The correct answers are B and E. Option B is valid because the 'internal-ip' URL category automatically applies to traffic from internal IP addresses, effectively bypassing URL filtering for internal users when used in a security rule with an allow action. Option E is valid because you can create a custom URL category listing internal websites that should be allowed, then use it in a security rule that allows traffic for internal users while applying strict filtering to external traffic. Option A is incorrect because URL Filtering profile override is not a standard feature; User-ID agent configuration does not provide such override. Option C is incorrect because setting the action to 'alert' only logs the traffic, it does not bypass the filtering (the traffic is still subject to the block action if matched). Option D is incorrect because there is no IP exemption list in URL filtering profiles; exemptions are based on URL categories, not IP addresses.

Answer

Enable URL Filtering profile override on the user-id agent configuration.

Answer

Set the URL Filtering profile action to 'alert' instead of 'block'.

Answer

Add the user's IP address to an exemption list in the URL filtering profile.

Question 10

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Accepted Answer

The SSH key exchange algorithm used by the client or server is not in the firewall's supported list.. The error message indicates 'unsupported key exchange algorithm'. SSH decryption requires the firewall to act as a proxy and re-encrypt the session. If the client or server uses a key exchange algorithm that the firewall does not support, decryption will fail. The exhibit shows a policy for SSH decryption and a session, but the algorithm is not supported.

Answer

The firewall does not have a certificate installed for SSH decryption.

Answer

The SSH session is using a cipher that is not supported by the firewall's decryption engine.

Answer

The decryption policy is misconfigured because the service is set to 'any' instead of 'ssh'.