PCNSA Device Management and Services Practice Test 5 — 15 Questions

Question 1

Which three of the following services are commonly permitted on the management interface? (Choose three.)

Accepted Answer

Ping. Ping (ICMP Echo) is commonly permitted on the management interface because it allows network administrators to verify the interface's reachability and responsiveness without exposing management services to unnecessary risk. While ICMP is not a management protocol per se, it is a fundamental troubleshooting tool that is typically allowed on the management plane to test connectivity to the management IP address.

Answer

HTTP

Answer

Telnet

Question 2

A company uses Panorama to manage multiple firewalls. The administrator wants changes made in Panorama to be automatically pushed to managed firewalls without manual intervention. Which setting should be enabled?

Accepted Answer

Auto Commit in Panorama Push Settings. The 'Auto Commit on Panorama Push Settings' feature enables Panorama to automatically commit and push configuration changes to managed firewalls immediately after an administrator commits on Panorama, eliminating the need for manual intervention. This setting is specifically designed for automated deployment workflows where changes must be propagated without delay.

Answer

Scheduled Config Update

Answer

Auto Push on Panorama

Answer

Schedule Commit

Answer

Commit on Startup

Question 3

An administrator needs to access the firewall's CLI via SSH, but the default SSH port (22) is blocked by the corporate firewall. Which configuration allows SSH on a non-standard port?

Accepted Answer

Device > Setup > Management > Port for SSH. The firewall's SSH port is configured under Device > Setup > Management > Port for SSH. This setting allows the administrator to change the default TCP port 22 to any non-standard port, enabling SSH access when the corporate firewall blocks the default port. The management interface settings control all inbound management protocols, including SSH, HTTPS, and ping.

Answer

Device > Setup > Services > SSH Port

Answer

Device > Setup > Management > Port for HTTP/HTTPS

Answer

Device > Administration > SSH Port

Answer

Device > Setup > Operations > SSH

Question 4

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

Accepted Answer

Management profile HTTP permission revoked. The management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Answer

HTTP certificate expired

Answer

HTTP is disabled by default after upgrade

Answer

Browser caching issue

Answer

HTTP port conflict

Question 5

An administrator notices repeated login failures from external IP 10.0.0.1 in the system logs. The admin wants to permanently block all traffic from that IP. Which approach is best practice?

Accepted Answer

Create a security policy to block the IP and commit. Creating a security policy to block the IP and committing it is the standard, persistent method to block all traffic from a specific external IP address in Palo Alto Networks firewalls. This approach uses the firewall's stateful inspection engine to deny traffic at the network layer, ensuring the block survives reboots and is enforced across all interfaces.

Answer

Use the admin lockout feature

Answer

Create a static route to null0 via CLI

Answer

Use a Zone Protection profile

Answer

Add the IP to a block list in the management profile

Question 6

A company uses Panorama to manage multiple firewalls. After pushing a template change, one firewall fails to commit with error 'invalid certificate path'. What is the most likely cause?

Accepted Answer

The template includes a certificate that has no trusted root on that firewall. When a template push includes a certificate (e.g., for SSL decryption or authentication) that references a Certificate Authority (CA) not trusted by the target firewall, the commit fails with 'invalid certificate path'. The firewall cannot validate the certificate chain because the root or intermediate CA certificate is missing from its trusted store, causing the commit to abort.

Answer

The firewall's management IP changed

Answer

Template commit requires reconnection

Answer

The firewall's certificate has expired

Answer

Panorama's certificate is mismatched

Question 7

An administrator wants to configure the firewall to automatically synchronize its clock with an external NTP server. Which device management section is used?

Accepted Answer

Device > Setup > Services. NTP synchronization is configured under Device > Setup > Services in the PAN-OS web interface. This section contains the NTP server settings where you can specify primary and secondary NTP servers, and the firewall will automatically synchronize its clock with them using the Network Time Protocol (NTP) on UDP port 123.

Answer

Device > Setup > Management

Answer

Device > High Availability

Answer

Device > Setup > Operations

Answer

Device > Server Monitoring

Question 8

An administrator configured SNMP community and trap destination under Device > Setup > Services, but no traps are received. What additional configuration is needed?

