PCNSA Device Management and Services Practice Test 10 — 15 Questions

Question 1

Which TWO are best practices for securing management access to a Palo Alto firewall? (Select two)

Accepted Answer

Use a dedicated management subnet. Using a dedicated management subnet (out-of-band management) isolates management traffic from production data traffic, reducing the attack surface and ensuring management access remains available even if the data plane is compromised. This is a foundational security best practice for any network device, including Palo Alto firewalls.

Answer

Use HTTPS with self-signed certificates

Answer

Use SNMP v1 for monitoring

Answer

Disable ping on the management interface

Question 2

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Accepted Answer

Apply the log forwarding profile to a security policy rule.. A log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Answer

Set the syslog server to use TCP port 514.

Answer

Specify the syslog facility code in the log forwarding profile.

Question 3

An administrator notices that the firewall's web interface is accessible via HTTPS but shows an expired certificate warning. The firewall's management certificate was issued by an internal CA and has a validity of two years. The administrator checks the certificate and sees it expired yesterday. The administrator generates a new self-signed certificate through the firewall's GUI. After generating, the administrator assigns the new certificate to the HTTPS management interface. Despite this, the firewall still presents the old expired certificate when accessed. What is the most likely cause?

Accepted Answer

The new certificate was not committed.. In Palo Alto Networks firewalls, changes to management interface settings, including certificate assignments, require a commit operation to become active. Generating and assigning the new certificate through the GUI only stages the change; without a commit, the firewall continues to use the previously committed configuration, which still references the expired certificate. This is why the old certificate persists despite the assignment.

Answer

The firewall must be restarted for the change to take effect.

Answer

The old certificate is still bound to a different service.

Answer

The browser has cached the old certificate.

Question 4

After a firewall upgrade, the system clock shows a time that is five minutes behind the actual time, even though NTP is synchronized. What is the most likely cause?

Accepted Answer

The timezone offset is incorrectly set.. When NTP is synchronized but the system clock is offset by a fixed amount (e.g., five minutes), the most likely cause is an incorrect timezone offset. NTP synchronizes the UTC time, and the firewall then applies the configured timezone offset to display the local time. If the offset is wrong, the displayed time will be consistently off by that offset value, even though NTP shows synchronization.

Answer

The firewall is using a stratum 2 server that is inaccurate.

Answer

NTP authentication is not configured.

Answer

The NTP admin state is enabled but the service route is misconfigured.

Question 5

An administrator needs to restrict access to the firewall's web management interface to only the IT department subnet 10.0.0.0/24. The firewall's management interface is in the 'Management' zone. Which configuration step is required to enforce this restriction?

Accepted Answer

Configure an Interface Management Profile with permitted IP addresses 10.0.0.0/24 and apply it to the management interface.. Interface Management Profiles are specifically designed to control management access to an interface by specifying allowed IP addresses and enabled services. Applying such a profile to the management interface with 10.0.0.0/24 ensures only that subnet can access the web UI. Other options either apply to transit traffic or do not enforce source IP restrictions.

Answer

Enable 'Require HTTPS' and configure an authentication profile with allowed users from 10.0.0.0/24.

Answer

Create a security policy rule allowing only 10.0.0.0/24 to the Management zone and deny all other sources.

Answer

Set up a NAT rule to translate external IPs to the management IP and restrict via security policy.

Question 6

A security administrator at a branch office needs to allow a remote vendor to access the firewall's web management interface only from IP address 203.0.113.50. The firewall's management interface is in the Management zone. Which Palo Alto Networks feature should the administrator use to restrict access?

Accepted Answer

Configure an Interface Management Profile with HTTPS allowed and permitted IP addresses set to 203.0.113.50, then apply it to the management interface.. The Interface Management Profile is the correct tool because it explicitly enables management services on an interface and can restrict them to specific source IP addresses. Applying it to the management interface with HTTPS enabled and the vendor's IP permitted ensures only that address can reach the web UI. Other options either do not affect management plane access or address routing/authentication rather than IP-based restriction.

Answer

Create a Security policy rule allowing traffic from 203.0.113.50 to the Management zone on port 443.

