PCNSA Core Concepts Practice Test 2 — 15 Questions

Question 1

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Accepted Answer

Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings. Option C is correct because FTP uses separate control (TCP 21) and data channels, and the firewall must inspect both to enforce security policies. Enabling 'FTP Alg' in the Application Override settings allows the Palo Alto Networks firewall to dynamically open pinholes for the data channel and perform deep inspection of FTP commands, ensuring proper stateful handling of active and passive modes.

Answer

Create a rule with service 'tcp-21' and application 'any'

Answer

Create a rule with application 'ftp' and disable Application Override

Answer

Create a rule with application 'ftp' and service 'application-default'

Question 2

An administrator configures a security policy rule to block traffic from IP address 10.1.1.1 to 10.2.2.2 on any service. However, traffic from 10.1.1.1 to 10.2.2.2 is still passing through the firewall. After checking all rules, what is the most likely cause?

Accepted Answer

The rule is configured in the PBF rulebase instead of the Security rulebase. Policy-Based Forwarding (PBF) rules are evaluated before security rules and can override security policy decisions. If the traffic matches a PBF rule, it may be forwarded without being subject to the security rulebase, even if a security rule explicitly blocks it. This is the most likely cause because the administrator configured the block in the wrong rulebase.

Answer

The rule is placed after an allow rule that matches the traffic

Answer

The source and destination zones are set to 'any'

Answer

There is an implicit allow rule that overrides the block rule

Question 3

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Accepted Answer

Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block. Option C is correct because placing an override rule for the specific URL above the category block rule allows fine-grained control. Option A is wrong because disabling URL Filtering altogether removes protection. Option B is wrong because changing action to 'allow' on the existing rule would allow all hacking sites. Option D is wrong because using a different service does not bypass URL filtering.

Answer

Change the service to TCP/443 and allow all applications

Answer

Remove the URL Filtering profile from the security rule

Answer

Change the URL Filtering action for 'hacking' category to 'allow'

Question 4

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Accepted Answer

Use a dedicated physical interface or VLAN for HA heartbeat communication. Option A is correct because using a dedicated heartbeat interface on a separate subnet ensures reliable communication and avoids routing issues. Option B is wrong because active/active is less common and more complex; active/passive is recommended for most deployments. Option C is wrong because preemptive mode can cause unnecessary failovers if not carefully configured. Option D is wrong because setting both firewalls to 'auto' election is standard, but the best practice is to use a dedicated link.

Answer

Set both firewall's HA election delay to '0' for fast failover

Answer

Enable preemptive mode to ensure the primary firewall always resumes control

Answer

Configure both firewalls in active/active mode to maximize throughput

Question 5

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

Accepted Answer

Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow. Option A is correct because traffic from trust to DMZ with application 'web-browsing' permits HTTP/HTTPS access. Option B is wrong because service 'any' is too broad. Option C is wrong because source zone should be 'trust', not 'DMZ'. Option D is wrong because destination zone should be 'DMZ', not 'trust'.

Answer

Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow

Answer

Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow

Answer

Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow

Question 6

During a security audit, it is discovered that some traffic from the 'guest' zone to the 'untrust' zone is not being inspected by Threat Prevention profiles. The security rule that matches this traffic has a Threat Prevention profile applied. What is a likely reason for the lack of inspection?

Accepted Answer

An earlier rule with action 'allow' is matching the traffic before reaching this rule. Option D is correct because if the rule's action is 'allow', the threat profile is applied; but if the traffic matches an earlier rule with action 'allow' and no threat profile, the later rule's profile is not applied. Option A is wrong because if the profile is applied, it should be active. Option B is wrong because threat profiles apply to all sessions that match the rule, regardless of service. Option C is wrong because the action 'deny' would block traffic entirely, not allow without inspection.

Answer

The Threat Prevention profile is disabled on the rule

Answer

The traffic uses a service that is not supported by the Threat Prevention profile

Answer

The security rule action is set to 'deny'

Question 7

Which TWO of the following are key benefits of using an Application-Based Security Policy compared to a Port-Based Security Policy? (Choose TWO.)

Accepted Answer

Ability to control applications regardless of port or protocol evasion. Options B and E are correct: Application-based policies allow control regardless of port, and they enable visibility into application usage. Option A is wrong because simpler configuration is not necessarily a benefit; port-based can be simpler. Option C is wrong because application-based policies do not inherently improve throughput. Option D is wrong because dynamic port applications are better handled by App-ID, not static port rules.

Answer

Simpler configuration for traditional protocols like HTTP and FTP

Answer

Easier to allow applications that use dynamic ports

Answer

Increased throughput because firewall does not need to inspect ports

Question 8

Which THREE of the following actions are valid actions for a security policy rule on a Palo Alto Networks firewall? (Choose THREE.)

Accepted Answer

Deny. Options A, C, and E are correct: Allow, Deny, and Drop are valid actions. Option B is wrong, 'Reset' is not a valid action; instead, there is 'Reset-Client' and 'Reset-Server'. Option D is wrong, 'Log' is not an action; logging is configured separately within a rule.