Accepted Answer

Add a management profile that allows SNMP. Even after configuring SNMP communities and trap destinations under Device > Setup > Services, the firewall still requires a management profile that explicitly permits SNMP (and optionally traps) on the interface through which the traps will be sent. Without this profile applied to the interface, the firewall will not allow SNMP traffic to egress, and traps will be silently dropped.

Answer

Set the source interface

Answer

Configure SNMP version

Answer

Create a security policy

Answer

Enable SNMP on the interface

Question 9

A firewall is configured with multiple Virtual Systems (vsys). An admin wants to assign a custom admin role that can manage only specific vsys. Which role type supports this?

Accepted Answer

Virtual System Admin. The Virtual System Admin role is specifically designed to grant administrative access to one or more Virtual Systems (vsys) within a Palo Alto Networks firewall. This role type allows the admin to manage only the assigned vsys, with no visibility or control over other vsys or the shared firewall configuration, which directly matches the requirement in the question.

Answer

Panorama Admin

Answer

Read Only Admin

Answer

Superadmin

Answer

Device Admin

Question 10

Which license is required for the firewall to use URL filtering?

Accepted Answer

URL Filtering. URL filtering requires a dedicated URL Filtering license on Palo Alto Networks firewalls to enable the firewall to query the PAN-DB cloud or use a locally installed URL database for categorizing URLs. Without this license, the firewall cannot perform URL-based access control, even if other security subscriptions like Threat Prevention or WildFire are active.

Answer

DNS Security

Answer

GlobalProtect

Answer

WildFire

Answer

Threat Prevention

Question 11

Which TWO conditions must be true for intra-zone traffic to be allowed between two interfaces in the same zone?

Accepted Answer

The interfaces are in the same virtual router. Intra-zone traffic between two interfaces in the same zone requires that both interfaces belong to the same virtual router (Option A) because the virtual router defines the routing table and forwarding domain. Without this, the firewall cannot route packets between the interfaces even if they are in the same zone. Additionally, a security policy must explicitly allow the traffic (Option E), as Palo Alto Networks firewalls default to a deny-all posture; no traffic is permitted without an explicit rule.

Answer

Intra-zone default rule is set to allow

Answer

The zones are in the same vsys

Answer

The interfaces are in the same virtual wire

Question 12

Which THREE log types can be forwarded to a syslog server?

Accepted Answer

Threat logs. B is correct because threat logs capture security-related events such as intrusion attempts, malware detection, and vulnerability exploits, which are critical for security monitoring. The Palo Alto Networks firewall can forward these logs to a syslog server (e.g., using UDP 514 or TCP 6514) for centralized analysis and alerting. This is a standard feature in PAN-OS for integrating with SIEM systems.

Answer

Packet capture logs

Answer

Configuration logs

Question 13

Which TWO management methods allow CLI access to a Palo Alto Networks firewall?

Accepted Answer

SSH. SSH (Secure Shell) is a standard management method that provides encrypted CLI access to Palo Alto Networks firewalls, allowing administrators to execute commands securely over a network. The serial console port on the firewall provides direct, out-of-band CLI access for initial configuration or troubleshooting when network connectivity is unavailable.

Answer

HTTPS

Answer

HTTP

Answer

Telnet

Question 14

An administrator configured NTP servers as shown. After committing, the firewall's time is not synchronized. Which additional configuration is required?

Accepted Answer

Enable NTP service under Device > Setup > Services. The NTP service must be explicitly enabled on the firewall under Device > Setup > Services before it will synchronize time with any configured NTP servers. Without enabling the NTP service, the firewall ignores the NTP server configuration entirely, even if the servers are reachable and correctly specified.

Answer

Configure an authentication key

Answer

Set time zone manually

Answer

Specify a source interface for NTP

Answer

Restart NTP service

Question 15

An administrator notices that the firewall's time is incorrect. Based on the exhibit, what is the most likely cause?

Accepted Answer

NTP service is stopped. The firewall's time is incorrect because the NTP service is stopped. NTP (Network Time Protocol) is responsible for synchronizing the system clock with an external time source. Without NTP, the firewall relies on its internal hardware clock, which can drift over time, leading to an incorrect time.

Answer

DNS proxy is running

Answer

Management service is down

Answer

SNMP is running

Answer

Syslog is running