PCNSA Device Management and Services Practice Test 6 — 15 Questions

Question 1

A Panorama-managed firewall currently allows SSH access from any IP. The security policy requires that administrative access to the firewall be possible only from Panorama. What should be configured?

Accepted Answer

Configure the management interface to accept connections only from the Panorama IP address.. Option A is correct because the requirement is to restrict administrative access to the firewall exclusively from Panorama. By configuring the management interface to accept connections only from the Panorama IP address, you create a source IP-based access control that blocks SSH (and other management protocols) from any other IP. This directly enforces the security policy while still allowing Panorama to manage the firewall.

Answer

Disable SSH and HTTP on the firewall.

Answer

Remove all local admin accounts.

Answer

Set 'Managed by Panorama' to enable.

Question 2

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

Accepted Answer

Session synchronization. Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Answer

Stateful failover

Answer

Packet buffer

Answer

Session Timer adjustment

Question 3

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 4

An administrator wants to ensure that a specific security policy rule is applied before all other rules. What should be configured?

Accepted Answer

Move the rule to the top of the rulebase. In Palo Alto Networks firewalls, security policy rules are evaluated in a top-down order, and the first matching rule is applied. Moving a rule to the top of the rulebase ensures it is evaluated before all other rules, guaranteeing it takes precedence regardless of its priority number. Priority numbers (1-65535) are used for ordering within the rulebase, but the physical position in the list determines evaluation order; setting priority to 1 does not automatically place the rule at the top if other rules with lower numbers exist.

Answer

Set the rule's priority to 1

Answer

Use a schedule

Answer

Enable 'Optimize' on the rule

Question 5

A company uses Panorama to manage multiple firewalls. They have configured a template to push NTP settings, DNS, and authentication profiles. However, one firewall is not receiving the template settings. Which of the following is the most likely cause?

Accepted Answer

The firewall's management IP is not reachable from Panorama. Panorama pushes template settings to managed firewalls via a management-plane connection. If the firewall's management IP is not reachable from Panorama (e.g., due to network issues, incorrect IP, or routing problems), the template cannot be applied. This is the most direct cause of a firewall not receiving template settings, as Panorama requires reachability to commit and push configurations.

Answer

The template was not committed to Panorama

Answer

The firewall is not in the template's device group

Answer

The firewall has a local configuration that overrides the template

Question 6

An administrator needs to check the system uptime of the firewall. Which CLI command should be used?

Accepted Answer

show system info. The 'show system info' command on Palo Alto Networks firewalls displays system information including the system uptime, model, software version, and serial number. This is the correct command to check the firewall's uptime as it directly provides the time since the last reboot.

Answer

show uptime

Answer

show system state

Answer

show system resources

Question 7

A firewall administrator notices that after a power outage, the firewall boots up but fails to load the last committed configuration. What should the administrator do to recover the configuration?

Accepted Answer

Use the 'load config from' command via CLI to restore from the most recent saved config. Option D is correct because the 'load config from' CLI command allows the administrator to load a previously saved configuration file (e.g., from the most recent backup) into the running configuration without affecting the startup configuration. After loading, the administrator must commit the configuration to make it persistent. This is the standard recovery method when the last committed configuration fails to load after a reboot, as the firewall retains saved configuration files in its filesystem.

Answer

Perform a factory reset

Answer

Load a config file from the previous backup

Answer

Reinstall the PAN-OS image

Question 8

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

Accepted Answer

Use Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Answer

Use CLI scripts

Answer

Use a dedicated management server

Answer

Use SNMP

Question 9

A security administrator is configuring Panorama to manage multiple firewalls. Which two actions are required to ensure that a firewall receives its configuration from Panorama? (Choose two.)

Accepted Answer

Add the firewall to a template stack.. Option C is correct because a firewall must be added to a template stack to receive device-level settings (such as network interfaces and security zones) from Panorama. Template stacks allow hierarchical configuration of device-specific parameters, ensuring the firewall inherits the correct operational settings.

Answer

Commit the Panorama configuration.

Answer

Create a local admin account on the firewall.

Answer

Add the firewall to a device group.

Question 10

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Accepted Answer

Set the firewall priority to determine the active role.. Option A is correct because in an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Answer

Assign the same IP address to both firewalls for the data interface.

Answer

Sync the running configuration to the passive firewall.

Question 11

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Accepted Answer

Configure Panorama to collect logs.. Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Answer

Use the CLI command 'show log traffic'.

Answer

Use SNMP to retrieve logs.

Answer

View logs in the Monitor tab.

Question 12

Refer to the exhibit. The administrator notices that traffic from 192.168.1.100 to 10.1.1.1 using HTTPS is being blocked. What is the most likely cause?

Accepted Answer

The application is web-browsing, but HTTPS uses ssl application.. The exhibit shows a security policy rule that allows 'web-browsing' application traffic. HTTPS traffic uses the 'ssl' application, not 'web-browsing'. Since the rule's application match is set to 'web-browsing', it does not match HTTPS sessions, causing them to be blocked by the implicit deny rule at the end of the policy.

Answer

The source IP is not in the range.

Answer

The destination is in 10.0.0.0/8 but the policy is missing service TCP/443.

Answer

The rule is not committed.

Question 13

Refer to the exhibit. What does this log indicate?

Accepted Answer

An intrusion was detected and dropped.. The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Answer

A file transfer was blocked.

Answer

An intrusion was detected and allowed.

Answer

A URL filtering event occurred.

Question 14

Refer to the exhibit. What is the effect of this configuration?

Accepted Answer

The firewall responds to pings on the management interface.. The configuration shown is a management profile applied to an interface. The 'ping' service is enabled under the management profile, which allows the firewall to respond to ICMP echo requests (pings) on that specific interface. This does not permit transit ping traffic through the firewall, nor does it enable SSH or allow the firewall to initiate pings. Therefore, option C is correct.

Answer

The firewall allows ping traffic through all interfaces.

Answer

The management profile allows SSH access.

Answer

The firewall cannot ping others.

Question 15

A company needs to receive email alerts for critical system events. What is the recommended method to configure email notifications on a Palo Alto Networks firewall?

Accepted Answer

Create an Email server profile under Device > Server Profiles with SMTP settings. Option A is correct because Palo Alto Networks firewalls provide a native Email Server Profile under Device > Server Profiles that allows direct SMTP configuration for sending email alerts. This is the recommended method as it integrates directly with the firewall's alerting system without requiring external tools or services.

Answer

Configure an SNMP trap receiver to forward events to email

Answer

Enable ICMP echo replies to trigger email via a separate scripting tool

Answer

Set up a syslog server that sends email alerts