PCNSA Device Management and Services — Timed 20 Questions

Question 1

During a firewall upgrade from PAN-OS 9.1 to 10.0, the administrator receives an error that the upgrade cannot proceed because there is a pending commit. The administrator checks the commit status and sees that a commit was initiated but has not completed. What is the best course of action?

20 minute time limit — choose an answer to begin.

Accepted Answer

Run 'commit force yes' from the CLI to force the commit. The 'commit force yes' command overrides a stuck or incomplete commit by forcing the commit operation to proceed, which clears the pending commit state and allows the upgrade to continue. In PAN-OS, a pending commit blocks administrative operations like upgrades, and forcing the commit is the safest way to resolve this without disrupting the firewall's operational state.

Answer

Reboot the firewall to clear the pending commit

Answer

Wait for the commit to complete automatically

Answer

Cancel the upgrade and restart

Question 2

An administrator needs to back up the firewall configuration before making changes. Which method creates a complete backup that can be restored to the same or a different firewall?

Accepted Answer

Use the 'Device > Setup > Operations > Export named configuration snapshot' and select 'running-config.xml'. Exporting the running-config.xml via 'Device > Setup > Operations > Export named configuration snapshot' creates a complete XML backup of the entire running configuration. This file can be imported and restored to the same or a different firewall of the same model and PAN-OS version, ensuring full recovery of all settings, including network, policy, and object configurations.

Answer

Use the 'Device > Setup > Operations > Save named configuration snapshot' option

Answer

Use the 'Save Candidate Config' option in the GUI

Answer

Use the CLI command 'show config running' and copy the output

Question 3

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Dynamic Updates > Software. Option A is correct because the PAN-OS web interface provides the software upgrade workflow under Device > Dynamic Updates > Software, where an administrator can check for, download, and install a new PAN-OS image. Option B is correct because the CLI command 'request system software upgrade install version <version>' is the standard operational command used to install a previously downloaded PAN-OS version on a firewall. Option C is incorrect because Content Updates covers dynamic content such as Applications and Threats, Antivirus, and WildFire signatures, not the PAN-OS base image. Option D is incorrect because 'load software' is not a valid PAN-OS CLI command for installing an OS image, and SCP is not the supported upgrade mechanism. Option E is incorrect because Panorama's Software tab is used to manage Panorama's own software, and Panorama does not push PAN-OS upgrades to managed firewalls in that manner.

Answer

Using the GUI under Device > Dynamic Updates > Content Updates

Answer

Downloading the image via SCP and using 'load software'

Answer

Using Panorama's 'Software' tab to push an upgrade to the firewall

Question 4

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Troubleshooting > Generate Tech Support File. Option C is correct because the Palo Alto Networks web interface provides the tech support file generation under Device > Troubleshooting > Generate Tech Support File, which packages logs, configuration, and diagnostics into a single bundle for TAC. Option D is correct because the CLI command 'generate tech-support file' produces the same tech support archive from the command line, which is the standard supported method for collecting this file. Option A is incorrect because 'save config to tftp' exports the running configuration to a TFTP server, not a technical support file. Option B is incorrect because Monitor > Packet Capture is used to capture packet data, not to generate a tech support bundle. Option E is incorrect because 'show tech-support' is not a valid PAN-OS command for generating a tech support file.

Answer

Using the CLI command 'save config to tftp'

Answer

Using the GUI under Monitor > Packet Capture

Answer

Using the CLI command 'show tech-support'

Question 5

Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?

Accepted Answer

Rule 1 (Allow-Sales). (Rule 1 – Allow-Sales) is correct. The source 10.1.1.50 belongs to the Sales zone, and the destination 192.168.1.100 belongs to the Servers zone. This is interzone traffic. Rule 1 explicitly permits traffic from Sales to Servers on TCP port 443, so it matches this traffic. The traffic log shows no entries because logging is disabled on Rule 1. The user's inability to connect is likely due to a server-side issue (e.g., the server not listening on port 443) or a routing problem, not because the firewall is dropping the traffic.

Answer

Interzone-default

Answer

Intrazone-default

Answer

Rule 2 (Allow-HR)

Question 6

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Accepted Answer

Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses. The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.

Answer

Ensure that the HA2 interfaces are also connected and configured correctly

Answer

Change the HA2 IP addresses to be on the same subnet as HA1

Answer

Enable HA ping on the HA1 interface to test connectivity

Question 7

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Accepted Answer

Check the Traffic log with the session's source IP and destination. The Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Answer

Check the System log for related entries

Answer

Run a packet capture on the ingress interface

Answer

Check the global counters for dropped packets

Question 8

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Accepted Answer

Create a security policy rule that allows traffic from the internal zone to the external zone. In a virtual wire deployment (which operates at Layer 2), traffic inspection is still governed by security policy rules. A rule allowing traffic from the internal zone to the external zone ensures that all outbound traffic is evaluated and inspected by the firewall. Security policies are the primary mechanism for controlling and logging traffic, regardless of the deployment mode.

