PCNSA Practice Test 7 — 10 Questions

Question 1

A university uses a Palo Alto firewall for outbound SSL decryption. The IT helpdesk receives complaints that students cannot access certain educational resource websites (e.g., online libraries, research databases) after decryption was enabled. The firewall logs show 'decryption failure' for these sites with reason 'certificate validation failure'. The decryption profile is set to 'Block sessions with expired certificates' and 'Block sessions with untrusted issuers'. The helpdesk verifies that the root CA certificate is installed on all endpoints. The issue is intermittent and only affects a few sites. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a decryption profile that allows sessions with certificate status unknown.. The 'decryption failure' with 'certificate validation failure' and 'certificate status unknown' indicates that the firewall cannot determine the revocation status of the site's certificate (e.g., no CRL or OCSP responder reachable). The current decryption profile blocks sessions with expired certificates and untrusted issuers, but it does not explicitly block sessions with 'certificate status unknown'. By using a decryption profile that allows sessions with certificate status unknown, the firewall will permit the SSL handshake to proceed even when revocation checking fails, resolving the intermittent access issues for those specific educational sites.

Answer

Update the firewall's certificate revocation list (CRL).

Answer

Add the websites to a decryption policy exception rule.

Answer

Disable blocking for untrusted issuers in the decryption profile.

Question 2

Refer to the exhibit. A user reports that they receive a certificate warning when accessing https://example.com. The firewall is configured to decrypt SSL traffic. What is the most likely cause?

Accepted Answer

The client device does not have the firewall's CA certificate installed in its trusted root store.. The log shows an error 'Certificate is not trusted by client'. This typically occurs when the firewall's decryption CA certificate is not installed in the client's trusted root store. The firewall's certificate is valid, but the client does not trust it.

Answer

The web server's certificate is invalid and the firewall is not configured to block untrusted certificates.

Answer

The decryption policy is not matching the traffic because the destination is not specified.

Answer

The firewall's decryption certificate is expired.

Question 3

Refer to the exhibit. What does this log indicate?

Accepted Answer

An intrusion was detected and dropped.. The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Answer

A file transfer was blocked.

Answer

An intrusion was detected and allowed.

Answer

A URL filtering event occurred.

Question 4

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 5

Refer to the exhibit. The administrator notices that traffic from 192.168.1.100 to 10.1.1.1 using HTTPS is being blocked. What is the most likely cause?

Accepted Answer

The application is web-browsing, but HTTPS uses ssl application.. The exhibit shows a security policy rule that allows 'web-browsing' application traffic. HTTPS traffic uses the 'ssl' application, not 'web-browsing'. Since the rule's application match is set to 'web-browsing', it does not match HTTPS sessions, causing them to be blocked by the implicit deny rule at the end of the policy.

Answer

The source IP is not in the range.

Answer

The destination is in 10.0.0.0/8 but the policy is missing service TCP/443.

Answer

The rule is not committed.

Question 6

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Accepted Answer

Application object. Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Answer

Application filter

Answer

Application group

Answer

Service object

Question 7

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Accepted Answer

The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.. The URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.

Answer

The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.

Answer

The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.

Answer

The firewall has insufficient memory to process URL lookups and is dropping packets.

Question 8

Which THREE actions can be performed in a decryption policy? (Choose three.)

Accepted Answer

No-decrypt. In Palo Alto Networks decryption policy, the valid actions are Decrypt, No-decrypt, and Block. These three actions control how traffic is handled. Option D (Block) is indeed a valid decryption policy action; it is used to block traffic when decryption cannot be performed or is not allowed. Options A (App-ID) and B (Allow) are not decryption policy actions; they are security policy actions.

Answer

App-ID

Answer

Allow

Question 9

A Panorama-managed firewall currently allows SSH access from any IP. The security policy requires that administrative access to the firewall be possible only from Panorama. What should be configured?

Accepted Answer

Configure the management interface to accept connections only from the Panorama IP address.. The requirement is to restrict administrative access to the firewall exclusively from Panorama. By configuring the management interface to accept connections only from the Panorama IP address, you create a source IP-based access control that blocks SSH (and other management protocols) from any other IP. This directly enforces the security policy while still allowing Panorama to manage the firewall.

Answer

Disable SSH and HTTP on the firewall.

Answer

Remove all local admin accounts.

Answer

Set 'Managed by Panorama' to enable.

Question 10

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Accepted Answer

Check the Traffic log with the session's source IP and destination. The Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Answer

Check the System log for related entries

Answer

Run a packet capture on the ingress interface

Answer

Check the global counters for dropped packets