PCNSA Hard Questions — 25 Difficult Questions

Question 1

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 2

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

Accepted Answer

Suspend the passive firewall, then re-suspend it to trigger a full configuration synchronization.. Suspending and then re-suspending the passive firewall forces a full configuration synchronization from the active to the passive node. This is the most efficient method to resync after a software upgrade, as it triggers a complete config push without requiring a reboot or factory reset, preserving the HA state and minimizing disruption.

Answer

Restart both firewalls to automatically trigger a configuration sync.

Answer

Perform a factory reset on the passive firewall and re-join it to the HA pair.

Answer

Suspend the active firewall to make the passive take over, then restore the config.

Question 3

Refer to the exhibit. A user at IP 10.1.1.5 on the untrust zone is trying to access a server on the trust zone. The traffic is being blocked by a default deny rule instead of being allowed by rule1. What is the most likely reason?

Accepted Answer

The rule uses negation on the source address.. When a rule uses negation on the source address (e.g., 'not 10.1.1.5'), the firewall treats the source as 'any IP except 10.1.1.5'. This means traffic from 10.1.1.5 will not match the rule, causing it to fall through to the default deny rule. Negation in Palo Alto Networks policies explicitly excludes the specified address from matching, which is a common misconfiguration.

Answer

The rule's destination is set to 'any' which is too broad.

Answer

The rule does not specify any application or service.

Answer

The rule has not been committed.

Question 4

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Accepted Answer

Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block. Adding a URL Filtering profile override rule for the specific URL above the category block allows the traffic while still blocking other sites in the 'hacking' category. Option A is wrong because changing the service to TCP/443 and allowing all applications would bypass application control and does not address the URL filtering block; it also weakens security by allowing other applications. Option B is wrong because removing the URL Filtering profile entirely would allow all hacking sites, defeating security. Option D is wrong because changing the URL Filtering action for 'hacking' to 'allow' would allow all websites in that category, not just the specific one, reducing security.

Answer

Change the service to TCP/443 and allow all applications

Answer

Remove the URL Filtering profile from the security rule

Answer

Change the URL Filtering action for 'hacking' category to 'allow'

Question 5

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 6

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Accepted Answer

The traffic will be denied by the implicit deny rule because the application does not match.. The security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it. Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Answer

The traffic will be allowed if the user uses HTTP instead.

Answer

The traffic will be allowed because the rule has log-start enabled.

Answer

The traffic will be allowed because the source and destination zones match.

Question 7

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Policy Optimizer requires a valid support license to access the cloud-based service that analyzes rules. Options A, C, and D are not prerequisites; Policy Optimizer can analyze any rule regardless of security profiles, logging settings, or hit count rank.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 8

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

Accepted Answer

The application filter must specify the parent application 'facebook' because 'facebook-base' is a sub-application.. In Panorama, application filters require the parent application name when filtering by sub-application. 'facebook-base' is a sub-application of 'facebook', so the correct filter should be '(app eq facebook) (subapp eq facebook-base)'. Option A correctly identifies that the filter must specify the parent application. Option B is incorrect because Panorama supports both scheduled and ad-hoc queries. Option C is incorrect because the report template does not need to be committed to a device group; reports are run independently. Option D is incorrect because log forwarding to Panorama is configured in the log forwarding profile, but the port is not the issue; the logs are already forwarded.

Answer

Panorama only supports scheduled reports, not ad-hoc queries.

Answer

The report template is not committed to the device group.

Answer

The firewall's log forwarding profile must be set to send logs to Panorama on a separate port.

