PCNSA Practice Test 8 — 10 Questions

Question 1

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the policy has the correct source zone.. Option B is correct because a security policy only matches traffic when its source zone matches the ingress zone of the packet, so verifying the policy's source zone (internal) confirms the rule can actually match the users' web-browsing traffic. Option C is correct because the traffic log records each session with its matched policy, action (allow/deny), and source/destination zones, which directly shows whether the traffic is being matched and allowed. Option A is not relevant because CPU usage is a performance metric and does not indicate policy matching. Option D is not relevant because the Threat log records security profile detections such as malware, not whether a policy allowed the session. Option E is not relevant because a URL filtering profile affects content inspection after policy matching, not whether the traffic is matched and allowed by the policy.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 2

What is the primary benefit of using Content-ID in a security policy?

Accepted Answer

It enables threat prevention and file blocking on allowed applications.. Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Answer

It blocks malicious URLs.

Answer

It prioritizes traffic for specific applications.

Answer

It identifies applications regardless of port.

Question 3

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Accepted Answer

The SSH key exchange algorithm used by the client or server is not in the firewall's supported list.. The error message indicates 'unsupported key exchange algorithm'. SSH decryption requires the firewall to act as a proxy and re-encrypt the session. If the client or server uses a key exchange algorithm that the firewall does not support, decryption will fail. The exhibit shows a policy for SSH decryption and a session, but the algorithm is not supported.

Answer

The firewall does not have a certificate installed for SSH decryption.

Answer

The SSH session is using a cipher that is not supported by the firewall's decryption engine.

Answer

The decryption policy is misconfigured because the service is set to 'any' instead of 'ssh'.

Question 4

An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?

Accepted Answer

Rule1. Rule1 allows any to any with logging at session start, so it matches the traffic first and permits it, generating a log entry. Since Rule1 is evaluated before Rule2 and Rule3, the traffic is processed by Rule1 and never reaches the subsequent rules. The log confirms that the session was allowed, consistent with Rule1's action.

Answer

Rule3

Answer

Rule2

Answer

No rule matched

Question 5

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. What is the most likely cause?

Accepted Answer

The custom application uses HTTP but no specific App-ID signature.. When a custom application uses HTTP but lacks a specific App-ID signature, Palo Alto Networks firewalls default to classifying the traffic as web-browsing (HTTP). App-ID relies on a combination of protocol decoders and application signatures; without a custom App-ID signature defined for the application, the firewall cannot distinguish it from generic HTTP traffic.

Answer

The application signature database is outdated.

Answer

App-ID is disabled on the security rule.

Answer

Content-ID is blocking the application.

Question 6

A syslog server is only reachable through a specific interface on the firewall. To ensure syslog logs are sent via that interface, which configuration is required?

Accepted Answer

Set up a service route for syslog. Service routes in Palo Alto Networks firewalls allow you to specify which source interface or IP address is used for outbound traffic from the firewall itself, such as syslog, SNMP, or authentication. By configuring a service route for syslog, you ensure that syslog messages are sourced from the specific interface that can reach the syslog server, even if the routing table would otherwise choose a different path.

Answer

Configure a static route for the syslog server IP

Answer

Enable NAT on the syslog traffic

Answer

Use policy-based forwarding for syslog traffic

Question 7

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. Palo Alto Networks security policies are evaluated top-down, and the first rule that matches the traffic is applied. If an existing deny rule that matches HTTP from Trust to Untrust sits above the new allow rule, the deny rule wins and traffic remains blocked. The new rule must be moved above the deny rule (or the deny rule modified) to take effect.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.

Question 8

Which THREE are required for Panorama to manage a firewall? (Select three)

Accepted Answer

Certificate-based mutual authentication (or pre-shared key). Panorama and managed firewalls must establish a secure, authenticated connection using either certificate-based mutual authentication or a pre-shared key. This ensures that only authorized firewalls can register with Panorama and receive configuration updates, preventing unauthorized devices from joining the management domain.

Answer

A valid Panorama license

Answer

Panorama plugin installed on the firewall

Question 9

A security analyst notices that a legitimate application is being incorrectly identified as a different application by the firewall. What is the best first step to resolve this issue?

Accepted Answer

Verify the application signature in the App-ID database and submit a false-positive report if needed. The first step in resolving an application misidentification is to verify the application signature in the App-ID database. If the signature is incorrect or missing, submitting a false-positive report allows Palo Alto Networks to update the database, ensuring accurate identification without manual overrides. This aligns with the principle of using the built-in App-ID engine as the primary identification method.

Answer

Reboot the firewall to refresh the application cache

Answer

Disable the application override and use port-based rules

Answer

Create a custom App-ID to override the incorrect identification

Question 10

Match each PAN-OS component to its role.

Accepted Answer

Management Plane: Handles device configuration, management access, and logging.. The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Answer

Management Plane: Processes and forwards network traffic based on security policies.

Answer

Data Plane: Handles device configuration, management access, and logging.