PCNSA Device Management and Services Practice Test 6 — 15 Questions

Question 1

An administrator needs to configure the firewall to send SNMP traps to a monitoring server at 192.0.2.50. The SNMP community string is 'public'. After configuring the SNMP community and trap destination under Device > Setup > Services > SNMP, the administrator notices that traps are not being received. The monitoring server is reachable from the management interface. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's management interface does not have a default gateway configured, preventing outbound SNMP traps.. SNMP traps are sent from the firewall's management interface by default. For the traps to reach a monitoring server on a different subnet, the management interface must have a default gateway configured so that outbound traffic can be routed. Without a default gateway, the firewall cannot send traps beyond its local subnet, resulting in the monitoring server not receiving them. This is a common oversight when the management interface is on an isolated network.

Answer

The SNMP trap destination must be configured with the source interface set to the management interface.

Answer

The SNMP trap destination requires an Interface Management profile with SNMP enabled on the management interface.

Answer

The SNMP community string must be configured with the 'trap' option enabled.

Question 2

An administrator needs to allow a security analyst to log in to the Palo Alto Networks firewall web interface using RADIUS authentication. The RADIUS server is reachable from the management interface. After adding the RADIUS server profile under Device > Server Profiles > RADIUS, what is the next required step to enable RADIUS authentication for the analyst?

Accepted Answer

Create an authentication profile that references the RADIUS server profile and assign it to the analyst's administrator account.. To use RADIUS for administrative authentication, you first create a RADIUS server profile, then create an authentication profile that references it. Finally, you assign that authentication profile to the specific administrator account. This binds the analyst's login to RADIUS. The management interface does not directly consume authentication profiles; they are applied to administrator accounts or authentication sequences.

Answer

Create an authentication profile that references the RADIUS server profile and assign it to the management interface.

Answer

Enable RADIUS authentication globally under Device > Setup > Services and specify the server profile.

Answer

Configure a RADIUS authentication sequence and apply it to the management interface under Device > Setup > Management.

Question 3

A security administrator is configuring a Palo Alto Networks firewall to authenticate users via LDAP for GlobalProtect. The LDAP server requires a bind DN and password for queries. The administrator wants to ensure that user credentials are not sent in clear text over the network. Which configuration should be used?

Accepted Answer

Configure the LDAP server profile to use LDAPS on port 636. LDAPS encrypts LDAP traffic using SSL/TLS, preventing credentials from being transmitted in clear text. Configuring the LDAP server profile to use LDAPS on port 636 is the standard and recommended method to secure LDAP authentication for GlobalProtect and other services. It ensures confidentiality and integrity of authentication data.

Answer

Configure an IPsec tunnel between the firewall and the LDAP server

Answer

Enable Kerberos authentication in the LDAP server profile

Answer

Use LDAP on port 389 with StartTLS enabled

Question 4

An administrator is configuring a Palo Alto Networks firewall to use an external LDAP server for administrator authentication. The LDAP server is at 203.0.113.100 and uses port 636 for LDAPS. The firewall must validate the server's certificate. Which TWO actions must the administrator take to ensure secure LDAP authentication? (Choose two.)

Accepted Answer

Create an Authentication profile that references the LDAP server and enable the 'Use SSL' option.. To securely authenticate administrators via LDAPS, the firewall must trust the LDAP server's certificate. This requires importing the issuing CA certificate as a trusted root CA on the firewall. Additionally, the Authentication profile used for administrator authentication must be configured to use SSL, ensuring that the connection to the LDAP server is encrypted. These two actions together enable certificate validation and secure communication.

Answer

Configure a service route for LDAP to use the management interface.

Answer

Enable 'Require TLS' in the LDAP server profile settings.

Answer

Generate a self-signed certificate on the firewall and upload it to the LDAP server.

Question 5

A firewall administrator needs to back up the current configuration of a PA-3220 firewall running PAN-OS 10.2 before making significant changes. The administrator wants to save the configuration to an external SCP server at 192.168.1.200. Which action should the administrator take?

Accepted Answer

Navigate to Device > Setup > Operations > Export named configuration snapshot and select SCP as the export method.. The 'Export named configuration snapshot' feature under Device > Setup > Operations allows exporting the running configuration to an external server using SCP. This directly satisfies the need to save the configuration to an SCP server before changes. Saving a snapshot locally or configuring scheduled backups does not provide an immediate external backup, and the CLI command as written is incorrect.

Answer

Use the CLI command 'scp export configuration from running-config to 192.168.1.200:/backup.xml'.

Answer

Navigate to Device > Setup > Operations > Save named configuration snapshot and then download the file via the web interface.

Answer

Navigate to Device > Setup > Management > Configuration Backup and enable scheduled backups to an SCP server.

Question 6

An administrator wants to back up the firewall configuration before making changes. Which method provides a complete backup of the configuration that can be restored later?

