PCNSA Core Concepts — Timed 30 Questions

Question 1

A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?

Accepted Answer

The Security policy rule has a DoS Protection profile applied that is dropping traffic.. When a Security policy rule permits traffic but it is still blocked, the most likely cause is that a DoS Protection profile is applied to the rule. DoS Protection profiles can drop traffic based on session rate thresholds or other attack signatures, even when the base Security rule allows the session. This is a common misconfiguration because the profile operates as an additional enforcement layer above the permit action.

Answer

A Zone Protection profile is dropping the traffic.

Answer

A decryption policy is blocking the traffic.

Answer

The Security policy rule has a source zone mismatch.

Question 2

An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?

Accepted Answer

Create a Security policy rule that allows traffic between the virtual routers.. Option D is correct because traffic between virtual routers must be explicitly permitted by a Security policy rule. Even though virtual routers provide separate routing tables, the firewall still enforces policy enforcement points; without a Security rule allowing the traffic, it will be denied by default. This ensures that inter-virtual-router traffic is inspected and controlled by the firewall's security engine.

Answer

Install a virtual wire between the virtual routers.

Answer

Add static routes for the remote subnets in each virtual router.

Answer

Configure a default route in each virtual router pointing to the other.

Question 3

A security administrator wants to block users from accessing social media websites during business hours. The firewall is connected to the internet and has a Security policy that allows general web browsing. What is the most efficient way to block social media?

Accepted Answer

Create a new Security policy rule with a URL Filtering profile that blocks the social-media category.. Option B is correct because URL Filtering profiles are specifically designed to block entire categories of websites (like social media) based on URL categorization, which is the most efficient method for blocking access to social media sites. This approach leverages Palo Alto Networks' URL Filtering database, which categorizes millions of URLs, allowing the administrator to block the entire 'social-media' category with a single policy rule without needing to identify individual applications or destinations.

Answer

Create a new Security policy rule with an Application ID that blocks social-media applications.

Answer

Add a Custom Signature to the existing rule to block social media traffic.

Answer

Modify the existing web browsing rule to deny social media destinations.

Question 4

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

Accepted Answer

An application on the internal network is not completing TCP handshakes.. A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.

Answer

A DDoS attack is flooding the firewall with SYN packets.

Answer

The firewall's TCP timeout setting is too short.

Answer

The firewall's hardware is failing.

Question 5

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Accepted Answer

Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.. Option A is correct because a Security policy rule explicitly allowing traffic to destination ports 80 and 443 ensures only HTTP and HTTPS traffic reaches the web server, aligning with the requirement to restrict allowed traffic. This rule uses port-based matching to permit only the specified services, which is a foundational step in controlling access.

Answer

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Answer

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Answer

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Question 6

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Accepted Answer

Assign an IP address to the internal interface and set it as a Layer 3 interface.. Option B is correct because the internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Answer

Configure a DNS proxy to resolve domain names.

Answer

Enable User-ID to identify users on the network.

Question 7

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.. In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry. The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Answer

OSPF is flapping and causing route instability.

Answer

A DDoS attack is overwhelming the management plane.

Answer

The firewall's licenses have expired, causing feature degradation.

Question 8

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Accepted Answer

The route via 10.0.0.2 on ethernet1/3. The firewall selects the route with the lowest administrative distance (AD) for forwarding traffic to 10.0.1.1. In this scenario, the route via 10.0.0.2 on ethernet1/3 has an AD of 10 (typically OSPF), which is lower than the AD of 20 (static route) and 110 (RIP). Therefore, it is the preferred route.

Answer

The route via 10.0.0.3 on ethernet1/4

Answer

The route via 10.0.0.4 on ethernet1/5

Answer

All three routes are used in ECMP

Question 9

Which THREE actions can a Security policy rule perform on traffic?

Accepted Answer

Drop. A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Answer

Reset

Answer

Block

Question 10

A security administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The Phase 1 proposal includes AES-256, SHA-256, and DH Group 14 with a lifetime of 28800 seconds. The Phase 2 proposal includes AES-256, SHA-256, and PFS with DH Group 14. The tunnel is established and traffic is flowing, but intermittently the tunnel drops and re-establishes. The logs show the following error: 'Phase 2 negotiation failed because no suitable proposal found.' Both firewalls have identical IKE gateway and IPsec crypto profile configurations. Which option is the most likely cause of this issue?

Accepted Answer

The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.. The error 'Phase 2 negotiation failed because no suitable proposal found' indicates a mismatch in the IPsec SA parameters. Even though both firewalls have identical IKE gateway and IPsec crypto profile configurations, if one firewall has an IPsec SA lifetime configured (e.g., 3600 seconds) and the other does not (defaulting to a different value, such as 10800 seconds), the lifetimes will not match, causing intermittent rekey failures. This is the most likely cause because the tunnel initially establishes but drops when rekeying occurs due to the lifetime mismatch.

Answer

The DH group used in Phase 2 is not supported by the firewall model.

Answer

The Phase 2 proposal uses a different DH group than Phase 1.

Answer

The Phase 1 lifetime is shorter than the Phase 2 lifetime.

Question 11

Drag and drop the steps to configure a NAT policy on a Palo Alto Networks firewall into the correct order.

