PCNSA Core Concepts Practice Test 3 — 15 Questions

Question 1

A security engineer is creating a security policy that should allow access to Salesforce.com for the sales team. The engineer configures the policy to allow application 'ssl' with no restriction on URL category. How can the engineer ensure that only traffic to Salesforce.com is allowed and not all SSL traffic?

Accepted Answer

Use App-ID to identify the 'salesforce' application and add a URL category for Salesforce domains.. Option D is correct because using App-ID to identify 'salesforce' application and configuring a URL category for Salesforce domains ensures precise control. Option A is wrong because allowing all SSL traffic is too broad. Option B is wrong because the destination address does not cover all Salesforce IPs, and it's less precise. Option C is wrong because SSL decryption alone does not restrict access to specific sites without policy application.

Answer

Use a destination address object for the known Salesforce IP addresses.

Answer

Change the application to 'web-browsing' and restrict by URL category.

Answer

Enable SSL decryption to inspect the traffic.

Question 2

A company uses Active Directory for user authentication. They want to enforce security policies based on user identity. What is the required first step to enable User-ID on the Palo Alto Networks firewall?

Accepted Answer

Configure a server monitoring profile to connect to the domain controller.. Option A is correct. The first step is to configure the firewall to communicate with the domain controller to gather user-to-IP mappings. Option B is wrong because LDAP is used for retrieval of user attributes, not for mapping. Option C is wrong because GlobalProtect is a client-based solution for remote users, not for internal AD integration. Option D is wrong because Captive Portal is another method but not the first step for AD integration.

Answer

Add an LDAP server profile to authenticate users.

Answer

Deploy GlobalProtect agents on all endpoints.

Answer

Enable captive portal on the internal zone.

Question 3

An administrator wants to protect the firewall management interface from unauthorized access. The management interface is on a separate management network. Which of the following is the best security practice to restrict access?

Accepted Answer

Configure 'Permitted IP Addresses' under Device > Setup > Management.. Option B is correct. Creating an ACL on the management interface using the 'permitted IP addresses' setting is the standard method to restrict management access. Option A is wrong because interface management profiles are for dataplane interfaces, not the management interface itself. Option C is wrong because security policies do not apply to management traffic. Option D is wrong because the 'trusted management stations' option is not a configuration on the firewall.

Answer

Create a security policy rule that blocks traffic to the management interface.

Answer

Apply an interface management profile to the management interface.

Answer

Enable 'Trusted Management Stations' under firewall settings.

Question 4

A firewall administrator needs to generate a report that shows the top applications consuming bandwidth over the last week. Which Palo Alto Networks tool should be used?

Accepted Answer

Application Command Center (ACC).. Option C is correct. The ACC (Application Command Center) provides a visual overview of application usage and can filter by time. Option A is wrong because the log viewer shows raw logs, not aggregated reports. Option B is wrong because predefined reports are scheduled, not interactive. Option D is wrong because packet capture is for troubleshooting individual flows.

Answer

Predefined reports.

Answer

Traffic log viewer.

Answer

Packet capture (PCAP).

Question 5

Two Palo Alto Networks firewalls are deployed in an active/passive high availability pair. The passive firewall does not synchronize configuration changes. What is the most likely cause?

Accepted Answer

Configuration synchronization is not enabled.. Option D is correct. If session synchronization is enabled but configuration synchronization is not, the passive unit will not receive config changes. Option A is wrong because HA requires both to be the same model and PAN-OS version. Option B is wrong because link monitoring does not affect config sync. Option C is wrong because the passive unit must be configured as part of the HA pair.

Answer

Link monitoring is disabled.

Answer

The passive firewall is not configured as a peer.

Answer

The firewalls are different models.

Question 6

Users report that some internal services are not accessible when connected via VPN, but they work when on the local network. The firewall has a policy allowing all traffic from the VPN zone to the internal zone. What should the administrator check first?

Accepted Answer

Check if there are NAT rules that affect the VPN zone traffic, such as missing reverse NAT.. Option A is correct. NAT rules can cause issues if return traffic is not handled properly, especially if the destination NAT is only applied to a specific zone. Option B is wrong because the policy is already allowing traffic. Option C is wrong because zone protection profiles are not likely to cause this selective issue. Option D is wrong because decryption is usually for outbound traffic, not internal service access.

Answer

Check if SSL decryption is breaking the traffic.

Answer

Check if the zone protection profile is dropping traffic.

Answer

Check if the security policy rule order is correct.

Question 7

Which TWO are valid methods for authenticating administrative users on Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Local authentication using local user database. Options A and C are correct. The firewall supports local authentication and RADIUS. Option B is wrong because TACACS is not supported (TACACS+ is, but not TACACS). Option D is wrong because LDAP is used for directory services, not authentication directly (though it can be used for captive portal, but not admin auth). Option E is wrong because SAML is supported for SSO but not typically as a direct admin authentication method.

Answer

TACACS

Answer

SAML

Answer

LDAP

Question 8

Which THREE actions can improve firewall performance by reducing CPU load? (Choose three.)

Accepted Answer

Enable hardware acceleration for packet processing. Options B, D, E are correct. Disabling unused features frees up resources. Enabling hardware acceleration offloads processing. Reducing logging volume lowers I/O. Option A is wrong because enabling SSL decryption increases CPU load. Option C is wrong because using reactive policies (e.g., dynamic updates) adds overhead.

