PCNSA Palo Alto Networks Platforms and Architecture — 20 Questions

Question 1

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

Accepted Answer

The rule is disabled in the rulebase.. Option D is correct because if a security policy rule is disabled in the rulebase, it will not be evaluated or enforced, even if it matches the traffic. The firewall will skip the rule entirely, meaning no logging or inspection occurs for traffic that would have matched it. This directly explains why the traffic is not being inspected or logged despite the rule appearing to be configured.

Answer

The rule is placed below an earlier rule that also matches the traffic.

Answer

The firewall's license for the threat prevention subscription has expired.

Answer

The firewall is in an active/passive HA pair and the passive unit is handling traffic.

Question 2

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

Accepted Answer

Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).. Option A is correct because it implements a least-privilege security model using Palo Alto Networks zones and granular application- and port-based rules. By creating separate zones (Web, App, DB) and explicitly allowing only the necessary protocols (e.g., HTTP/HTTPS from the internet to Web, specific ports from Web to App, and specific ports from App to DB), the firewall enforces strict segmentation and minimizes the attack surface. This design leverages the zone-based security paradigm of PAN-OS to control inter-zone traffic precisely, aligning with the principle of zero trust.

Answer

Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.

Answer

Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.

Answer

Place all servers in the same zone and use rules to allow traffic between them.

Question 3

A network administrator is troubleshooting a connectivity issue where users in the 192.168.1.0/24 subnet cannot reach a server at 10.0.0.10. The firewall has a rule that allows traffic from source zone 'Trust' to destination zone 'DMZ' with source address 192.168.1.0/24 and destination address 10.0.0.10. The traffic is matching the rule, but the packets are being dropped. What is the most likely reason?

Accepted Answer

The firewall does not have a route to the 10.0.0.0/24 network.. The traffic matches the security rule, but the firewall drops the packet because it cannot find a route to the destination network 10.0.0.0/24. In Palo Alto Networks firewalls, even if a security rule permits traffic, the firewall must have a valid route in its routing table to forward the packet to the next hop. Without a route, the firewall has no way to deliver the packet to the server at 10.0.0.10, resulting in a drop.

Answer

The security rule is not placed at the top of the rulebase.

Answer

A zone protection profile is blocking the traffic.

Answer

The destination server does not have a route back to the 192.168.1.0/24 subnet.

Question 4

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

Accepted Answer

A security policy rule that allows traffic from the internet zone to the DMZ zone and has a threat prevention profile attached.. Option C is correct because a security policy rule that allows traffic from the internet zone to the DMZ zone with a threat prevention profile attached is the essential component to inspect all traffic from the internet to the internal web server for threats. The threat prevention profile enables the firewall to perform intrusion prevention system (IPS) and antivirus inspection on the allowed traffic, ensuring malicious content is blocked. Without this profile, traffic would be permitted but not inspected for threats, failing the requirement.

Answer

Destination NAT policy to translate the public IP to the internal server.

Answer

SSL decryption policy to decrypt traffic to the web server.

Answer

A QoS policy to prioritize web traffic.

Question 5

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Accepted Answer

The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.. Option B is correct because after a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Answer

The firewall's CPU and memory are insufficient for the new PAN-OS version.

Answer

The firewall is performing a backup of the configuration.

Answer

The rulebase has grown too large.

Question 6

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

Accepted Answer

Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.. Virtual routers in different virtual systems (Vsys) are isolated by default. To enable inter-Vsys routing, you must configure either a virtual wire (which bridges the two Vsys at Layer 2) or route redistribution (which allows routes from one virtual router to be shared with the other). This provides the necessary Layer 3 connectivity between the Vsys A and Vsys B subnets.

Answer

Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.

Answer

Ensure both virtual routers are in the same virtual system.

Answer

Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.

Question 7

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

Accepted Answer

URL Filtering profile to block the Social Networking category.. A URL Filtering profile allows the administrator to block access to specific categories of websites, such as Social Networking. By applying this profile to a security policy rule that governs internet access, the firewall can identify and block HTTP/HTTPS traffic to social media sites based on their URL category, without needing to decrypt or inspect the content.

Answer

SSL Decryption policy to decrypt traffic to social media.

Answer

QoS policy to limit bandwidth to social media sites.

Answer

File blocking profile to block executable files from social media.

Question 8

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

Accepted Answer

Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.. Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.

Answer

Create a VPC peering connection between the two subnets and attach the firewall.

Answer

Attach the firewall to a single subnet and use it as a default gateway for both subnets.

Answer

Configure AWS security groups to route traffic through the firewall.

Question 9

An organization uses GlobalProtect for remote access. Users report that they cannot connect to the portal. The firewall's GlobalProtect portal configuration is correct, and the firewall has a valid certificate. What is the most likely cause of the issue?

