PCNSA Core Concepts — 10 Questions

Question 1

A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?

Accepted Answer

The Security policy rule has a DoS Protection profile applied that is dropping traffic.. When a Security policy rule permits traffic but it is still blocked, the most likely cause is that a DoS Protection profile is applied to the rule. DoS Protection profiles can drop traffic based on session rate thresholds or other attack signatures, even when the base Security rule allows the session. This is a common misconfiguration because the profile operates as an additional enforcement layer above the permit action.

Answer

A Zone Protection profile is dropping the traffic.

Answer

A decryption policy is blocking the traffic.

Answer

The Security policy rule has a source zone mismatch.

Question 2

An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?

Accepted Answer

Create a Security policy rule that allows traffic between the virtual routers.. Option D is correct because traffic between virtual routers must be explicitly permitted by a Security policy rule. Even though virtual routers provide separate routing tables, the firewall still enforces policy enforcement points; without a Security rule allowing the traffic, it will be denied by default. This ensures that inter-virtual-router traffic is inspected and controlled by the firewall's security engine.

Answer

Install a virtual wire between the virtual routers.

Answer

Add static routes for the remote subnets in each virtual router.

Answer

Configure a default route in each virtual router pointing to the other.

Question 3

A security administrator wants to block users from accessing social media websites during business hours. The firewall is connected to the internet and has a Security policy that allows general web browsing. What is the most efficient way to block social media?

Accepted Answer

Create a new Security policy rule with a URL Filtering profile that blocks the social-media category.. Option B is correct because URL Filtering profiles are specifically designed to block entire categories of websites (like social media) based on URL categorization, which is the most efficient method for blocking access to social media sites. This approach leverages Palo Alto Networks' URL Filtering database, which categorizes millions of URLs, allowing the administrator to block the entire 'social-media' category with a single policy rule without needing to identify individual applications or destinations.

Answer

Create a new Security policy rule with an Application ID that blocks social-media applications.

Answer

Add a Custom Signature to the existing rule to block social media traffic.

Answer

Modify the existing web browsing rule to deny social media destinations.

Question 4

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

Accepted Answer

An application on the internal network is not completing TCP handshakes.. A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.

Answer

A DDoS attack is flooding the firewall with SYN packets.

Answer

The firewall's TCP timeout setting is too short.

Answer

The firewall's hardware is failing.

Question 5

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. Option A is correct because a Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 6

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. Option B is correct because the internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.

Question 7

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.. In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry. The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Answer

OSPF is flapping and causing route instability.

Answer

A DDoS attack is overwhelming the management plane.

Answer

The firewall's licenses have expired, causing feature degradation.

Question 8

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Accepted Answer

The route via 10.0.0.2 on ethernet1/3. The firewall selects the route with the lowest administrative distance (AD) for forwarding traffic to 10.0.1.1. In this scenario, the route via 10.0.0.2 on ethernet1/3 has an AD of 10 (typically OSPF), which is lower than the AD of 20 (static route) and 110 (RIP). Therefore, it is the preferred route.

Answer

The route via 10.0.0.3 on ethernet1/4

Answer

The route via 10.0.0.4 on ethernet1/5

Answer

All three routes are used in ECMP

Question 9

Which THREE actions can a Security policy rule perform on traffic?

Accepted Answer

Drop. A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Answer

Reset

Answer

Block

Question 10

A security administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The Phase 1 proposal includes AES-256, SHA-256, and DH Group 14 with a lifetime of 28800 seconds. The Phase 2 proposal includes AES-256, SHA-256, and PFS with DH Group 14. The tunnel is established and traffic is flowing, but intermittently the tunnel drops and re-establishes. The logs show the following error: 'Phase 2 negotiation failed because no suitable proposal found.' Both firewalls have identical IKE gateway and IPsec crypto profile configurations. Which option is the most likely cause of this issue?

Accepted Answer

The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.. The error 'Phase 2 negotiation failed because no suitable proposal found' indicates a mismatch in the IPsec SA parameters. Even though both firewalls have identical IKE gateway and IPsec crypto profile configurations, if one firewall has an IPsec SA lifetime configured (e.g., 3600 seconds) and the other does not (defaulting to a different value, such as 10800 seconds), the lifetimes will not match, causing intermittent rekey failures. This is the most likely cause because the tunnel initially establishes but drops when rekeying occurs due to the lifetime mismatch.

Answer

The DH group used in Phase 2 is not supported by the firewall model.

Answer

The Phase 2 proposal uses a different DH group than Phase 1.

Answer

The Phase 1 lifetime is shorter than the Phase 2 lifetime.