PCNSA Device Management and Services Practice Test 3 — 15 Questions

Question 1

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

Accepted Answer

Path monitoring.. Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Answer

Heartbeat backup.

Answer

Session replication.

Answer

Link monitoring on all interfaces.

Question 2

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Option A is correct because Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 3

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Accepted Answer

Enable local authentication and configure RADIUS as the primary authentication method with local fallback.. Option D is correct because it allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Answer

Create local accounts for all engineers and sync with AD manually.

Answer

Use Kerberos authentication only.

Answer

Configure only RADIUS authentication and disable local authentication.

Question 4

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Accepted Answer

Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.. Option D is correct because enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Answer

Subscribe to the WildFire cloud and rely on updates.

Answer

Set the content update schedule to check every minute.

Answer

Manually download the latest content from the support portal and upload via CLI.

Question 5

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. Option C is correct because the 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 6

A firewall uses an external SMTP server for email alerts. The SMTP server is reachable via a specific virtual router and interface. What must be configured to ensure the firewall uses the correct path to reach the SMTP server?

Accepted Answer

Configure a service route for SMTP.. Option C is correct because service routes in Palo Alto Networks firewalls explicitly define the source interface and virtual router used for outbound management traffic, such as SMTP email alerts. By configuring a service route for SMTP, the firewall ensures that email alerts are sent via the specified virtual router and interface, overriding the default management plane routing behavior.

Answer

Ensure the SMTP server is in the same zone as the management interface.

Answer

Configure an SNMP trap destination.

Answer

Add a static route for the SMTP server.

Question 7

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. Option D is correct because PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.

Question 8

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

Accepted Answer

Install multiple User-ID agents in a redundancy group, each serving multiple sites.. Option D is correct because deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Answer

Install a single centralized User-ID agent that polls all domain controllers across sites.

Answer

Use the built-in User-ID agent on each firewall and point it to local domain controllers.

Answer

Install one User-ID agent at each site, each configured to communicate only with the local firewall.

Question 9

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. Option A is correct because a Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 10

An administrator is configuring active/passive HA for two PA-3020 firewalls. Which TWO conditions would trigger a failover? (Choose two.)

Accepted Answer

Path monitoring detects unreachable target. Option A is correct because path monitoring actively probes a target IP address (e.g., a next-hop router) using ICMP or ARP. If the target becomes unreachable, the firewall considers the network path failed and triggers a failover to the passive unit, ensuring traffic continuity even if the control plane is healthy.

Answer

Active firewall CPU usage exceeds 80%

Answer

Active firewall's power supply failure

Answer

Passive firewall loses connectivity to management network

Question 11

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Accepted Answer

Use a script that logs in via SSH and runs 'save config to scp/tftp'. Option A is correct because the firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Answer

Use the CLI command 'request system backup config schedule'

Answer

Set a recurring cron job via the firewall's built-in cron

Question 12

Refer to the exhibit. An administrator runs 'show system resources' on a PA-500 firewall experiencing performance issues. Based on the output, what is the most likely cause?

Accepted Answer

Logging partition full causing log write failures. The 'show system resources' output on a PA-500 firewall indicates that the logging partition is full, which directly causes log write failures. This is a common performance issue because when the logging partition reaches capacity, the firewall cannot write new logs, leading to system instability and performance degradation. Option D is correct because the output explicitly shows the logging partition at 100% utilization.

Answer

Disk space on system partition critically low

Answer

High CPU usage on management plane

Answer

Memory exhaustion on dataplane

Question 13

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Accepted Answer

It applies an interface management profile.. The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Answer

It applies a security rule.

Answer

It applies a QoS profile.

Answer

It applies a Zone Protection profile.

Question 14

Refer to the exhibit. A security analyst reviews a traffic log entry in JSON format. Which firewall feature is responsible for including the 'user' field in the log?

Accepted Answer

User-ID. The 'user' field in a traffic log is populated by User-ID, which maps IP addresses to usernames by monitoring authentication events from Active Directory, LDAP, or terminal services agents. This allows the firewall to log and enforce policies based on user identity rather than just IP addresses.

Answer

Data Filtering

Answer

Captive Portal

Answer

GlobalProtect

Question 15

A network administrator needs to restrict which source IP addresses can access the firewall's web management interface. Which feature should be configured?

Accepted Answer

Management Profile. The correct answer is A, Management Profile. A Management Profile is a firewall configuration object that defines which services (e.g., HTTPS, SSH, ping) are allowed on a specific interface and, critically, which source IP addresses or subnets can access those services. By binding a Management Profile to an interface, the administrator can restrict web management access to only trusted source IPs, such as a management subnet. This is the intended and most secure method for controlling management plane access on Palo Alto Networks firewalls.

Answer

Access Control List on the data plane

Answer

Interface management settings

Answer

Security policy rule for management traffic