PCNSA Device Management and Services Practice Test 7 — 15 Questions

Question 1

A security analyst notices that a legitimate application is being incorrectly identified as a different application by the firewall. What is the best first step to resolve this issue?

Accepted Answer

Verify the application signature in the App-ID database and submit a false-positive report if needed. The first step in resolving an application misidentification is to verify the application signature in the App-ID database. If the signature is incorrect or missing, submitting a false-positive report allows Palo Alto Networks to update the database, ensuring accurate identification without manual overrides. This aligns with the principle of using the built-in App-ID engine as the primary identification method.

Answer

Reboot the firewall to refresh the application cache

Answer

Disable the application override and use port-based rules

Answer

Create a custom App-ID to override the incorrect identification

Question 2

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. Option E is correct because creating the virtual wire object under Network > Virtual Wires is the foundational step that defines the vwire and lets you bind its interfaces. Option A is correct because a virtual wire must have at least two interfaces assigned as members (typically a pair) so that traffic can be bridged transparently between them. Option C is correct because, as with any PAN-OS configuration change, the candidate configuration must be committed for the virtual wire to take effect. Option B is not valid because a virtual wire operates at Layer 2 and is transparent, so it does not have or require an IP address. Option D is not a required configuration step for the vwire itself; security policy is a separate function and is not part of the virtual wire setup process.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Question 3

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

Accepted Answer

Dataplane resources are exhausted. The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Answer

The firewall has been recently rebooted

Answer

System CPU is too high

Answer

The session limit is being reached

Question 4

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 5

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Accepted Answer

Configuration of the Panorama IP address on the firewall. The firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Answer

DNS resolution for the Panorama hostname

Answer

A DHCP server to assign an IP to the management interface

Question 6

Drag and drop the steps to configure a GlobalProtect portal and gateway on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Configure Authentication Policy, then Assign Gateway to Portal and Commit. GlobalProtect requires portal, gateway, security policy, assignment, and testing.

Answer

Configure GlobalProtect Gateway, then Configure GlobalProtect Portal, then Configure Authentication Policy, then Assign Gateway to Portal and Commit

Answer

Configure Authentication Policy, then Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit

Answer

Configure GlobalProtect Portal, then Configure GlobalProtect Gateway, then Assign Gateway to Portal and Commit, then Configure Authentication Policy

Question 7

Drag and drop the steps to perform a factory reset on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Backup configuration, then access CLI, then issue factory-reset command, then confirm, then reboot.. Factory reset requires backup, CLI access, reset command, confirmation, and reboot.

Answer

Access CLI, then issue factory-reset command, then confirm, then reboot, then backup configuration.

Answer

Backup configuration, then access CLI, then confirm, then issue factory-reset command, then reboot.

Answer

Reboot, then access CLI, then backup configuration, then issue factory-reset command, then confirm.

Question 8

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access

Question 9

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

Accepted Answer

Create a single device group containing both firewalls and configure security policies there.. The best way to share security policies across firewalls with different interface configurations is to use a single device group containing both firewalls. Device groups are designed to manage security policies centrally, while templates handle device-specific settings like interface configurations. Option B is correct because it allows policy consistency without duplicating effort. Option A (separate device groups) would require manual duplication. Option C (templates) is incorrect because templates are for device-level configuration, not security policies. Option D (Shared policy with overrides) is not a standard or efficient approach for this scenario.

Answer

Create separate device groups for each firewall and configure identical policies manually.

Answer

Use templates to define security policies and assign to both firewalls.

Answer

Use the Shared policy and override for interfaces.

Question 10

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

Accepted Answer

Path monitoring.. Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Answer

Heartbeat backup.

Answer

Session replication.

Answer

Link monitoring on all interfaces.

Question 11

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

Accepted Answer

Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.. Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Answer

Use the default log forwarding settings and configure the syslog servers globally.

Answer

Create a single log forwarding profile with both syslog profiles and assign it to all rules.

Answer

Configure each firewall rule to specify which syslog server to send logs to.

Question 12

A firewall uses an external SMTP server for email alerts. The SMTP server is reachable via a specific virtual router and interface. What must be configured to ensure the firewall uses the correct path to reach the SMTP server?

Accepted Answer

Configure a service route for SMTP.. Service routes in Palo Alto Networks firewalls explicitly define the source interface and virtual router used for outbound management traffic, such as SMTP email alerts. By configuring a service route for SMTP, the firewall ensures that email alerts are sent via the specified virtual router and interface, overriding the default management plane routing behavior.

Answer

Ensure the SMTP server is in the same zone as the management interface.

Answer

Configure an SNMP trap destination.

Answer

Add a static route for the SMTP server.

Question 13

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Accepted Answer

Use a script that logs in via SSH and runs 'save config to scp/tftp'. The firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Answer

Use the CLI command 'request system backup config schedule'

Answer

Set a recurring cron job via the firewall's built-in cron

Question 14

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Accepted Answer

It applies an interface management profile.. The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Answer

It applies a security rule.

Answer

It applies a QoS profile.

Answer

It applies a Zone Protection profile.

Question 15

Refer to the exhibit. A security analyst reviews a traffic log entry in JSON format. Which firewall feature is responsible for including the 'user' field in the log?

Accepted Answer

User-ID. The 'user' field in a traffic log is populated by User-ID, which maps IP addresses to usernames by monitoring authentication events from Active Directory, LDAP, or terminal services agents. This allows the firewall to log and enforce policies based on user identity rather than just IP addresses.

Answer

Data Filtering

Answer

Captive Portal

Answer

GlobalProtect