PCNSA Multiple Select — 40 Questions

Question 1

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Accepted Answer

Configure Panorama to collect logs.. Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Answer

Use the CLI command 'show log traffic'.

Answer

Use SNMP to retrieve logs.

Answer

View logs in the Monitor tab.

Question 2

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies. WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 3

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Accepted Answer

Verify that the policy has the correct source zone.. Options B and C are correct. Verifying the source zone (B) ensures the policy is applied to the correct traffic flow. Checking the traffic log (C) shows whether the session matched a security policy. Option A (CPU usage) does not verify policy matching. Option D (Threat log) is for blocked malicious traffic, not for verifying allowed traffic. Option E (URL filtering profile) is a content inspection feature, not directly for verifying policy matching.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 4

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Placing the most specific rules at the top of the rulebase (option B) ensures that traffic is matched quickly and correctly, reducing latency. Regularly reviewing and removing unused rules using hit counts (option D) improves performance and reduces security risks. Option A is wrong because enabling logging on all rules can overwhelm storage and impact performance, not increase visibility effectively. Option C is wrong because using a single 'allow all' rule defeats the purpose of a security policy and allows any traffic. Option E is wrong because disabling unused rules leaves clutter and can cause confusion; it's better to remove them.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 5

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options C and D are correct. To ensure traffic is inspected by threat prevention features, you need a security rule that allows the traffic and includes a security profile group with threat prevention (C). Additionally, the rule's action must be set to 'allow' (D) for the traffic to pass through and be inspected; otherwise, traffic would be blocked. Option A (decryption) is only required for encrypted traffic, but the question does not specify that all traffic is encrypted, so it is not universally required. Option B (NAT) is for address translation, not inspection. Option E (application override) is not necessary for threat prevention.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 6

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.

Question 7

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options with null label, A, and D are correct. The null option is correct because if the destination address object is not in the rule's referenced address group, the rule will not match the traffic. Option A is correct because the traffic must match the source zone specified in the rule; otherwise, the rule is skipped. Option D is correct because a disabled rule is not evaluated and thus will not be hit. Option B is incorrect because a high hit count indicates the rule is being hit, not that it is not matched. Option C is incorrect because log forwarding configuration does not affect rule matching. Option E is incorrect because even though the action is set to drop, the rule can still be matched (and then drops traffic), so it can be hit.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 8

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Accepted Answer

The firewall's root CA certificate deployed to client browsers. In forward proxy decryption, the firewall acts as a trusted intermediary by generating a certificate for each HTTPS site the user visits, signed by the firewall's own root CA. For this to work without browser security warnings, the firewall's root CA certificate must be deployed to every client browser's trusted root store. This allows the browser to trust the firewall's dynamically generated server certificates, enabling seamless decryption and inspection of outbound SSL/TLS traffic.

Answer

The server's private key

Answer

A security policy rule allowing decrypted traffic

Question 9

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. A Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 10

A security administrator is reviewing best practices for creating security policies on a Palo Alto Networks firewall. Which two of the following are recommended practices?

Accepted Answer

Use security profile groups to apply multiple profiles.. Security profile groups allow administrators to bundle multiple security profiles (e.g., antivirus, anti-spyware, vulnerability protection, URL filtering) into a single object. This simplifies policy management, ensures consistent enforcement, and reduces the risk of misconfiguration by applying a predefined set of protections to a rule.

Answer

Use security policy tags to group rules.

Answer

Use the 'any' zone for source and destination to reduce rule count.

Answer

Disable logging on rules that permit traffic to reduce log volume.

Question 11

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Accepted Answer

Create a security rule with a URL category set to 'internal-ip'.. The correct answers are B and E. Option B is valid because the 'internal-ip' URL category automatically applies to traffic from internal IP addresses, effectively bypassing URL filtering for internal users when used in a security rule with an allow action. Option E is valid because you can create a custom URL category listing internal websites that should be allowed, then use it in a security rule that allows traffic for internal users while applying strict filtering to external traffic. Option A is incorrect because URL Filtering profile override is not a standard feature; User-ID agent configuration does not provide such override. Option C is incorrect because setting the action to 'alert' only logs the traffic, it does not bypass the filtering (the traffic is still subject to the block action if matched). Option D is incorrect because there is no IP exemption list in URL filtering profiles; exemptions are based on URL categories, not IP addresses.

Answer

Enable URL Filtering profile override on the user-id agent configuration.

Answer

Set the URL Filtering profile action to 'alert' instead of 'block'.

Answer

Add the user's IP address to an exemption list in the URL filtering profile.

Question 12

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 13

Which THREE actions can be performed in a decryption policy? (Choose three.)

Accepted Answer

No-decrypt. In Palo Alto Networks decryption policy, the valid actions are Decrypt, No-decrypt, and Block. These three actions control how traffic is handled. Option D (Block) is indeed a valid decryption policy action; it is used to block traffic when decryption cannot be performed or is not allowed. Options A (App-ID) and B (Allow) are not decryption policy actions; they are security policy actions.

Answer

App-ID

Answer

Allow

Question 14

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. The correct answers are A (File Blocking) and D (Antivirus). Antivirus blocks known malware by comparing files against signature databases. File Blocking prevents specific file types (e.g., executables, archives) from being transferred, which can stop malware delivery. URL Filtering (B) controls web access based on categories, not malware blocking. Anti-Spyware (C) targets spyware specifically, not all known malware. Vulnerability Protection (E) blocks exploit attempts, not malware files themselves.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 15

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 16

Which TWO methods can be used to create a custom App-ID signature?

Accepted Answer

Using a packet buffer override.. A packet buffer override is a method used to create a custom App-ID signature by capturing and analyzing the payload of a specific application's traffic. This allows the firewall to identify the application based on unique byte sequences or patterns in the packet payload, which is essential for applications that use non-standard ports or encryption.

Answer

Using a Data Filtering profile.

Answer

Using a URL Filtering profile.

Answer

Using a custom application signature with a port match.

Question 17

Which TWO are required for accurate application identification when an application uses non-standard ports?

Accepted Answer

Enable App-ID.. App-ID is the core technology that identifies applications regardless of port, using signatures, protocol decoders, and behavioral analysis. When an application uses non-standard ports, App-ID must be enabled to inspect traffic beyond simple port-based classification, ensuring accurate identification even if the application is not using its default port.

Answer

Define a custom service for the port.

Answer

Use a Content-ID profile.

Answer

Disable SSL Decryption.

Question 18

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Accepted Answer

Log forwarding profile. A Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Answer

Email server profile

Answer

Syslog server profile

Answer

SNMP manager object

Question 19

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Accepted Answer

Create a service group with two service objects (one for 1000, one for 2000). A service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.

Answer

Create a service object with port range 1000-2000

Answer

Create a service object with port 1000 and use an application override

Answer

Create a single service object with port 1000 and a separate rule for port 2000

Question 20

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

FQDN. FQDN (Fully Qualified Domain Name) is a valid address object type in Palo Alto Networks that allows you to define a security policy rule based on a domain name rather than an IP address. The firewall dynamically resolves the FQDN to IP addresses at runtime, which is useful for destinations like cloud services or websites with changing IPs.

Answer

MAC Address

Answer

Subnet Object