PCNSA Device Management and Services Practice Test 2 — 15 Questions

Question 1

Match each protocol to its default port used by Palo Alto Networks.

Accepted Answer

HTTPS: 443. The correct matches are HTTPS:443, SSH:22, and HTTP:80. Common confusions include swapping ports between HTTPS and SSH or HTTP, as all are used for management access.

Answer

HTTPS: 22

Answer

SSH: 80

Answer

HTTP: 443

Question 2

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Accepted Answer

Enable local authentication and configure RADIUS as the primary authentication method with local fallback.. It allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Answer

Create local accounts for all engineers and sync with AD manually.

Answer

Use Kerberos authentication only.

Answer

Configure only RADIUS authentication and disable local authentication.

Question 3

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Accepted Answer

Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.. Enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Answer

Subscribe to the WildFire cloud and rely on updates.

Answer

Set the content update schedule to check every minute.

Answer

Manually download the latest content from the support portal and upload via CLI.

Question 4

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. The 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 5

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.

Question 6

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

Accepted Answer

Install multiple User-ID agents in a redundancy group, each serving multiple sites.. Deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Answer

Install a single centralized User-ID agent that polls all domain controllers across sites.

Answer

Use the built-in User-ID agent on each firewall and point it to local domain controllers.

Answer

Install one User-ID agent at each site, each configured to communicate only with the local firewall.

Question 7

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. A Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 8

An administrator is configuring active/passive HA for two PA-3020 firewalls. Which TWO conditions would trigger a failover? (Choose two.)

Accepted Answer

Path monitoring detects unreachable target. Path monitoring actively probes a target IP address (e.g., a next-hop router) using ICMP or ARP. If the target becomes unreachable, the firewall considers the network path failed and triggers a failover to the passive unit, ensuring traffic continuity even if the control plane is healthy.

Answer

Active firewall CPU usage exceeds 80%

Answer

Active firewall's power supply failure

Answer

Passive firewall loses connectivity to management network

Question 9

Refer to the exhibit. An administrator runs 'show system resources' on a PA-500 firewall experiencing performance issues. Based on the output, what is the most likely cause?

Accepted Answer

Logging partition full causing log write failures. The 'show system resources' output on a PA-500 firewall indicates that the logging partition is full, which directly causes log write failures. This is a common performance issue because when the logging partition reaches capacity, the firewall cannot write new logs, leading to system instability and performance degradation. Option D is correct because the output explicitly shows the logging partition at 100% utilization.

Answer

Disk space on system partition critically low

Answer

High CPU usage on management plane

Answer

Memory exhaustion on dataplane

Question 10

For a firewall to communicate with Panorama for centralized management, which requirement must be met?

Accepted Answer

Panorama must be reachable via the management interface. For a firewall to communicate with Panorama for centralized management, the Panorama server must be reachable via the firewall's dedicated management interface (MGT). This is because the management interface is the default source for all management-plane traffic, including Panorama communications, unless explicitly overridden by a service route. Without reachability through this interface, the firewall cannot establish the required HTTPS or SSH connections to Panorama.

Answer

Both A and B are required

Answer

A service route must be configured for Panorama

Answer

A valid license for Panorama management is required

Question 11

Refer to the exhibit. What is the PAN-OS version running on the firewall?

Accepted Answer

10.2.0. The PAN-OS version is determined by the first two digits of the version string displayed in the CLI output (e.g., '10.2.0'). In the exhibit, the firewall shows '10.2.0', which corresponds to PAN-OS 10.2.0. This is the correct version because the CLI command 'show system info' or the GUI dashboard displays the exact software version installed.

Answer

10.1.0

Answer

9.1.0

Answer

10.0.0

Question 12

Refer to the exhibit. What is the status of the commit job?

Accepted Answer

Pending. The commit job status is 'Pending' because the commit operation has been initiated but not yet completed. In Palo Alto Networks firewalls, when a commit is in progress, the job status shows as 'Pending' until the configuration is successfully applied or an error occurs. The exhibit likely shows a commit job with a status of 'Pending', indicating that the system is still processing the configuration changes.

Answer

Completed

Answer

Canceled

Answer

Failed

Question 13

Which three of the following are valid commit options in the PAN-OS GUI? (Choose three.)

Accepted Answer

Validate commit. The PAN-OS GUI provides a 'Validate commit' option that checks the configuration for errors before applying it. This is a standard commit option that ensures the candidate configuration is syntactically and semantically valid, reducing the risk of committing a broken configuration.

Answer

Force commit

Answer

Commit to Panorama

Question 14

A company uses Panorama to manage multiple firewalls. The administrator wants changes made in Panorama to be automatically pushed to managed firewalls without manual intervention. Which setting should be enabled?

Accepted Answer

Auto Commit in Panorama Push Settings. The 'Auto Commit on Panorama Push Settings' feature enables Panorama to automatically commit and push configuration changes to managed firewalls immediately after an administrator commits on Panorama, eliminating the need for manual intervention. This setting is specifically designed for automated deployment workflows where changes must be propagated without delay.

Answer

Scheduled Config Update

Answer

Auto Push on Panorama

Answer

Schedule Commit

Answer

Commit on Startup

Question 15

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

Accepted Answer

Management profile HTTP permission revoked. The management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Answer

HTTP certificate expired

Answer

HTTP is disabled by default after upgrade

Answer

Browser caching issue

Answer

HTTP port conflict