Answer

Use reactive policy updates via API

Answer

Enable SSL decryption for all traffic

Question 9

Which THREE are default security profile groups in PAN-OS? (Choose three.)

Accepted Answer

Strict. Options A, C, D are correct. These are predefined profile groups. Option B is wrong because 'Server' is not a default group; there is 'Strict' but not 'Server'. Option E is wrong because 'Custom' is not a default group; custom groups are user-created.

Answer

Server

Answer

Custom

Question 10

Refer to the exhibit. A user in the trust zone attempts to access https://www.example.com. The traffic matches rule 2 first. What is the expected behavior?

Accepted Answer

The traffic is denied because of rule 2.. Option B is correct. HTTPS traffic is identified as application ssl, which matches rule 2 (deny). Since rule 2 has no schedule, it matches immediately, and the traffic is denied. Rule 3 (allow for web-browsing) is not evaluated because rule 2 matched first. Option A is wrong because rule 2 matches. Option C is wrong because there is a deny rule. Option D is wrong because the session is not allowed; it is denied.

Answer

The traffic is allowed due to the implicit allow at the end.

Answer

The traffic is allowed because rule 3 allows web-browsing.

Answer

The traffic is allowed because no explicit deny is configured.

Question 11

Refer to the exhibit. A packet arrives with source IP 192.168.1.10, destination IP 203.0.113.10, destination port 80, from zone trust. After this NAT rule is applied, what will be the destination IP and port of the packet?

Accepted Answer

Destination IP 10.0.0.5, Destination port 80. Option C is correct. The destination NAT rule translates the destination IP from 203.0.113.10 to 10.0.0.5, and the destination port remains 80 (as specified). Option A is wrong because source IP is not changed by this rule (no source NAT configured). Option B is wrong because the port changes to 8080 is not configured. Option D is wrong because the source port is not modified.

Answer

Destination IP 10.0.0.5, Destination port 80, Source IP changed to firewall IP

Answer

Destination IP 203.0.113.10, Destination port 8080

Answer

Destination IP 203.0.113.10, Destination port 80, Source port changed to 5000

Question 12

A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?

Accepted Answer

Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.. Option D is correct. The application mismatch indicates the firewall is not identifying the traffic as the expected application. Likely the application signature needs to be updated or the policy should use a broader application. Option A is wrong because decryption would not cause a mismatch; it would help identify applications. Option B is wrong because the policy is already allowing ssl; changing to web-browsing would be too broad and could bypass intent. Option C is wrong because the destination is correctly set; the issue is application identification.

Answer

Enable SSL decryption to inspect the traffic and improve application identification.

Answer

Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.

Answer

Check that the destination address object for the CRM server is correct and includes the CDN IPs.

Question 13

A network administrator is configuring a new security policy to allow specific inbound traffic to a web server. The policy must be as specific as possible to minimize risk. Which configuration approach is correct?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, and application web-browsing.. Option C is correct. Using App-ID (application web-browsing) is more specific than port-based service, as it identifies the application regardless of port. Option A uses port-based service http, which could allow other applications on port 80. Option B uses source any, which is too broad. Option D uses application-default, which is not a valid service object for policy configuration.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, and service application-default.

Answer

Create a security policy with source any, destination DMZ, and service http.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, and service http.

Question 14

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Accepted Answer

Verify that the policy has the correct source zone.. Options A and C are correct. Checking the traffic log shows whether the session matched a security policy. Verifying the source zone ensures the policy is applied to the correct zone. Option B is not directly about policy matching; URL filtering is a separate feature. Option D is about threats, not allowed traffic. Option E is unrelated to policy matching.

Answer

Review the system resources to check CPU usage.

Answer

Look at the Threat log for any malware detections.

Answer

Examine the URL filtering profile applied to the policy.

Question 15

A company has a Palo Alto Networks firewall in a data center, connecting internal users (zone: Internal) to the internet (zone: Untrust). Recently, users report that they cannot access the corporate HR portal hosted on a server in the DMZ (zone: DMZ, IP 10.10.10.10) using HTTPS. The firewall has a security policy that allows traffic from Internal to DMZ with application web-browsing and service https-ssl. The policy is in place and committed. The administrator verifies that the web server is running and reachable from within the DMZ. From the firewall, a ping from the management interface to the server is successful. However, when a user tries to access https://10.10.10.10, the connection times out. Traffic logs show no sessions logged for that traffic. What is the most likely cause?

Accepted Answer

The policy is missing the source zone; the traffic is being blocked by an implicit deny rule before any policy match.. Option A is correct. Since there are no sessions in the traffic log, the traffic is being dropped by the implicit deny rule, meaning no security policy matched. The most likely reason is that the policy's source zone is not set to Internal; if it were set to another zone (e.g., Untrust), the traffic from Internal would not match. Option B would likely produce sessions if matched by another policy. Option C would show sessions but no return traffic. Option D is incorrect because SSL decryption is not required for HTTPS to be allowed through the firewall.

Answer

There is a routing issue preventing return traffic from reaching the firewall.

Answer

The policy has the wrong destination zone; the server is actually in the Internal zone.

Answer

The firewall is not configured to perform SSL decryption; thus HTTPS traffic is being blocked.