PCNSA Matching — 10 Questions

Question 1

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 2

Match each security rule type to its purpose.

Accepted Answer

Security rule: Controls traffic based on source, destination, application, and service.. Correct matches: Security rule controls traffic based on source/destination/app/service; NAT rule translates IP addresses/ports; Decryption rule decrypts SSL/TLS traffic. Common confusions: QoS rules are for marking and prioritizing traffic, not access control; Application Override rules bypass App-ID, not decrypt traffic.

Answer

QoS rule: Controls traffic based on source, destination, and application.

Answer

Application Override rule: Decrypts traffic for inspection.

Question 3

Match each security zone type to its characteristic.

Accepted Answer

Trust: Network zone for internal trusted users and resources.. In Palo Alto firewalls, typical security zones include Trust (internal), Untrust (external), DMZ (public services), and Management (firewall admin). Common confusions arise from swapping Trust and Untrust or misattributing DMZ characteristics.

Answer

Trust: Zone for publicly accessible servers.

Answer

Untrust: Zone for internal trusted networks.

Question 4

Match each Palo Alto Networks feature to its category.

Accepted Answer

App-ID: Network Security. App-ID belongs to Network Security as it identifies applications. WildFire is a Threat Prevention feature for malware analysis. GlobalProtect enables Remote Access. Common confusions include mixing App-ID with threat prevention or Panorama with remote access.

Answer

App-ID: Threat Prevention

Answer

Panorama: Remote Access

Question 5

Match each Palo Alto Networks service to its typical use.

Accepted Answer

Panorama: Centralized management and reporting for multiple firewalls. Panorama is used for centralized management and reporting of multiple firewalls. WildFire provides cloud-based malware analysis and prevention. Common confusions include swapping these services or confusing them with AutoFocus.

Answer

Panorama: Cloud-based threat intelligence

Answer

WildFire: Centralized management for firewalls

Question 6

Match each PAN-OS component to its role.

Accepted Answer

Management Plane: Handles device configuration, management access, and logging.. The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Answer

Management Plane: Processes and forwards network traffic based on security policies.

Answer

Data Plane: Handles device configuration, management access, and logging.

Question 7

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 8

Match each log type to its description.

Accepted Answer

Traffic: Logs of all network traffic sessions. Common mistakes involve confusing System logs (configuration changes, system events) with WildFire Submissions logs (files sent for analysis). Traffic, Threat, and URL Filtering logs are correctly matched to their standard definitions.

Answer

WildFire Submissions: Logs of system events

Answer

System: Logs of files submitted for malware analysis

Question 9

Match each protocol to its default port used by Palo Alto Networks.

Accepted Answer

HTTPS: 443. The correct matches are HTTPS:443, SSH:22, and HTTP:80. Common confusions include swapping ports between HTTPS and SSH or HTTP, as all are used for management access.

Answer

HTTPS: 22

Answer

SSH: 80

Answer

HTTP: 443

Question 10

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications traversing the network regardless of port. The correct matches are: App-ID identifies applications, User-ID maps users, Content-ID inspects content, WildFire analyzes unknown threats. Common confusions involve swapping the definitions of App-ID and User-ID.

Answer

App-ID: Maps users to IP addresses for policy enforcement

Answer

User-ID: Identifies applications traversing the network regardless of port