PCNSA Device Management and Services Practice Test 5 — 15 Questions

Question 1

An administrator needs to access the firewall's CLI via SSH, but the default SSH port (22) is blocked by the corporate firewall. Which configuration allows SSH on a non-standard port?

Accepted Answer

Device > Setup > Management > Port for SSH. Option A is correct because the firewall's SSH port is configured under Device > Setup > Management > Port for SSH. This setting allows the administrator to change the default TCP port 22 to any non-standard port, enabling SSH access when the corporate firewall blocks the default port. The management interface settings control all inbound management protocols, including SSH, HTTPS, and ping.

Answer

Device > Setup > Services > SSH Port

Answer

Device > Setup > Management > Port for HTTP/HTTPS

Answer

Device > Administration > SSH Port

Answer

Device > Setup > Operations > SSH

Question 2

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

Accepted Answer

Management profile HTTP permission revoked. Option C is correct because the management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Answer

HTTP certificate expired

Answer

HTTP is disabled by default after upgrade

Answer

Browser caching issue

Answer

HTTP port conflict

Question 3

An administrator notices repeated login failures from external IP 10.0.0.1 in the system logs. The admin wants to permanently block all traffic from that IP. Which approach is best practice?

Accepted Answer

Create a security policy to block the IP and commit. Option A is correct because creating a security policy to block the IP and committing it is the standard, persistent method to block all traffic from a specific external IP address in Palo Alto Networks firewalls. This approach uses the firewall's stateful inspection engine to deny traffic at the network layer, ensuring the block survives reboots and is enforced across all interfaces.

Answer

Use the admin lockout feature

Answer

Create a static route to null0 via CLI

Answer

Use a Zone Protection profile

Answer

Add the IP to a block list in the management profile

Question 4

A company uses Panorama to manage multiple firewalls. After pushing a template change, one firewall fails to commit with error 'invalid certificate path'. What is the most likely cause?

Accepted Answer

The template includes a certificate that has no trusted root on that firewall. Option C is correct because when a template push includes a certificate (e.g., for SSL decryption or authentication) that references a Certificate Authority (CA) not trusted by the target firewall, the commit fails with 'invalid certificate path'. The firewall cannot validate the certificate chain because the root or intermediate CA certificate is missing from its trusted store, causing the commit to abort.

Answer

The firewall's management IP changed

Answer

Template commit requires reconnection

Answer

The firewall's certificate has expired

Answer

Panorama's certificate is mismatched

Question 5

An administrator wants to configure the firewall to automatically synchronize its clock with an external NTP server. Which device management section is used?

Accepted Answer

Device > Setup > Services. Option E is correct because NTP synchronization is configured under Device > Setup > Services in the PAN-OS web interface. This section contains the NTP server settings where you can specify primary and secondary NTP servers, and the firewall will automatically synchronize its clock with them using the Network Time Protocol (NTP) on UDP port 123.

Answer

Device > Setup > Management

Answer

Device > High Availability

Answer

Device > Setup > Operations

Answer

Device > Server Monitoring

Question 6

An administrator configured SNMP community and trap destination under Device > Setup > Services, but no traps are received. What additional configuration is needed?

Accepted Answer

Add a management profile that allows SNMP. Option D is correct because even after configuring SNMP communities and trap destinations under Device > Setup > Services, the firewall still requires a management profile that explicitly permits SNMP (and optionally traps) on the interface through which the traps will be sent. Without this profile applied to the interface, the firewall will not allow SNMP traffic to egress, and traps will be silently dropped.

Answer

Set the source interface

Answer

Configure SNMP version

Answer

Create a security policy

Answer

Enable SNMP on the interface

Question 7

A firewall is configured with multiple Virtual Systems (vsys). An admin wants to assign a custom admin role that can manage only specific vsys. Which role type supports this?

Accepted Answer

Virtual System Admin. Option C is correct because the Virtual System Admin role is specifically designed to grant administrative access to one or more Virtual Systems (vsys) within a Palo Alto Networks firewall. This role type allows the admin to manage only the assigned vsys, with no visibility or control over other vsys or the shared firewall configuration, which directly matches the requirement in the question.

Answer

Panorama Admin

Answer

Read Only Admin

Answer

Superadmin

Answer

Device Admin

Question 8

Which license is required for the firewall to use URL filtering?

