PCNSA Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The filter syntax is invalid; 'andd' should be 'and'.. The dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.

Answer

The address object must be a member of a static address group to be included in a dynamic group.

Answer

The security rule must specify the source zone explicitly.

Answer

The dynamic address group filter uses 'andd' which is a valid operator in older PAN-OS versions.

Answer

The dynamic address group only updates its membership after a system reboot.

Question 2

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. The firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 3

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Accepted Answer

The traffic will be denied by the implicit deny rule because the application does not match.. The security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it. Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Answer

The traffic will be allowed if the user uses HTTP instead.

Answer

The traffic will be allowed because the rule has log-start enabled.

Answer

The traffic will be allowed because the source and destination zones match.

Question 4

An administrator needs to create a security policy that allows access to a set of servers identified by a dynamic address group. The dynamic address group filter is 'WebServer' and 'Production'. The administrator wants to ensure that only servers that have both tags are included. After configuring the tags on the address objects, the administrator notices that some servers with only one of the tags are also being allowed. What is the most likely cause?

Accepted Answer

The dynamic address group filter is missing the 'and' operator between the tags.. Dynamic address group filters require explicit logical operators. If the administrator intended to require both tags but omitted the 'and' operator, the filter may default to an OR condition, including any object with either tag. The correct filter should be 'WebServer' and 'Production'. This ensures only objects with both tags are included. The other options do not explain why some servers with only one tag are included.

Answer

The address objects are not properly committed, so the tags are not applied.

Answer

The dynamic address group filter uses an OR condition instead of AND.

Answer

The address objects have been tagged with both tags, but the dynamic group filter is incorrectly using a wildcard.

Question 5

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 6

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Accepted Answer

The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.. The malware uses a custom packer not recognized by current Anti-Malware signatures. The default Anti-Malware profile may not block unknown malware effectively because it relies on signatures. WildFire would provide cloud-based analysis for unknown threats, but the question states the firewall is missing the latest content updates for WildFire, which could also be a factor. However, the most direct reason is that the Anti-Malware profile is set to 'default', which may not have the necessary heuristics or WildFire integration to block unknown malware. The other options are either contradicted by the scenario or less likely.

Answer

The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Answer

The firewall is missing the latest content updates for WildFire.

Answer

The decryption exclusion list includes the domain of the malware source.

Question 7

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 8

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

Accepted Answer

The security rule that allows the traffic does not include the custom application.. The security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Answer

SSL decryption is not enabled for the custom application.

Answer

The custom application needs to be added to the 'ssl' application group.

Answer

The application override was not committed.

Question 9

An organization uses App-ID to allow 'web-browsing' but notices that some web traffic is being blocked. The traffic is HTTP over port 8080. What is a likely cause?

Accepted Answer

The security rule does not have Application set to 'web-browsing' for that traffic.. If the security rule does not have 'web-browsing' set as the Application, the firewall will not allow HTTP traffic even if the port (8080) is permitted. App-ID identifies the application regardless of port, but the security policy must explicitly allow the application for the traffic to pass. In this case, the traffic is being blocked because the rule either has a different application or no application specified, so the firewall drops it by default.

Answer

The 'web-browsing' application does not include HTTP.

Answer

A custom application must be created for port 8080.

Answer

App-ID cannot identify HTTP over non-standard ports.

Question 10

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Accepted Answer

The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.. The most likely cause is that a more specific route for 10.10.20.0/24 in the virtual router's routing table points to a different virtual router or interface that belongs to a different zone. In Palo Alto Networks firewalls, zone membership is determined by the ingress interface, not by the source IP address alone. If traffic from the new subnet enters through an interface in a different zone, the security rule with source zone 'Internal' will not match, and the SSH connection is denied or dropped. This explains why other subnets in Internal work while the new subnet does not, even though the source address object covers it.

Answer

The application is not correctly identified because the SSH server uses a non-standard port.

Answer

There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.

Answer

The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.

Question 11

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Accepted Answer

Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses. The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.

Answer

Ensure that the HA2 interfaces are also connected and configured correctly

Answer

Change the HA2 IP addresses to be on the same subnet as HA1

Answer

Enable HA ping on the HA1 interface to test connectivity

Question 12

An administrator is tasked with centralizing the management of 50 Palo Alto firewalls spread across four geographical regions. The company has a Panorama VM deployed in the data center. Each firewall must receive a common set of security policies and URL filtering profiles, but regional administrators need the ability to add locally required policies. The administrator configures Panorama with device groups: 'Shared' device group for global policies, and four regional device groups (Americas, EMEA, APAC, Oceania). They create a template for basic network settings and use template stacks. After pushing the Device Group and Template configuration, some regional firewalls report that they are not receiving the shared policies. What is the most likely cause?

