PCNSA Device Management and Services Practice Test 2 — 15 Questions

Question 1

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses. The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.

Answer

Ensure that the HA2 interfaces are also connected and configured correctly

Answer

Change the HA2 IP addresses to be on the same subnet as HA1

Answer

Enable HA ping on the HA1 interface to test connectivity

Question 2

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Accepted Answer

Check the Traffic log with the session's source IP and destination. The Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Answer

Check the System log for related entries

Answer

Run a packet capture on the ingress interface

Answer

Check the global counters for dropped packets

Question 3

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Accepted Answer

Create a security policy rule that allows traffic from the internal zone to the external zone. In a virtual wire deployment (which operates at Layer 2), traffic inspection is still governed by security policy rules. A rule allowing traffic from the internal zone to the external zone ensures that all outbound traffic is evaluated and inspected by the firewall. Security policies are the primary mechanism for controlling and logging traffic, regardless of the deployment mode.

Answer

Define a NAT policy to translate internal IPs to the external interface

Answer

Enable SSL decryption on the firewall

Answer

Configure a virtual wire between the internal and external interfaces

Question 4

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 5

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

Accepted Answer

The FTP application requires additional configuration for passive mode. FTP uses two separate channels: a control channel (TCP 21) and a data channel. In passive mode, the client initiates both connections, but the data channel uses a random high port negotiated via the control channel. The Palo Alto Networks firewall's application decoder for FTP must inspect the control channel to dynamically open pinholes for the data channel; without this, the data connection is blocked even if the control channel is allowed. Option D is correct because the administrator likely created a rule for application 'ftp' but did not ensure that the FTP application's passive mode data connections are properly handled, which requires the firewall to perform application-level inspection and create temporary security policy openings for the negotiated data ports.

Answer

The destination IP is not covered by a NAT policy

Answer

Logging is not enabled on the rule

Answer

The rule is set to deny instead of allow

Question 6

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 7

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 8

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. The firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 9

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Accepted Answer

The internal interface (ethernet1/2) is administratively down. The exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 10

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

Accepted Answer

The vsys2 is not included in the device group on Panorama.. Panorama pushes configuration to firewalls based on device group membership. If vsys2 is not included in the device group assigned to the firewall, Panorama will not push the updated configuration to that virtual system, even if the firewall itself is reachable and other vsys are updated. The administrator verified the template stack assignment, but the device group inclusion is a separate prerequisite for configuration delivery.

Answer

The commit on Panorama failed for vsys2 due to a validation error.

Answer

The admin user does not have sufficient privileges to push configuration to vsys2.

Answer

The firewall's serial number is not registered correctly in Panorama for vsys2.

Question 11

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Define zones, then address objects, then application/service, then action, then commit. Security policies are configured by first defining zones, then addresses, then application/service, then action, and finally committing.

Answer

Define address objects, then zones, then application/service, then action, then commit

Answer

Define zones, then address objects, then action, then application/service, then commit

Answer

Commit, then define zones, then address objects, then application/service, then action

Question 12

Drag and drop the steps to configure a GlobalProtect portal and gateway on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Configure Authentication Policy, then Assign Gateway to Portal and Commit. GlobalProtect requires portal, gateway, security policy, assignment, and testing.

Answer

Configure GlobalProtect Gateway, then Configure GlobalProtect Portal, then Configure Authentication Policy, then Assign Gateway to Portal and Commit

Answer

Configure Authentication Policy, then Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit

Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit, then Configure Authentication Policy

Question 13

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Backup configuration, then access CLI, then issue factory-reset command, then confirm, then reboot.. Factory reset requires backup, CLI access, reset command, confirmation, and reboot.

Answer

Access CLI, then issue factory-reset command, then confirm, then reboot, then backup configuration.

Answer

Backup configuration, then access CLI, then confirm, then issue factory-reset command, then reboot.

Answer

Reboot, then access CLI, then backup configuration, then issue factory-reset command, then confirm.

Question 14

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications traversing the network regardless of port. The correct matches are: App-ID identifies applications, User-ID maps users, Content-ID inspects content, WildFire analyzes unknown threats. Common confusions involve swapping the definitions of App-ID and User-ID.

Answer

App-ID: Maps users to IP addresses for policy enforcement

Answer

User-ID: Identifies applications traversing the network regardless of port

Question 15

Match each protocol to its default port used by Palo Alto Networks.

Accepted Answer

HTTPS: 443. The correct matches are HTTPS:443, SSH:22, and HTTP:80. Common confusions include swapping ports between HTTPS and SSH or HTTP, as all are used for management access.

Answer

HTTPS: 22

Answer

SSH: 80

Answer

HTTP: 443