Accepted Answer

The firewall's external interface does not have a security policy rule allowing HTTPS traffic to the portal IP.. The most likely cause is that the firewall's external interface lacks a security policy rule permitting HTTPS (TCP/443) traffic to the GlobalProtect portal IP. Even with correct portal configuration and a valid certificate, the firewall will drop the client's connection attempt if no rule explicitly allows inbound HTTPS traffic to the portal's IP address. This is a common oversight when deploying GlobalProtect remote access.

Answer

The authentication profile is set to RADIUS but the RADIUS server is unreachable.

Answer

The certificate is self-signed and not trusted by the client.

Answer

The GlobalProtect gateway is not configured with a matching tunnel interface.

Question 10

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

Accepted Answer

Use a dedicated management interface and restrict access to trusted IP addresses.. Option C is correct because using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.

Answer

Enable the default admin account with a strong password.

Answer

Allow HTTP access to the management interface for ease of use.

Answer

Enable SNMP with read-write community strings for monitoring.

Question 11

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Accepted Answer

Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.. Option D is correct because, by default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Answer

Configure a zone protection profile on the DMZ zone.

Answer

Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.

Answer

Create a rule allowing traffic from DMZ to Untrust with a deny action.

Question 12

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

Accepted Answer

Asymmetric routing. The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Answer

Application override configured for HTTP

Answer

DNS resolution failure

Answer

NAT policy mismatch

Question 13

A network administrator is designing a Palo Alto Networks firewall deployment for a large enterprise with multiple branch offices. The requirement is to ensure that if the primary firewall at headquarters fails, the branch offices can still access the internet via a local breakout using a redundant firewall at the branch. Which architecture best meets this requirement with minimal complexity?

Accepted Answer

Deploy active/passive HA at headquarters and active/passive HA at each branch with local internet breakout. Option B is correct because deploying active/passive HA at each branch with local internet breakout ensures that if the primary firewall at headquarters fails, branch offices can still access the internet directly through their redundant firewall without relying on the hub. This design minimizes complexity by using simple HA pairs and local breakout policies, avoiding the need for complex routing or full mesh VPNs.

Answer

Use a hub-and-spoke VPN topology with headquarters as the hub

Answer

Use a full mesh VPN topology between all firewalls

Answer

Deploy active/active HA at headquarters and use IPsec VPN tunnels to each branch

Question 14

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Accepted Answer

KVM. KVM (Kernel-based Virtual Machine) is a supported hypervisor for Palo Alto Networks firewalls, allowing deployment as a virtual machine (VM) on Linux-based virtualization platforms. Palo Alto Networks provides specific VM images (e.g., KVM-compatible QCOW2 format) for KVM environments, making it a valid method for virtualized deployments.

Answer

Microsoft Hyper-V

Answer

Docker

Answer

Oracle VirtualBox

Question 15

Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?

Accepted Answer

The traffic is not matching the application 'web-browsing'. The session shows application 'incomplete' because the firewall has not yet identified the application due to insufficient data or because the traffic does not match the expected application signature. In this case, the traffic is likely not matching the 'web-browsing' application, which is the application defined in the security rule 'Allow-Web'. The firewall requires the first few packets to complete application identification; if the traffic is not recognized as 'web-browsing' (e.g., due to non-standard HTTP headers or encrypted payloads), the session remains 'incomplete' and may be dropped or not allowed by the rule.

Answer

The NAT rule is missing

Answer

The destination IP is not in the destination zone

Answer

The security rule 'Allow-Web' is configured after 'Block-All'

Question 16

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Question 17

Match each Palo Alto Networks service to its typical use.

Question 18

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

Accepted Answer

PA-220. The PA-220 is the most appropriate platform for a branch office with 50 users because it is a low-end, entry-level next-generation firewall designed for small to medium-sized businesses and remote/branch offices. It supports up to 100 Mbps of threat prevention throughput and includes all core NGFW features (App-ID, User-ID, SSL decryption) at a cost-effective price point, making it ideal for this user count.

Answer

PA-3250

Answer

VM-Series

Answer

PA-5280

Question 19

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

Accepted Answer

Configure the firewall to send logs to a separate log collector. Option B is correct because offloading logs to a separate log collector reduces the firewall's dataplane CPU overhead associated with local log processing and storage. The firewall can then focus on core packet inspection and forwarding tasks, maintaining security posture while alleviating CPU pressure.

Answer

Disable logging for all security rules

Answer

Upgrade to a higher-end firewall model

Answer

Reduce the number of security policies

Question 20

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Accepted Answer

Deploy Panorama and manage all VM-Series firewalls from a single console. Option D is correct because Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Answer

Configure each VM-Series firewall independently

Answer

Rely on cloud-native security groups instead of VM-Series

Answer

Use a single security policy applied to all firewalls via an API script