Answer

Configure an authentication profile that requires the vendor to authenticate with a certificate before accessing the web UI.

Answer

Add a static route for 203.0.113.50 pointing to the management interface.

Question 7

A network administrator wants to ensure that the firewall sends SNMP traps to a monitoring server at 192.168.1.50. The administrator has already configured the SNMP community string and added the trap destination under Device > Setup > Services. However, traps are not being received. What is the most likely missing configuration?

Accepted Answer

An Interface Management Profile allowing SNMP on the interface used for traps.. SNMP traps are sent from the firewall's management plane, and the interface used must permit SNMP via an Interface Management Profile. If the profile does not allow SNMP, traps are dropped. Security policies and NAT rules do not apply to management traffic. Therefore, the missing configuration is the Interface Management Profile allowing SNMP.

Answer

A security policy rule allowing SNMP traffic from the firewall to the monitoring server.

Answer

A NAT rule to translate the firewall's management IP to a routable address.

Answer

Configuring the SNMP version to v3 with authentication.

Question 8

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall has two virtual routers: VR1 for the internal network and VR2 for the internet. The syslog server is reachable only through VR1. Which configuration setting must be applied to ensure syslog messages are sent via VR1?

Accepted Answer

In the syslog server profile, specify the source address as an interface in VR1, and ensure a route exists in VR1 for the syslog server.. To force syslog traffic through a specific virtual router, you must specify a source address in the syslog server profile that belongs to that virtual router. The firewall then uses that source address for outgoing syslog packets, and the virtual router associated with that interface will handle routing. This ensures the syslog server is reached via the intended path.

Answer

Under Device > Server Profiles > Syslog, set the virtual router to VR1 for the syslog server profile.

Answer

In the log forwarding profile, configure the syslog server to use VR1 as the source interface.

Answer

Create a static route in VR1 for the syslog server IP address and ensure the firewall uses the management interface for logging.

Question 9

A security administrator needs to restrict access to the firewall's web management interface to only the IP address 10.1.1.100. The administrator logs into the firewall and navigates to Device > Setup > Management. Which configuration should be modified?

Accepted Answer

Management Interface Settings: Add 10.1.1.100/32 to the Permitted IP Addresses list.. The Permitted IP Addresses list under Device > Setup > Management > Management Interface Settings is specifically designed to restrict management access to specified IP addresses. Adding 10.1.1.100/32 ensures only that host can connect to the web interface. Other settings, such as admin roles or service ports, do not provide IP-based restriction.

Answer

Device > Setup > Services: Configure a security policy rule to allow only 10.1.1.100 to the management interface.

Answer

Administrative Accounts: Create a new admin role with read-only access for 10.1.1.100.

Answer

Management Interface Settings: Enable HTTP and HTTPS on the management interface.

Question 10

A network security administrator needs to ensure that a Palo Alto Networks firewall sends SNMP traps to a monitoring server at 10.1.1.50 using the MGT interface. The administrator has already added the SNMP community string and trap destination under Device > Setup > Services > SNMP. However, no traps are being received. Which additional configuration is required to ensure traps are sent from the MGT interface?

Accepted Answer

Create a service route for SNMP under Device > Setup > Services > Service Routes.. Service routes override the default source interface for management services such as SNMP, syslog, and email. When a specific source interface is required, a service route must be configured. Without it, the firewall may use a different interface, causing the SNMP server to reject or ignore traps. Thus, creating a service route for SNMP is the correct action.

Answer

Enable SNMP on the MGT interface under Network > Interfaces > Management.

Answer

Assign the SNMP server IP address to a custom zone and create a NAT policy.

Answer

Configure a security policy rule allowing SNMP traffic from the MGT interface to the SNMP server.

Question 11

A network security engineer is configuring a Palo Alto Networks firewall to send SNMP traps to a management server. The engineer has already configured the SNMP community string and the trap destination IP. However, the management server is not receiving any traps. Which additional configuration is required to allow SNMP traps to be sent?