Question 12

Match each log type to its description.

Question 13

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

Accepted Answer

The rule has 'Log at Session End' disabled. Option C is correct because the 'Log at Session End' setting on a security policy rule controls whether traffic matching that rule generates a Traffic log entry when the session closes. If this setting is disabled, the firewall will allow the traffic per the rule but will not record it in the Traffic logs, which matches the scenario where traffic is permitted but not logged.

Answer

Zone Protection profile is set to 'Log at Session Start'

Answer

The Log Forwarding profile is not applied

Answer

Disable Server Response Inspection on the rule

Question 14

A company wants to ensure that all internet-bound HTTP traffic is decrypted for inspection before being forwarded to the next-generation firewall for policy enforcement. Which deployment method should be used?

Accepted Answer

Explicit proxy with SSL Forward Proxy decryption. B is correct because an explicit proxy deployment requires clients to be configured to send HTTP traffic to the firewall's proxy IP, which allows the firewall to terminate the client connection, perform SSL Forward Proxy decryption using a forward trust certificate, and then re-encrypt the traffic for inspection before forwarding it to the next-generation firewall for policy enforcement. This method ensures that all internet-bound HTTP traffic is decrypted for inspection, as the firewall acts as an intermediary between the client and the destination server.

Answer

Virtual wire mode with SSL Forward Proxy

Answer

Transparent proxy with a forward trust certificate

Answer

Layer 3 mode with a policy-based forwarding rule

Question 15

An organization is experiencing high CPU utilization on the firewall dataplane, causing latency in packet processing. The administrator notices that a large number of small packets are being processed by a specific security rule that allows any service. What is the best first step to reduce CPU load without impacting legitimate traffic?

Accepted Answer

Create a QoS policy to limit bandwidth for that traffic class. Option C is correct because applying a QoS policy to limit bandwidth for the traffic class causing high CPU utilization will throttle the rate at which small packets are processed, reducing the dataplane load without dropping legitimate traffic. QoS allows the firewall to prioritize or rate-limit specific traffic classes, which directly addresses the high volume of small packets without altering security rules or session behavior.

Answer

Remove the rule and create a more specific rule with a narrower service

Answer

Apply a DoS protection profile with a session rate threshold

Answer

Increase the session timeout to avoid creating new sessions

Question 16

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Accepted Answer

Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings. Option C is correct because FTP uses separate control (TCP 21) and data channels, and the firewall must inspect both to enforce security policies. Enabling 'FTP Alg' in the Application Override settings allows the Palo Alto Networks firewall to dynamically open pinholes for the data channel and perform deep inspection of FTP commands, ensuring proper stateful handling of active and passive modes.

Answer

Create a rule with service 'tcp-21' and application 'any'

Answer

Create a rule with application 'ftp' and disable Application Override

Answer

Create a rule with application 'ftp' and service 'application-default'

Question 17

An administrator configures a security policy rule to block traffic from IP address 10.1.1.1 to 10.2.2.2 on any service. However, traffic from 10.1.1.1 to 10.2.2.2 is still passing through the firewall. After checking all rules, what is the most likely cause?

Accepted Answer

The rule is configured in the PBF rulebase instead of the Security rulebase. Policy-Based Forwarding (PBF) rules are evaluated before security rules and can override security policy decisions. If the traffic matches a PBF rule, it may be forwarded without being subject to the security rulebase, even if a security rule explicitly blocks it. This is the most likely cause because the administrator configured the block in the wrong rulebase.

Answer

The rule is placed after an allow rule that matches the traffic

Answer

The source and destination zones are set to 'any'

Answer

There is an implicit allow rule that overrides the block rule

Question 18

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Accepted Answer

Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block. Option C is correct because placing an override rule for the specific URL above the category block rule allows fine-grained control. Option A is wrong because disabling URL Filtering altogether removes protection. Option B is wrong because changing action to 'allow' on the existing rule would allow all hacking sites. Option D is wrong because using a different service does not bypass URL filtering.

Answer

Change the service to TCP/443 and allow all applications

Answer

Remove the URL Filtering profile from the security rule

Answer

Change the URL Filtering action for 'hacking' category to 'allow'

Question 19

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Accepted Answer

Use a dedicated physical interface or VLAN for HA heartbeat communication. Option A is correct because using a dedicated heartbeat interface on a separate subnet ensures reliable communication and avoids routing issues. Option B is wrong because active/active is less common and more complex; active/passive is recommended for most deployments. Option C is wrong because preemptive mode can cause unnecessary failovers if not carefully configured. Option D is wrong because setting both firewalls to 'auto' election is standard, but the best practice is to use a dedicated link.

Answer

Set both firewall's HA election delay to '0' for fast failover

Answer

Enable preemptive mode to ensure the primary firewall always resumes control

Answer

Configure both firewalls in active/active mode to maximize throughput

Question 20

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

Accepted Answer

Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow. Option A is correct because traffic from trust to DMZ with application 'web-browsing' permits HTTP/HTTPS access. Option B is wrong because service 'any' is too broad. Option C is wrong because source zone should be 'trust', not 'DMZ'. Option D is wrong because destination zone should be 'DMZ', not 'trust'.

Answer

Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow

Answer

Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow

Answer

Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow