PCNSA Device Management and Services Practice Test 2 — 15 Questions

Question 1

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in layer 3 mode with virtual wire subinterfaces. Which configuration is required to achieve this?

Accepted Answer

Create a security policy rule that allows traffic from the internal zone to the external zone. Option A is correct because in a Layer 3 firewall deployment with virtual wire subinterfaces, traffic inspection is governed by security policy rules. A rule allowing traffic from the internal zone to the external zone ensures that all outbound traffic is evaluated and inspected by the firewall, as security policies are the primary mechanism for controlling and logging traffic in Palo Alto Networks firewalls.

Answer

Define a NAT policy to translate internal IPs to the external interface

Answer

Enable SSL decryption on the firewall

Answer

Configure a virtual wire between the internal and external interfaces

Question 2

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 3

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

Accepted Answer

The FTP application requires additional configuration for passive mode. FTP uses two separate channels: a control channel (TCP 21) and a data channel. In passive mode, the client initiates both connections, but the data channel uses a random high port negotiated via the control channel. The Palo Alto Networks firewall's application decoder for FTP must inspect the control channel to dynamically open pinholes for the data channel; without this, the data connection is blocked even if the control channel is allowed. Option D is correct because the administrator likely created a rule for application 'ftp' but did not ensure that the FTP application's passive mode data connections are properly handled, which requires the firewall to perform application-level inspection and create temporary security policy openings for the negotiated data ports.

Answer

The destination IP is not covered by a NAT policy

Answer

Logging is not enabled on the rule

Answer

The rule is set to deny instead of allow

Question 4

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 5

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 6

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. Option A is correct because the firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 7

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Accepted Answer

The internal interface (ethernet1/2) is administratively down. Option D is correct because the exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 8

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

Accepted Answer

The vsys2 is not included in the device group on Panorama.. Option C is correct because Panorama pushes configuration to firewalls based on device group membership. If vsys2 is not included in the device group assigned to the firewall, Panorama will not push the updated configuration to that virtual system, even if the firewall itself is reachable and other vsys are updated. The administrator verified the template stack assignment, but the device group inclusion is a separate prerequisite for configuration delivery.

Answer

The commit on Panorama failed for vsys2 due to a validation error.

Answer

The admin user does not have sufficient privileges to push configuration to vsys2.

Answer

The firewall's serial number is not registered correctly in Panorama for vsys2.

Question 9

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Question 10

Drag and drop the steps to configure a GlobalProtect portal and gateway on a Palo Alto Networks firewall into the correct order.

Question 11

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Question 12

Match each Palo Alto Networks feature to its primary function.

Question 13

Match each protocol to its default port used by Palo Alto Networks.

Question 14

Match each Palo Alto Networks feature to its category.

Question 15

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. Option A is correct because Panorama device groups are designed to share policies across firewalls, while templates handle device-specific settings. Option B (separate groups) duplicates effort; Option C (templates) is wrong because templates are for device configuration, not security policy; Option D (Shared policy with overrides) is not a standard approach for policy sharing.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.