PCNSA Device Management and Services Practice Test 6 — 15 Questions

Question 1

An administrator sees this log repeatedly. Which configuration change will allow 10.0.0.1 to access the management interface?

Accepted Answer

Add 10.0.0.1 to the allowed IP list in the management profile. The log indicates that the management interface is rejecting access attempts from 10.0.0.1 due to an IP-based access restriction. By adding 10.0.0.1 to the allowed IP list within the management profile, the administrator explicitly permits that host to reach the management interface, resolving the repeated denial.

Answer

Enable HTTP on the management interface

Answer

Disable management access restriction

Answer

Change the management interface to a different IP

Answer

Create a security policy allowing HTTP from 10.0.0.1

Question 2

An administrator modifies a security policy but the change does not take effect. What must the administrator do?

Accepted Answer

Commit the configuration.. In Palo Alto Networks firewalls, configuration changes are made in a candidate configuration that is not active until explicitly committed. The administrator must commit the configuration to apply the changes to the running configuration and enforce the new security policy. Without a commit, the modification remains pending and does not affect traffic.

Answer

Import the configuration.

Answer

Save the configuration.

Answer

Reboot the firewall.

Question 3

A Panorama-managed firewall currently allows SSH access from any IP. The security policy requires that administrative access to the firewall be possible only from Panorama. What should be configured?

Accepted Answer

Configure the management interface to accept connections only from the Panorama IP address.. The requirement is to restrict administrative access to the firewall exclusively from Panorama. By configuring the management interface to accept connections only from the Panorama IP address, you create a source IP-based access control that blocks SSH (and other management protocols) from any other IP. This directly enforces the security policy while still allowing Panorama to manage the firewall.

Answer

Disable SSH and HTTP on the firewall.

Answer

Remove all local admin accounts.

Answer

Set 'Managed by Panorama' to enable.

Question 4

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

Accepted Answer

Session synchronization. Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Answer

Stateful failover

Answer

Packet buffer

Answer

Session Timer adjustment

Question 5

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 6

An administrator wants to ensure that a specific security policy rule is applied before all other rules. What should be configured?

Accepted Answer

Move the rule to the top of the rulebase. In Palo Alto Networks firewalls, security policy rules are evaluated in a top-down order, and the first matching rule is applied. Moving a rule to the top of the rulebase ensures it is evaluated before all other rules, guaranteeing it takes precedence regardless of its priority number. Priority numbers (1-65535) are used for ordering within the rulebase, but the physical position in the list determines evaluation order; setting priority to 1 does not automatically place the rule at the top if other rules with lower numbers exist.

Answer

Set the rule's priority to 1

Answer

Use a schedule

Answer

Enable 'Optimize' on the rule

Question 7

A company uses Panorama to manage multiple firewalls. They have configured a template to push NTP settings, DNS, and authentication profiles. However, one firewall is not receiving the template settings. Which of the following is the most likely cause?

Accepted Answer

The firewall's management IP is not reachable from Panorama. Panorama pushes template settings to managed firewalls via a management-plane connection. If the firewall's management IP is not reachable from Panorama (e.g., due to network issues, incorrect IP, or routing problems), the template cannot be applied. This is the most direct cause of a firewall not receiving template settings, as Panorama requires reachability to commit and push configurations.

Answer

The template was not committed to Panorama

Answer

The firewall is not in the template's device group

Answer

The firewall has a local configuration that overrides the template

Question 8

An administrator needs to check the system uptime of the firewall. Which CLI command should be used?

Accepted Answer

show system info. The 'show system info' command on Palo Alto Networks firewalls displays system information including the system uptime, model, software version, and serial number. This is the correct command to check the firewall's uptime as it directly provides the time since the last reboot.

Answer

show uptime

Answer

show system state

Answer

show system resources

Question 9

A firewall administrator notices that after a power outage, the firewall boots up but fails to load the last committed configuration. What should the administrator do to recover the configuration?

Accepted Answer

Use the 'load config from' command via CLI to restore from the most recent saved config. The 'load config from' CLI command allows the administrator to load a previously saved configuration file (e.g., from the most recent backup) into the running configuration without affecting the startup configuration. After loading, the administrator must commit the configuration to make it persistent. This is the standard recovery method when the last committed configuration fails to load after a reboot, as the firewall retains saved configuration files in its filesystem.

Answer

Perform a factory reset

Answer

Load a config file from the previous backup

Answer

Reinstall the PAN-OS image

Question 10

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

Accepted Answer

Use Panorama. Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Answer

Use CLI scripts

Answer

Use a dedicated management server

Answer

Use SNMP

Question 11

A security administrator is configuring Panorama to manage multiple firewalls. Which two actions are required to ensure that a firewall receives its configuration from Panorama? (Choose two.)

Accepted Answer

Add the firewall to a template stack.. To receive its full configuration from Panorama, a firewall must be added to both a device group and a template stack. The device group provides policy objects (e.g., security policies, address objects), while the template stack provides device settings (e.g., interfaces, zones). Enabling Panorama Managed on the firewall is a necessary step but is performed on the firewall, not as part of configuring Panorama. Committing the Panorama configuration pushes changes but does not establish the management association.

Answer

Commit the Panorama configuration.

Answer

Create a local admin account on the firewall.

Answer

Enable 'Panorama Managed' on the firewall.

Question 12

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Accepted Answer

Set the firewall priority to determine the active role.. In an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Answer

Assign the same IP address to both firewalls for the data interface.

Answer

Sync the running configuration to the passive firewall.

Question 13

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Accepted Answer

Configure Panorama to collect logs.. Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Answer

Use the CLI command 'show log traffic'.

Answer

Use SNMP to retrieve logs.

Answer

View logs in the Monitor tab.

Question 14

Refer to the exhibit. The administrator notices that traffic from 192.168.1.100 to 10.1.1.1 using HTTPS is being blocked. What is the most likely cause?

Accepted Answer

The application is web-browsing, but HTTPS uses ssl application.. The exhibit shows a security policy rule that allows 'web-browsing' application traffic. HTTPS traffic uses the 'ssl' application, not 'web-browsing'. Since the rule's application match is set to 'web-browsing', it does not match HTTPS sessions, causing them to be blocked by the implicit deny rule at the end of the policy.

Answer

The source IP is not in the range.

Answer

The destination is in 10.0.0.0/8 but the policy is missing service TCP/443.

Answer

The rule is not committed.

Question 15

Refer to the exhibit. What does this log indicate?

Accepted Answer

An intrusion was detected and dropped.. The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Answer

A file transfer was blocked.

Answer

An intrusion was detected and allowed.

Answer

A URL filtering event occurred.