PCNSA Multiple Select — 40 Questions

Question 1

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. Option A is correct because a Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 2

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Options B and D are correct. Option A is wrong because CA-signed certs are recommended for trust. Option C is wrong because decrypting internal traffic can cause issues; best practice is to exclude internal traffic. Option E is wrong because decrypting all traffic is not recommended; use selective decryption.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 3

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Option B is correct because setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 4

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. Option A is correct because DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 5

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Use zone-based policies instead of IP-based policies whenever possible.. Option B is correct because zone-based policies reduce complexity and improve scalability by grouping interfaces into security zones, allowing policies to be applied based on traffic direction (e.g., from Trust to Untrust) rather than individual IP addresses. This aligns with Palo Alto Networks' best practice of using zones to simplify rule management and enhance security posture, as IP-based policies become unmanageable in dynamic environments.

Answer

Enable logging on all rules to ensure complete audit trails.

Answer

Sort rules alphabetically by name to simplify rulebase navigation.

Answer

Use service objects based on TCP/UDP ports to define application traffic.

Question 6

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. Option A is correct because the firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 7

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. Option A is correct because a virtual wire requires at least two interfaces to be added as members, which allows the firewall to transparently bridge traffic between them without any IP configuration. The virtual wire acts as a Layer 2 bump-in-the-wire, so interfaces are placed into the vwire to forward frames based on MAC addresses, not IP routing.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Question 8

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Troubleshooting > Generate Tech Support File. Option C is correct because the Palo Alto Networks firewall GUI provides a dedicated path under Device > Troubleshooting > Generate Tech Support File to generate and download a comprehensive technical support file. This file bundles logs, configuration, and system state data essential for troubleshooting.

Answer

Using the CLI command 'save config to tftp'

Answer

Using the GUI under Monitor > Packet Capture

Answer

Using the CLI command 'show tech-support'

Question 9

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Accepted Answer

Using the GUI under Device > Dynamic Updates > Software. Option A is correct because the PAN-OS software upgrade can be initiated via the GUI under Device > Dynamic Updates > Software, where administrators can download and install new PAN-OS versions. This is a standard method for upgrading the firewall's operating system through the web interface.

Answer

Using the GUI under Device > Dynamic Updates > Content Updates

Answer

Downloading the image via SCP and using 'load software'

Answer

Using Panorama's 'Software' tab to push an upgrade to the firewall

Question 10

Which two components are part of Content-ID? (Choose two.)

Accepted Answer

File Blocking. File Blocking (option B) is a core component of Content-ID that allows administrators to block or allow specific file types based on MIME type or file extension, regardless of the application or port used. Data Filtering (option C) is also part of Content-ID and enables inspection of data patterns (e.g., credit card numbers, SSNs) within application traffic to prevent data exfiltration. Both features operate after App-ID identifies the application, providing granular control over content within allowed sessions.

Answer

Application Override

Answer

URL Filtering

Question 11

Which TWO of the following are true about App-ID? (Choose two.)

Accepted Answer

App-ID identifies applications regardless of port.. App-ID is designed to identify applications based on their unique traffic behavior, not just port numbers. By using signatures, protocol decoding, and behavioral analysis, App-ID can accurately detect applications even when they are running on non-standard ports, such as SSH on TCP 2222 or HTTP on TCP 8080. This decoupling from port-based identification is a core strength of the Palo Alto Networks next-generation firewall.

Answer

App-ID cannot identify custom applications.

Answer

App-ID can only identify applications on standard ports.

Question 12

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Accepted Answer

An application override is configured that misidentifies the app.. Option B is correct because an application override explicitly forces the firewall to classify traffic as a specific application, bypassing App-ID's signature-based identification. If the override is misconfigured, the firewall will consistently misidentify the traffic, leading to incorrect policy enforcement. This is a common cause of App-ID misidentification when administrators manually override the default identification process.

Answer

Packet size exceeds the maximum transmission unit.

Question 13

Which TWO are capabilities of Content-ID? (Choose two.)

Accepted Answer

Blocking files by type (e.g., .exe, .pdf).. Content-ID is a Palo Alto Networks technology that extends App-ID by inspecting the actual content of traffic. It includes a file blocking capability that can block files by type (e.g., .exe, .pdf) based on the file's signature, not just its extension, providing granular control over file transfers. This is a core feature of Content-ID for data filtering.

Answer

Identifying the application regardless of port.

Answer

Applying QoS policies to applications.

Question 14

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. Option A is correct because 'No Decrypt' is a valid action in a decryption policy rule that explicitly excludes traffic from decryption, often used for traffic that cannot be decrypted (e.g., certificate pinning) or should not be inspected for compliance reasons. This action ensures the firewall forwards the traffic without attempting SSL/TLS interception.

Answer

Block

Answer

Forward

Question 15

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy is correct because it allows the firewall to decrypt outbound SSL/TLS traffic from internal clients to external servers, enabling inspection of encrypted content for threats and data filtering. This is a core decryption feature in Palo Alto Networks firewalls, distinct from inbound inspection.

Answer

SSH Proxy

Answer

TLS 1.3 Decryption

Answer

SSL Reverse Proxy

Question 16

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Accepted Answer

Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.. Option A is correct because the 'Show Group Membership' feature in the PAN-OS web interface allows you to view all members of an address group and directly add a new address object by clicking 'Add New Address'. This creates a new address object and adds it to the group in one step. Option C is correct because navigating to Objects > Address Groups, selecting the group, and clicking 'Add' lets you add an existing address object to the group, though you cannot type an IP directly—you must select an existing address object from the list.

Answer

Execute 'set address-group add ip ' in CLI.

Answer

Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.

Answer

Create a tag, assign it to the IP address, and add the tag to the group.

Question 17

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. Option B is correct because the internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.

Question 18

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Accepted Answer

KVM. KVM (Kernel-based Virtual Machine) is a supported hypervisor for Palo Alto Networks firewalls, allowing deployment as a virtual machine (VM) on Linux-based virtualization platforms. Palo Alto Networks provides specific VM images (e.g., KVM-compatible QCOW2 format) for KVM environments, making it a valid method for virtualized deployments.

Answer

Microsoft Hyper-V

Answer

Docker

Answer

Oracle VirtualBox

Question 19

Which THREE are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

SSH Proxy. SSH Proxy is a valid method for decrypting SSL/TLS traffic on a Palo Alto Networks firewall because it allows the firewall to act as a man-in-the-middle for SSH connections, decrypting the SSH tunnel to inspect the encapsulated traffic. This is distinct from SSL/TLS decryption but is grouped under the same decryption feature set for inspecting encrypted protocols.

Answer

IPsec Decryption

Answer

Decryption Mirror

Question 20

Which THREE actions can a Security policy rule perform on traffic?

Accepted Answer

Drop. A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Answer

Reset

Answer

Block