Question 9

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Accepted Answer

The traffic is being dropped due to a security policy rule that denies the traffic. If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer

The traffic is intra-zone, not inter-zone

Answer

The firewall is using hardware offload for fast-path processing

Answer

The packet is part of an existing session that has not timed out

Question 10

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule. This is a standard method of creating an exception to a broader deny rule.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 11

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 12

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection. Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 13

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options with null label, A, and D are correct. The null option is correct because if the destination address object is not in the rule's referenced address group, the rule will not match the traffic. Option A is correct because the traffic must match the source zone specified in the rule; otherwise, the rule is skipped. Option D is correct because a disabled rule is not evaluated and thus will not be hit. Option B is incorrect because a high hit count indicates the rule is being hit, not that it is not matched. Option C is incorrect because log forwarding configuration does not affect rule matching. Option E is incorrect because even though the action is set to drop, the rule can still be matched (and then drops traffic), so it can be hit.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 14

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Accepted Answer

The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.. The Anti-Malware profile set to 'default' relies on known signatures and may not detect malware using a custom packer that is not recognized. The default profile does not include advanced analysis like WildFire, which could identify unknown threats. Option A is incorrect because using application 'ssl' is appropriate for decrypted SSL traffic; the traffic is correctly identified. Option B is incorrect because while content updates for WildFire are important, the primary issue is the profile not leveraging WildFire analysis; the default profile may not send samples to WildFire even with latest updates. Option C is incorrect because the decryption exclusion list does not include the domain; the malware source is not in the financial services category.

Answer

The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Answer

The firewall is missing the latest content updates for WildFire.

Answer

The decryption exclusion list includes the domain of the malware source.

Question 15

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Accepted Answer

Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses. The HA1 interfaces must be on the same Layer 2 domain (VLAN) and able to communicate via ICMP to form the control link. The 'link down' status on the HA1 interface, despite physical connectivity, indicates a Layer 2 misconfiguration (e.g., VLAN mismatch or port mode issue) on the replaced switch. Verifying that the HA1 IP addresses can ping each other confirms Layer 3 reachability, which is essential for HA1 heartbeats and state synchronization.

Answer

Ensure that the HA2 interfaces are also connected and configured correctly

Answer

Change the HA2 IP addresses to be on the same subnet as HA1

Answer

Enable HA ping on the HA1 interface to test connectivity

Question 16

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Accepted Answer

The firewall's root CA certificate deployed to client browsers. In forward proxy decryption, the firewall acts as a trusted intermediary by generating a certificate for each HTTPS site the user visits, signed by the firewall's own root CA. For this to work without browser security warnings, the firewall's root CA certificate must be deployed to every client browser's trusted root store. This allows the browser to trust the firewall's dynamically generated server certificates, enabling seamless decryption and inspection of outbound SSL/TLS traffic.

Answer

The server's private key

Answer

A security policy rule allowing decrypted traffic

Question 17

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. A Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 18

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Accepted Answer

The SSH key exchange algorithm used by the client or server is not in the firewall's supported list.. The error message indicates 'unsupported key exchange algorithm'. SSH decryption requires the firewall to act as a proxy and re-encrypt the session. If the client or server uses a key exchange algorithm that the firewall does not support, decryption will fail. The exhibit shows a policy for SSH decryption and a session, but the algorithm is not supported.

Answer

The firewall does not have a certificate installed for SSH decryption.

Answer

The SSH session is using a cipher that is not supported by the firewall's decryption engine.

Answer

The decryption policy is misconfigured because the service is set to 'any' instead of 'ssh'.

Question 19

Refer to the exhibit. A user reports that they receive a certificate warning when accessing https://example.com. The firewall is configured to decrypt SSL traffic. What is the most likely cause?

Accepted Answer

The client device does not have the firewall's CA certificate installed in its trusted root store.. The log shows an error 'Certificate is not trusted by client'. This typically occurs when the firewall's decryption CA certificate is not installed in the client's trusted root store. The firewall's certificate is valid, but the client does not trust it.

Answer

The web server's certificate is invalid and the firewall is not configured to block untrusted certificates.

Answer

The decryption policy is not matching the traffic because the destination is not specified.

Answer

The firewall's decryption certificate is expired.

Question 20

Refer to the exhibit. What does this log indicate?

Accepted Answer

An intrusion was detected and dropped.. The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Answer

A file transfer was blocked.

Answer

An intrusion was detected and allowed.

Answer

A URL filtering event occurred.