Accepted Answer

URL Filtering. URL filtering requires a dedicated URL Filtering license on Palo Alto Networks firewalls to enable the firewall to query the PAN-DB cloud or use a locally installed URL database for categorizing URLs. Without this license, the firewall cannot perform URL-based access control, even if other security subscriptions like Threat Prevention or WildFire are active.

Answer

DNS Security

Answer

GlobalProtect

Answer

WildFire

Answer

Threat Prevention

Question 9

Which TWO conditions must be true for intra-zone traffic to be allowed between two interfaces in the same zone?

Accepted Answer

The interfaces are in the same virtual router. Intra-zone traffic between two interfaces in the same zone requires that both interfaces belong to the same virtual router (Option A) because the virtual router defines the routing table and forwarding domain. Without this, the firewall cannot route packets between the interfaces even if they are in the same zone. Additionally, a security policy must explicitly allow the traffic (Option E), as Palo Alto Networks firewalls default to a deny-all posture; no traffic is permitted without an explicit rule.

Answer

Intra-zone default rule is set to allow

Answer

The zones are in the same vsys

Answer

The interfaces are in the same virtual wire

Question 10

Which THREE log types can be forwarded to a syslog server?

Accepted Answer

Threat logs. B is correct because threat logs capture security-related events such as intrusion attempts, malware detection, and vulnerability exploits, which are critical for security monitoring. The Palo Alto Networks firewall can forward these logs to a syslog server (e.g., using UDP 514 or TCP 6514) for centralized analysis and alerting. This is a standard feature in PAN-OS for integrating with SIEM systems.

Answer

Packet capture logs

Answer

Configuration logs

Question 11

Which TWO management methods allow CLI access to a Palo Alto Networks firewall?

Accepted Answer

SSH. SSH (Secure Shell) is a standard management method that provides encrypted CLI access to Palo Alto Networks firewalls, allowing administrators to execute commands securely over a network. The serial console port on the firewall provides direct, out-of-band CLI access for initial configuration or troubleshooting when network connectivity is unavailable.

Answer

HTTPS

Answer

HTTP

Answer

Telnet

Question 12

An administrator configured NTP servers as shown. After committing, the firewall's time is not synchronized. Which additional configuration is required?

Accepted Answer

Enable NTP service under Device > Setup > Services. Option C is correct because the NTP service must be explicitly enabled on the firewall under Device > Setup > Services before it will synchronize time with any configured NTP servers. Without enabling the NTP service, the firewall ignores the NTP server configuration entirely, even if the servers are reachable and correctly specified.

Answer

Configure an authentication key

Answer

Set time zone manually

Answer

Specify a source interface for NTP

Answer

Restart NTP service

Question 13

An administrator notices that the firewall's time is incorrect. Based on the exhibit, what is the most likely cause?

Accepted Answer

NTP service is stopped. The firewall's time is incorrect because the NTP service is stopped. NTP (Network Time Protocol) is responsible for synchronizing the system clock with an external time source. Without NTP, the firewall relies on its internal hardware clock, which can drift over time, leading to an incorrect time.

Answer

DNS proxy is running

Answer

Management service is down

Answer

SNMP is running

Answer

Syslog is running

Question 14

An administrator sees this log repeatedly. Which configuration change will allow 10.0.0.1 to access the management interface?

Accepted Answer

Add 10.0.0.1 to the allowed IP list in the management profile. The log indicates that the management interface is rejecting access attempts from 10.0.0.1 due to an IP-based access restriction. By adding 10.0.0.1 to the allowed IP list within the management profile, the administrator explicitly permits that host to reach the management interface, resolving the repeated denial.

Answer

Enable HTTP on the management interface

Answer

Disable management access restriction

Answer

Change the management interface to a different IP

Answer

Create a security policy allowing HTTP from 10.0.0.1

Question 15

An administrator modifies a security policy but the change does not take effect. What must the administrator do?

Accepted Answer

Commit the configuration.. In Palo Alto Networks firewalls, configuration changes are made in a candidate configuration that is not active until explicitly committed. The administrator must commit the configuration to apply the changes to the running configuration and enforce the new security policy. Without a commit, the modification remains pending and does not affect traffic.

Answer

Import the configuration.

Answer

Save the configuration.

Answer

Reboot the firewall.