Answer

Define a NAT policy to translate internal IPs to the external interface

Answer

Enable SSL decryption on the firewall

Answer

Configure a virtual wire between the internal and external interfaces

Question 9

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

Accepted Answer

The FTP application requires additional configuration for passive mode. FTP uses two separate channels: a control channel (TCP 21) and a data channel. In passive mode, the client initiates both connections, but the data channel uses a random high port negotiated via the control channel. The Palo Alto Networks firewall's application decoder for FTP must inspect the control channel to dynamically open pinholes for the data channel; without this, the data connection is blocked even if the control channel is allowed. Option D is correct because the administrator likely created a rule for application 'ftp' but did not ensure that the FTP application's passive mode data connections are properly handled, which requires the firewall to perform application-level inspection and create temporary security policy openings for the negotiated data ports.

Answer

The destination IP is not covered by a NAT policy

Answer

Logging is not enabled on the rule

Answer

The rule is set to deny instead of allow

Question 10

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Accepted Answer

Review the application specified in the rule and the actual traffic. The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Answer

Ensure that logging is enabled on the rule

Answer

Check the zone configuration for the destination

Answer

Verify that the source and destination IP ranges are correct

Question 11

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Accepted Answer

Define at least one static route or enable a dynamic routing protocol. When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Answer

Set the administrative distance for the default route

Answer

Configure OSPF as the routing protocol

Answer

Configure route redistribution

Question 12

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Accepted Answer

The internal interface (ethernet1/2) is administratively down. The exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Answer

The internal interface has no IP address assigned

Answer

The internal zone is not configured

Answer

The default route is missing

Question 13

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

Accepted Answer

The vsys2 is not included in the device group on Panorama.. Panorama pushes configuration to firewalls based on device group membership. If vsys2 is not included in the device group assigned to the firewall, Panorama will not push the updated configuration to that virtual system, even if the firewall itself is reachable and other vsys are updated. The administrator verified the template stack assignment, but the device group inclusion is a separate prerequisite for configuration delivery.

Answer

The commit on Panorama failed for vsys2 due to a validation error.

Answer

The admin user does not have sufficient privileges to push configuration to vsys2.

Answer

The firewall's serial number is not registered correctly in Panorama for vsys2.

Question 14

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Define zones, then address objects, then application/service, then action, then commit. Security policies are configured by first defining zones, then addresses, then application/service, then action, and finally committing.

Answer

Define address objects, then zones, then application/service, then action, then commit

Answer

Define zones, then address objects, then action, then application/service, then commit

Answer

Commit, then define zones, then address objects, then application/service, then action

Question 15

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications traversing the network regardless of port. The correct matches are: App-ID identifies applications, User-ID maps users, Content-ID inspects content, WildFire analyzes unknown threats. Common confusions involve swapping the definitions of App-ID and User-ID.

Answer

App-ID: Maps users to IP addresses for policy enforcement

Answer

User-ID: Identifies applications traversing the network regardless of port

Question 16

Match each protocol to its default port used by Palo Alto Networks.

Accepted Answer

HTTPS: 443. The correct matches are HTTPS:443, SSH:22, and HTTP:80. Common confusions include swapping ports between HTTPS and SSH or HTTP, as all are used for management access.

Answer

HTTPS: 22

Answer

SSH: 80

Answer

HTTP: 443

Question 17

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Accepted Answer

Enable local authentication and configure RADIUS as the primary authentication method with local fallback.. It allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Answer

Create local accounts for all engineers and sync with AD manually.

Answer

Use Kerberos authentication only.

Answer

Configure only RADIUS authentication and disable local authentication.

Question 18

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Accepted Answer

Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.. Enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Answer

Subscribe to the WildFire cloud and rely on updates.

Answer

Set the content update schedule to check every minute.

Answer

Manually download the latest content from the support portal and upload via CLI.

Question 19

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Accepted Answer

Use the 'commit revert' command to revert to before the problematic commit.. The 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Answer

Issue the 'revert to last known good configuration' command.

Answer

Use 'show configuration saved' and copy the previous config.

Answer

Reboot the firewall to load the previous running config.

Question 20

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Accepted Answer

Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.. PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Answer

Use the CLI command 'set snmp trap' with the receiver IP.

Answer

Configure an SNMP manager and select the traps to send.

Answer

Enable SNMP on the management interface and set the trap destination.