Accepted Answer

The firewalls are not connected to Panorama due to management IP misconfiguration. The most likely cause is that the firewalls are not connected to Panorama due to management IP misconfiguration. In Palo Alto Panorama, the 'Shared' device group is automatically pushed to all connected firewalls regardless of device group hierarchy. Therefore, if some firewalls are not receiving shared policies, it indicates a connectivity issue rather than a hierarchy problem.

Answer

The 'Shared' device group is not included in the device group hierarchy for the regional device groups

Answer

Regional administrators created local policies in their own device groups with higher order than shared policies

Answer

The template stack does not include the shared template

Question 13

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Accepted Answer

Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block. Adding a URL Filtering profile override rule for the specific URL above the category block allows the traffic while still blocking other sites in the 'hacking' category. Option A is wrong because changing the service to TCP/443 and allowing all applications would bypass application control and does not address the URL filtering block; it also weakens security by allowing other applications. Option B is wrong because removing the URL Filtering profile entirely would allow all hacking sites, defeating security. Option D is wrong because changing the URL Filtering action for 'hacking' to 'allow' would allow all websites in that category, not just the specific one, reducing security.

Answer

Change the service to TCP/443 and allow all applications

Answer

Remove the URL Filtering profile from the security rule

Answer

Change the URL Filtering action for 'hacking' category to 'allow'

Question 14

A company has a security policy rule that allows traffic from the Trust zone to the DMZ zone. The rule includes the application 'ftp' and service 'application-default'. Users can connect to the FTP server but cannot transfer files in passive mode. What is the most likely cause?

Accepted Answer

The firewall is not configured to allow the dynamic ports used by FTP passive mode, and a custom application or service must be created.. Passive FTP uses random high ports for data transfer. While Palo Alto Networks firewalls can dynamically open these ports via App-ID, issues can arise when the control channel is not properly inspected or NAT is involved. A common workaround is to create a custom application or service that allows the specific passive port range used by the FTP server.

Answer

The security policy rule is missing the 'ftp-data' application, which is required for file transfers.

Answer

The service 'application-default' only allows TCP port 21, so passive mode data ports are blocked.

Answer

The application 'ftp' does not include the dynamic ports used in passive mode, so a separate rule is needed.

Question 15

Refer to the exhibit. A security engineer observes that SSL decryption is not working for session 1. The policy and session table are shown. What is the most likely reason?

Accepted Answer

The decryption policy requires a certificate that is not installed on the firewall.. The session table shows an SSL session from 10.0.0.1 to 192.168.1.100:443, which matches POL-1 (forward-proxy). However, the decryption statistics show 0 sessions decrypted. The most likely cause is that the decryption policy requires a certificate to be imported and configured, and the firewall cannot perform decryption without a valid certificate. Other options (like policy order or application mismatch) are not supported by the exhibit.

Answer

The security policy is configured to allow SSL, but the decryption policy is not configured to decrypt SSL traffic.

Answer

The destination IP 192.168.1.100 is not in the decryption policy's destination list.

Answer

The firewall is not receiving the SSL handshake because the session is already established.

Question 16

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. Option E is correct because creating the virtual wire object under Network > Virtual Wires is the foundational step that defines the vwire and lets you bind its interfaces. Option A is correct because a virtual wire must have at least two interfaces assigned as members (typically a pair) so that traffic can be bridged transparently between them. Option C is correct because, as with any PAN-OS configuration change, the candidate configuration must be committed for the virtual wire to take effect. Option B is not valid because a virtual wire operates at Layer 2 and is transparent, so it does not have or require an IP address. Option D is not a required configuration step for the vwire itself; security policy is a separate function and is not part of the virtual wire setup process.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Question 17

An administrator is configuring a syslog server that is only reachable through a specific interface, ethernet1/2, which is in the 'dmz' zone. The syslog server IP is 172.16.1.100. To ensure syslog logs are sent via ethernet1/2, which configuration is required?

Accepted Answer

Configure a static route to 172.16.1.100 via ethernet1/2, and ensure the Interface Management Profile on ethernet1/2 allows syslog.. Syslog traffic is generated by the management plane. To send it through a specific interface, a route to the syslog server must point out that interface, and the interface's Interface Management Profile must allow syslog. Security policies and NAT rules do not affect management plane traffic. Therefore, the correct configuration involves a static route and an Interface Management Profile.

Answer

Configure a NAT rule to translate the syslog source IP to the ethernet1/2 IP, and set the syslog server in Device > Server Profiles > Syslog.

Answer

Set the syslog server in Device > Server Profiles > Syslog and enable 'Use Management Interface' for syslog.

Answer

Create a security policy rule allowing syslog traffic from the firewall to 172.16.1.100, and set the syslog server in Device > Server Profiles > Syslog.

Question 18

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. The firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 19

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Accepted Answer

There are a few sessions failing due to TLS version mismatch.. The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Answer

The firewall is rejecting many sessions due to certificate errors.

Answer

The decryption policy is not being hit because of low policy hits.

Answer

The current decryption session count is at its peak.

Question 20

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.