PCNSA Practice Test 7 — 10 Questions

Question 1

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The address object has multiple tags including the wrong one. Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Answer

The group is configured as static

Answer

The dynamic group uses 'match all' and the object lacks some tags

Answer

The administrator added the object directly to the group

Question 2

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Accepted Answer

Antivirus. Antivirus (A) is correct because it scans traffic for known malware signatures and malicious payloads, directly blocking viruses, worms, and trojans at the content level. Anti-Spyware (E) is correct because it detects and blocks spyware, keyloggers, and command-and-control traffic that antivirus signatures may not cover, providing complementary malware protection. Vulnerability Protection (C) is correct because it inspects traffic for exploits targeting software vulnerabilities, blocking the delivery mechanisms malware often uses to compromise hosts. URL Filtering (B) is not marked correct because it primarily controls web access by category or reputation rather than blocking malware itself, and File Blocking (D) is not marked correct because it restricts file transfers by type rather than detecting malicious content.

Answer

URL Filtering

Answer

File Blocking

Question 3

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access

Question 4

Match each Palo Alto Networks service to its typical use.

Accepted Answer

Panorama: Centralized management and reporting for multiple firewalls. Panorama is used for centralized management and reporting of multiple firewalls. WildFire provides cloud-based malware analysis and prevention. Common confusions include swapping these services or confusing them with AutoFocus.

Answer

Panorama: Cloud-based threat intelligence

Answer

WildFire: Centralized management for firewalls

Question 5

An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?

Accepted Answer

Both destination port and protocol. In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.

Answer

Destination port

Answer

Source port

Answer

Protocol

Question 6

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Accepted Answer

Use a dedicated physical interface or VLAN for HA heartbeat communication. Using a dedicated physical interface or VLAN for the HA heartbeat (HA1) isolates control-plane HA traffic from data-plane traffic, preventing data congestion from delaying or dropping heartbeat packets and causing false failovers. Palo Alto best practice is to dedicate HA1 for control/heartbeat and HA2 for data link synchronization. This separation ensures reliable election and state sync.

Answer

Set both firewall's HA election delay to '0' for fast failover

Answer

Enable preemptive mode to ensure the primary firewall always resumes control

Answer

Configure both firewalls in active/active mode to maximize throughput

Question 7

Refer to the exhibit. An administrator notices a high number of decryption failures. What is the most likely cause?

Accepted Answer

The firewall's certificate is not trusted by client devices.. When the firewall's certificate is not trusted by client devices, clients will reject the SSL handshake, resulting in decryption failures. This is a common issue in SSL Forward Proxy deployments where the firewall generates a certificate for each session, and clients must trust the firewall's CA certificate. Without this trust, clients display certificate warnings or fail to connect, leading to a high number of decryption failures.

Answer

The SSL session cache size is too small.

Answer

SSL Forward Proxy is not enabled.

Answer

Non-HTTP traffic is being decrypted.

Question 8

An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?

Accepted Answer

RDP. TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.

Answer

FTP

Answer

SSH

Answer

Telnet

Question 9

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

Accepted Answer

A file blocking profile is blocking the upload.. A file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Answer

The application 'webapp' is not allowed due to an application override.

Answer

SSL decryption is not enabled.

Answer

App-ID is not identifying the application correctly.

Question 10

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Accepted Answer

Use a script that logs in via SSH and runs 'save config to scp/tftp'. The firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Answer

Use the CLI command 'request system backup config schedule'

Answer

Set a recurring cron job via the firewall's built-in cron