Accepted Answer

Enable SNMP on the management interface by applying an Interface Management Profile that includes SNMP.. SNMP traps are generated by the management plane and sent out the management interface. By default, SNMP is not enabled on that interface. An Interface Management Profile with SNMP enabled must be applied to the management interface. Once that is done, the firewall can send traps to the configured destination. Other options either relate to data plane policies or routing, which are not the cause of the missing traps.

Answer

Configure an SNMPv3 user with authentication and encryption.

Answer

Configure a Security policy rule allowing SNMP traffic from the firewall to the management server.

Answer

Add a static route to the management server via the management interface.

Question 12

An administrator is configuring a Palo Alto Networks firewall to send email alerts for critical system events. The administrator has configured an SMTP server under Device > Setup > Services > Email. However, test emails are not being delivered. Which additional step is required to allow the firewall to send email alerts?

Accepted Answer

Set up a service route for SMTP under Device > Setup > Services > Service Routes.. Email alerts are sent from the management plane, and their source interface is determined by service routes. If the SMTP server is not reachable from the default management interface, a service route must be configured to specify the correct egress interface. This ensures that the firewall can deliver email alerts successfully. Without a service route, the firewall may use an interface that cannot reach the SMTP server.

Answer

Enable SMTP in the Management Interface settings under Network > Interfaces.

Answer

Configure a security policy rule allowing SMTP traffic from the firewall to the SMTP server.

Answer

Add an SNMP trap destination for email notifications.

Question 13

An administrator wants to ensure that only the firewall administrator's workstation at 203.0.113.45 can reach the web management interface on a PA-3220 running PAN-OS 10.2. The workstation is on the trust zone, and management access is currently allowed from any address on the management interface. Which configuration object should the administrator create and apply to the management interface?

Accepted Answer

An Interface Management profile with HTTPS enabled and the permitted IP address 203.0.113.45/32, applied to the management interface.. Interface Management profiles are the correct mechanism to control which management services (HTTPS, SSH, SNMP, etc.) are enabled on an interface and to restrict those services to specific permitted IP addresses. By creating a profile with HTTPS enabled and only 203.0.113.45/32 as a permitted address, the administrator ensures that the web management interface is reachable only from the intended workstation, directly meeting the stated requirement.

Answer

A Management Interface ACL applied to the trust zone interface, permitting only 203.0.113.45.

Answer

A Security policy rule from the trust zone to the management zone allowing only 203.0.113.45, with a default deny rule after it.

Answer

An Authentication profile bound to the management interface, allowing only the user account associated with 203.0.113.45.

Question 14

An administrator manages a PA-3220 running PAN-OS 10.2 with two virtual routers: VR-A for the internal network and VR-B for the internet. The firewall must send SNMP traps, syslog, and email alerts to servers reachable only through VR-B. Which setting directly controls which virtual router the firewall uses to egress that management-plane traffic?

Accepted Answer

The Service Route Configuration under Device > Setup > Services. Firewall-originated management services such as SNMP, syslog, and email do not follow dataplane routing by default; they are steered by Service Route Configuration. Binding each service to an interface in VR-B forces that egress path, which is exactly what the scenario requires. Other mechanisms either affect only transit traffic or the dedicated management port.

Answer

A static route in VR-A pointing to the SNMP, syslog, and SMTP servers

Answer

A Policy-Based Forwarding (PBF) rule matching the firewall's own management traffic

Answer

The Management Interface's default gateway under Device > Setup > Interfaces

Question 15

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable via a specific interface and virtual router. Which two configurations are required to ensure that syslog messages are sent from the correct source interface? (Choose two.)

Accepted Answer

Configure a Syslog Server Profile and assign it to the appropriate log forwarding settings.. To send logs to an external syslog server, you must configure a Syslog Server Profile and apply it to log forwarding settings. To control the source interface used for syslog messages, you must configure a service route for the syslog service, specifying the desired interface and virtual router. These two steps ensure that logs are sent from the correct interface. Security policies and Interface Management Profiles do not influence syslog source interface selection.

Answer

Specify the source interface in the Syslog Server Profile.

Answer

Enable syslog on the management interface via an Interface Management Profile.

Answer

Create a Security policy rule allowing syslog traffic from the firewall to the syslog server.