PCNSA Palo Alto Networks Platforms and Architecture Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Question 2

Match each Palo Alto Networks service to its typical use.

Question 3

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

Accepted Answer

PA-220. The PA-220 is the most appropriate platform for a branch office with 50 users because it is a low-end, entry-level next-generation firewall designed for small to medium-sized businesses and remote/branch offices. It supports up to 100 Mbps of threat prevention throughput and includes all core NGFW features (App-ID, User-ID, SSL decryption) at a cost-effective price point, making it ideal for this user count.

Answer

PA-3250

Answer

VM-Series

Answer

PA-5280

Question 4

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

Accepted Answer

Configure the firewall to send logs to a separate log collector. Option B is correct because offloading logs to a separate log collector reduces the firewall's dataplane CPU overhead associated with local log processing and storage. The firewall can then focus on core packet inspection and forwarding tasks, maintaining security posture while alleviating CPU pressure.

Answer

Disable logging for all security rules

Answer

Upgrade to a higher-end firewall model

Answer

Reduce the number of security policies

Question 5

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Accepted Answer

Deploy Panorama and manage all VM-Series firewalls from a single console. Option D is correct because Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Answer

Configure each VM-Series firewall independently

Answer

Rely on cloud-native security groups instead of VM-Series

Answer

Use a single security policy applied to all firewalls via an API script

Question 6

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

Accepted Answer

NAT rules are evaluated from top to bottom, and the first match is applied. Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Answer

NAT rules are evaluated after security rules

Answer

NAT rules use longest prefix match on the destination address

Answer

NAT rules cannot combine source and destination NAT in a single rule

Question 7

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

Accepted Answer

Create rules with the most specific conditions first. Placing more specific rules above general rules ensures that specific traffic is matched first, preventing unintended matches. Option A is wrong because disabling logging on all rules reduces visibility. Option C is wrong because using any/any rules is discouraged. Option D is wrong because security rules should ideally be grouped by zone, not mixed.

Answer

Use 'any' for source and destination zones to save time

Answer

Mix inbound and outbound rules in the same rulebase section

Answer

Place general rules above specific rules

Question 8

Two Palo Alto Networks firewalls are configured in an active/passive high-availability pair. During a failover event, the passive firewall becomes active but the session table is empty. What is the most likely cause?

Accepted Answer

Session synchronization is not configured. In an active/passive high-availability pair, session synchronization must be explicitly configured to replicate session state from the active firewall to the passive firewall. Without this configuration, the passive firewall has no session table when it becomes active, causing all existing connections to be dropped. This is the most direct cause of an empty session table after failover.

Answer

The preemptive mode is disabled

Answer

Heartbeat failure caused the failover to be incomplete

Answer

The sessions timed out during the failover

Question 9

An administrator needs to decrypt HTTPS traffic from external users to the company's web servers. Which decryption policy should the administrator configure?

Accepted Answer

SSL Inbound Inspection. D is correct because SSL Inbound Inspection is specifically designed to decrypt inbound HTTPS traffic destined for company-owned web servers. The firewall acts as a destination proxy, terminating the client's TLS connection and re-encrypting traffic to the server, allowing inspection of the decrypted payload for threats.

Answer

Configure a security policy to block HTTPS

Answer

SSL Forward Proxy

Answer

No decryption is needed because the firewall can inspect HTTPS without decryption

Question 10

Which Palo Alto Networks subscription service provides real-time threat intelligence about unknown files and links?

Accepted Answer

WildFire. WildFire is the correct answer because it is Palo Alto Networks' cloud-based threat analysis service specifically designed to detect and block unknown malware, zero-day exploits, and advanced persistent threats. It analyzes files and links in a sandboxed environment, correlating behavioral indicators with real-time threat intelligence to generate signatures that protect the entire network.

Answer

URL Filtering

Answer

DNS Security

Answer

Threat Prevention

Question 11

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Accepted Answer

The traffic is being dropped due to a security policy rule that denies the traffic. Option C is correct because if a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer

The traffic is intra-zone, not inter-zone

Answer

The firewall is using hardware offload for fast-path processing

Answer

The packet is part of an existing session that has not timed out

Question 12

Refer to the exhibit. The firewall is currently running PAN-OS 9.1.4. The administrator wants to upgrade to the latest available version shown. What should the administrator do first?

Accepted Answer

Download the PAN-OS 9.1.7 package from the support site. The firewall is running PAN-OS 9.1.4, and the latest available version shown is 9.1.7. Before any upgrade can be performed, the administrator must first download the PAN-OS 9.1.7 image from the Palo Alto Networks support site. This is a prerequisite step because the upgrade process requires the image file to be present on the firewall or accessible via a valid download path; the firewall cannot install a version it has not yet obtained.

Answer

Reset the firewall to factory defaults to ensure a clean upgrade

Answer

Reboot the firewall to apply pending updates

Answer

Directly install the PAN-OS 9.1.7 package

Question 13

Refer to the exhibit. The firewall cannot reach the Internet. Based on the routing table, what is the most likely cause?

Accepted Answer

The default route is not active because the interface ethernet1/1 is down. The routing table shows a default route (0.0.0.0/0) configured with a next hop of 10.1.1.1 via interface ethernet1/1, but the route is not active (no 'C' flag for candidate). In Palo Alto Networks firewalls, a static route is only installed into the forwarding table if the specified egress interface is administratively up and operationally active. Since ethernet1/1 is down, the route cannot be used, and the firewall has no path to the Internet.

Answer

The next hop 10.1.1.1 is not reachable

Answer

There is no default route configured

Answer

The route table is empty because the virtual-router is misconfigured

Question 14

Refer to the exhibit. Which profile group is applied to this security rule?

Accepted Answer

strict-profile-group. Option B is correct because the exhibit shows the security rule's 'Profile Group' field set to 'strict-profile-group', which applies a predefined set of security profiles (antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking) to the rule. This is visible in the rule configuration where the profile group is explicitly selected, not set to 'none' or a custom group.

Answer

No profile group is applied

Answer

log-profile-group

Answer

default-profile-group

Question 15

Which TWO of the following are valid methods to centrally manage multiple Palo Alto Networks firewalls?

Accepted Answer

Deploy a dedicated Log Collector to aggregate logs from multiple firewalls. Option A is correct because a dedicated Log Collector aggregates logs from multiple Palo Alto Networks firewalls, enabling centralized log storage and analysis without managing firewall configurations. This is a valid method for centralizing log data, though it does not manage firewall policies or settings directly. Option D is correct because Panorama is the primary centralized management server for Palo Alto Networks firewalls, allowing administrators to push policies, templates, and configurations to multiple firewalls from a single interface.

Answer

Use the web interface of one firewall to manage others

Answer

Manually configure each firewall and synchronize via TFTP

Answer

Use CLI scripting to push configurations