PCNSA Device Management and Services Practice Test 3 — 15 Questions

Question 1

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access

Question 2

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. The best way to share security policies across firewalls with different interface configurations is to use a single device group containing both firewalls. Device groups are designed to manage security policies centrally, while templates handle device-specific settings like interface configurations. Option B is correct because it allows policy consistency without duplicating effort. Option A (separate device groups) would require manual duplication. Option C (templates) is incorrect because templates are for device-level configuration, not security policies. Option D (Shared policy with overrides) is not a standard or efficient approach for this scenario.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.

Question 3

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

Accepted Answer

Path monitoring.. Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Answer

Heartbeat backup.

Answer

Session replication.

Answer

Link monitoring on all interfaces.

Question 4

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 5

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Accepted Answer

Enable local authentication and configure RADIUS as the primary authentication method with local fallback.. It allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Answer

Create local accounts for all engineers and sync with AD manually.

Answer

Use Kerberos authentication only.

Answer

Configure only RADIUS authentication and disable local authentication.

Question 6

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Accepted Answer

Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.. Enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Answer

Subscribe to the WildFire cloud and rely on updates.

Answer

Set the content update schedule to check every minute.

Answer

Manually download the latest content from the support portal and upload via CLI.

Question 7

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. The 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 8

A firewall uses an external SMTP server for email alerts. The SMTP server is reachable via a specific virtual router and interface. What must be configured to ensure the firewall uses the correct path to reach the SMTP server?

Accepted Answer

Configure a service route for SMTP.. Service routes in Palo Alto Networks firewalls explicitly define the source interface and virtual router used for outbound management traffic, such as SMTP email alerts. By configuring a service route for SMTP, the firewall ensures that email alerts are sent via the specified virtual router and interface, overriding the default management plane routing behavior.

Answer

Ensure the SMTP server is in the same zone as the management interface.

Answer

Configure an SNMP trap destination.

Answer

Add a static route for the SMTP server.

Question 9

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.

Question 10

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

Accepted Answer

Install multiple User-ID agents in a redundancy group, each serving multiple sites.. Deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Answer

Install a single centralized User-ID agent that polls all domain controllers across sites.

Answer

Use the built-in User-ID agent on each firewall and point it to local domain controllers.

Answer

Install one User-ID agent at each site, each configured to communicate only with the local firewall.

Question 11

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. A Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 12

An administrator is configuring active/passive HA for two PA-3020 firewalls. Which TWO conditions would trigger a failover? (Choose two.)

Accepted Answer

Path monitoring detects unreachable target. Path monitoring actively probes a target IP address (e.g., a next-hop router) using ICMP or ARP. If the target becomes unreachable, the firewall considers the network path failed and triggers a failover to the passive unit, ensuring traffic continuity even if the control plane is healthy.

Answer

Active firewall CPU usage exceeds 80%

Answer

Active firewall's power supply failure

Answer

Passive firewall loses connectivity to management network

Question 13

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Accepted Answer

Use a script that logs in via SSH and runs 'save config to scp/tftp'. The firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Answer

Use the CLI command 'request system backup config schedule'

Answer

Set a recurring cron job via the firewall's built-in cron

Question 14

Refer to the exhibit. An administrator runs 'show system resources' on a PA-500 firewall experiencing performance issues. Based on the output, what is the most likely cause?

Accepted Answer

Logging partition full causing log write failures. The 'show system resources' output on a PA-500 firewall indicates that the logging partition is full, which directly causes log write failures. This is a common performance issue because when the logging partition reaches capacity, the firewall cannot write new logs, leading to system instability and performance degradation. Option D is correct because the output explicitly shows the logging partition at 100% utilization.

Answer

Disk space on system partition critically low

Answer

High CPU usage on management plane

Answer

Memory exhaustion on dataplane

Question 15

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Accepted Answer

It applies an interface management profile.. The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Answer

It applies a security rule.

Answer

It applies a QoS profile.

Answer

It applies a Zone Protection profile.