Accepted Answer

Export the configuration file from Device > Setup > Operations.. Exporting the configuration file from Device > Setup > Operations is the correct way to create a complete, restorable backup. It captures the entire running configuration as an XML file. This can be imported later if needed. Other options either do not exist or are for different purposes, such as automated scheduled backups, which do not provide an immediate manual backup.

Answer

Schedule a configuration backup to an external server under Device > Setup > Services.

Answer

Save a configuration snapshot from the Dashboard.

Answer

Use the 'Save Config' option under Device > Setup > Management.

Question 7

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable via the management interface. The administrator wants to ensure that logs are sent using TCP for reliability. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Assign the syslog server profile to the log forwarding settings for each log type that needs to be forwarded.. To send logs via TCP to a syslog server, you must first create a syslog server profile that specifies TCP as the transport protocol. Then, you must apply that profile to the relevant log forwarding settings so that logs are actually forwarded. Without both steps, logs will not be sent over TCP.

Answer

Configure a security policy rule to allow the firewall to send syslog traffic from the management interface to the syslog server.

Answer

Configure a NAT rule to translate the management interface IP to an external IP.

Answer

Enable SNMP traps to send logs to the syslog server.

Question 8

A network administrator is configuring a Palo Alto Networks firewall to use an external authentication server for administrator logins. The administrator wants to ensure that if the external server is unreachable, a local account can still be used for emergency access. Which configuration should be implemented?

Accepted Answer

Configure a local administrator account with a strong password and ensure it is not tied to external authentication.. The most reliable way to ensure emergency access is to create a dedicated local administrator account with a strong password that is not dependent on external authentication. This account remains functional even if the external authentication server is unreachable, allowing administrators to log in and resolve issues.

Answer

Create a local administrator account and configure it as a fallback in the authentication profile.

Answer

Use the 'admin' account with the default password and change it after emergency access.

Answer

Enable the 'Allow local authentication' checkbox in the authentication profile and use a local account.

Question 9

An administrator is configuring a Palo Alto Networks firewall to use an external LDAP server for administrator authentication. The LDAP server requires a bind DN and password. Which two configurations are required to successfully authenticate administrators via LDAP? (Choose two.)

Accepted Answer

Create an authentication profile that references the LDAP server profile and specifies the base DN and username attribute.. To authenticate administrators via LDAP, you must first create an LDAP server profile that specifies the server address, bind DN, and password. Then, you create an authentication profile that references that server profile and defines how to search for users, such as base DN and username attribute. Finally, you assign the authentication profile to administrator accounts. The other options are not required for basic LDAP authentication.

Answer

Configure a LDAP authentication sequence and assign it to the management interface.

Answer

Enable LDAP authentication under Device > Setup > Management > Authentication Settings.

Answer

Import the LDAP server's SSL certificate into the firewall's trusted certificate store.

Question 10

A security administrator needs to allow only specific IP addresses to access the firewall's web management interface. The administrator has already created an administrator account with a permitted IP address list. However, the administrator can still access the web interface from an unlisted IP address. What is the most likely cause?

Accepted Answer

The management interface has a permitted IP address list that is separate and may include the unlisted IP.. Access to the management interface is controlled by two independent IP address lists: the permitted IP addresses on the management interface and the allowed IP addresses on the administrator account. Both must permit the source IP for access to be granted. If the management interface list is not configured or includes the IP, access is allowed even if the administrator account list does not include it. Therefore, the most likely cause is that the management interface permitted IP list is not restricting access.

Answer

The administrator account is using an authentication profile that bypasses IP restrictions.

Answer

The administrator is also a member of a group that has a broader IP address list.

Answer

The administrator account's IP address list is not enforced for web interface access, only for CLI access.

Question 11

A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?

Accepted Answer

Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10. Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.

Answer

Search Threat logs for the destination IP

Answer

Search Config logs for any rule changes

Answer

Search System logs for the user's IP

Question 12

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

Accepted Answer

MGT (Management) interface. The MGT (Management) interface is a dedicated physical port on Palo Alto Networks firewalls designed specifically for out-of-band management traffic. It operates on a separate routing table and does not participate in production data forwarding, ensuring complete isolation of management traffic from production traffic as required by the scenario.

Answer

HA1 interface

Answer

VLAN interface

Answer

Ethernet 1/1

Question 13

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

Accepted Answer

Use the ACC (Application Command Center) and filter by user group and time range. The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

Answer

Export Traffic logs to CSV and analyze in Excel

Answer

Use the Top Applications report in the Reports tab

Answer

Use the Monitor tab's Session Browser with a filter for the user group

Question 14

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

Accepted Answer

The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed. For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Answer

The VLAN interface needs an IP address configured

Answer

The VLAN interface must be assigned to a virtual router

Answer

The firewall needs a commit to apply the changes

Question 15

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

Accepted Answer

Enable Session Setup and State Synchronization under HA configuration. Session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Answer

Configure HA1 and HA2 interfaces with appropriate IPs

Answer

Enable Config Sync on the HA General tab

Answer

Configure Path Monitoring to detect link failures