Answer

Log

Answer

Reset

Question 9

Which TWO of the following are required to configure a site-to-site VPN using IKEv2 on Palo Alto Networks firewalls? (Choose TWO.)

Accepted Answer

A pre-shared key or certificate for authentication. Options A and D are correct: A pre-shared key (or certificate) and a tunnel interface are required. Option B is wrong because an IKE gateway configuration is also needed but the question asks for required components; tunnel interface and pre-shared key are both required. Option C is wrong because a virtual router is not specifically required; the default virtual router can be used. Option E is wrong because a loopback interface is not needed.

Answer

An IKE gateway configuration

Answer

A loopback interface for the VPN gateway

Answer

A dedicated virtual router for the VPN

Question 10

Refer to the exhibit. Based on the session information, which type of NAT is being performed?

Accepted Answer

Source NAT. Option A is correct because the source IP is translated from a private IP to a public IP, indicating source NAT (SNAT). Option B is wrong because destination NAT would show a change in destination IP. Option C is wrong because no port information is shown to indicate PAT specifically; the term 'source NAT' encompasses address translation. Option D is wrong because no IPs are being hidden in the sense of typical network terminology.

Answer

No NAT is being performed

Answer

Port Address Translation (PAT)

Answer

Destination NAT

Question 11

Refer to the exhibit. An administrator observes that HTTP requests from the 10.0.0.0/24 network to the 172.16.1.0/24 network are being logged but the logs show that the action taken is 'deny'. What is the most likely cause?

Accepted Answer

A different rule with higher priority is matching the traffic and denying it. Option B is correct because the rule has 'log-start' enabled, which generates a log entry before the actual action is determined. If another rule with higher priority denies the traffic, the log will show the result of the first matching rule. Option A is wrong because the rule itself has action allow, so if it matches, it would allow. Option C is wrong because even if the rule is disabled, it would not produce a log. Option D is wrong because the rule explicitly allows web-browsing.

Answer

The rule 'Allow-Web' is disabled

Answer

The application 'web-browsing' is not correctly identified

Answer

The rule 'Allow-Web' is configured with action 'deny'

Question 12

Refer to the exhibit. An administrator notices that SSH traffic from the trust zone to the untrust zone is being blocked. The administrator expected it to be allowed by rule 2. What is the most likely reason?

Accepted Answer

Rule 1 matches the traffic and is evaluated before rule 2. Option A is correct because rule 1 has source and destination zones 'any' and matches all SSH traffic, and it is placed before rule 2. Option B is wrong because the action of rule 1 is deny, not allow. Option C is wrong because the rule explicitly denies SSH. Option D is wrong because the rule 2 does allow SSH but never gets evaluated due to rule 1.

Answer

Rule 2's application is set to 'ssh' but the service is not 'application-default'

Answer

Rule 1 is configured with action 'allow'

Answer

Rule 2's source zone is incorrectly set to 'dmz'

Question 13

A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?

Accepted Answer

The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.. Option A is correct because the zone protection profile's Flood Protection can erroneously block legitimate traffic if threshold values are too low. Option B is wrong because logging profiles do not affect traffic flow. Option C is wrong because schedule settings would either allow or deny traffic at certain times, but the policy is set to allow always. Option D is wrong because the zone protection profile with Flood Protection is the most likely cause, not the security policy itself.

Answer

The security policy is set to deny due to an implicit deny rule.

Answer

The security policy has a logging profile attached that is blocking traffic.

Answer

The security policy has a schedule configured that is currently outside the allowed time.

Question 14

A company uses destination NAT to translate a public IP to an internal server. They need to ensure that traffic sourced from the internal network to the public IP is also translated correctly. What is the best practice to achieve this?

Accepted Answer

Implement a source NAT rule for internal traffic destined to the public IP, translating it to the internal server IP.. Option B is correct because implementing NAT policy rules in both directions (source NAT for internal traffic to the public IP and destination NAT for external traffic) ensures symmetric traffic flow. Option A is wrong because policy-based forwarding is unrelated. Option C is wrong because an additional destination NAT rule for internal traffic would create asymmetric routing. Option D is wrong because disabling NAT on the loopback interface does not solve the issue.

Answer

Disable NAT on the internal zone's loopback interface.

Answer

Configure a policy-based forwarding rule to redirect internal traffic.

Answer

Add an additional destination NAT rule for internal traffic.

Question 15

An organization is planning to deploy SSL decryption for outbound traffic. They want to inspect all traffic from internal users to the internet, but they need to exclude traffic to financial sites for compliance reasons. Which approach should be taken?

Accepted Answer

Create a decryption policy with a custom URL category that includes financial sites and set the action to 'no-decrypt', then place it above the general decrypt rule.. Option C is correct because creating a decryption policy with a custom URL category for financial sites set to 'no-decrypt' allows exclusion while still decrypting other traffic. Option A is wrong because disabling decryption entirely defeats the purpose. Option B is wrong because an application filter might not cover all financial traffic and could miss some. Option D is wrong because configuring decryption exception on the firewall system settings is not how decryption exclusions are handled; it's done via policy.

Answer

Disable SSL decryption for all traffic.

Answer

Configure a decryption exception on the firewall system settings.

Answer

Use an application filter to exclude financial apps from decryption.