PCNSA Securing Traffic — 25 Questions

Question 1

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

SSL Inbound Inspection. SSL Inbound Inspection and SSL Forward Proxy are the two valid methods for decrypting SSL/TLS traffic on a Palo Alto Networks firewall. SSH Proxy decrypts SSH traffic, not SSL/TLS. IPsec Decryption is not applicable to SSL/TLS, and Decryption Mirror is a monitoring tool, not a decryption method.

Answer

IPsec Decryption

Answer

SSH Proxy

Answer

Decryption Mirror

Question 2

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Accepted Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.. It uses User-ID to dynamically identify HR users, specifies the source zone corporate and the application social-media, and places the deny rule before the allow rule. This ensures that traffic from HR users to social media is blocked by the deny rule, while all other traffic matches the subsequent allow rule. Option A is wrong because the allow rule is placed first, so all traffic including HR users to social media will match the allow rule and be permitted, making the deny rule ineffective. Additionally, it does not explicitly use User-ID to identify HR users. Option B places the deny rule before the allow rule (correct order), but it is wrong because it does not specify the source zone (corporate) and may rely on a static user group rather than dynamic User-ID identification. Without the source zone, the rule could apply to traffic from other zones, potentially causing unintended blocking, and it may not correctly identify the HR users. Option C uses User-ID and correct conditions, but places the deny rule after the allow rule. Due to top-down rule evaluation, the allow rule matches first, permitting access to social media for all users, so the deny rule never applies.

Answer

Create an allow rule for all users, then a deny rule for HR with application social-media.

Answer

Create a deny rule for the HR user group with application social-media before the allow rule.

Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.

Question 3

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

Accepted Answer

Allowed by rule Allow_Web because service tcp/443 matches.. The rule 'Allow_Web' permits traffic matching service tcp/443 from any source. An HTTPS request to 10.1.1.50 uses tcp/443, so it matches the rule and is allowed. Option D is also true because HTTPS corresponds to application ssl, but the rule's service match is explicit; however, the question's intended correct answer is C as it directly references the service match. The previous explanation incorrectly stated that option D was wrong due to source being 'any,' which is not relevant.

Answer

Denied because the source is not specified in Allow_Web.

Answer

Denied by rule Block_ALL because it is the last rule.

Answer

Allowed by rule Allow_Web because application ssl matches.

Question 4

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.

Question 5

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 6

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 7

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Accepted Answer

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action. A security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Answer

Source Zone, Destination Zone, Application, and User

Answer

Source Zone, Destination Zone, Application, and Service

Answer

Source Zone, Destination Zone, Service, and Action

Question 8

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Accepted Answer

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.. To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Answer

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Answer

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Answer

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Question 9

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 10

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Accepted Answer

The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.. The URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.

Answer

The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.

Answer

The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.

Answer

The firewall has insufficient memory to process URL lookups and is dropping packets.

Question 11

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Accepted Answer

A rule with a broader match exists above the blocking rule in the rulebase.. In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Answer

The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

Answer

The custom object containing the malicious IP was not committed.

Answer

The device clock is out of sync, causing time-based rules to fail.

Question 12

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 13

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Accepted Answer

Rule 1 (allow-web). Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Answer

Rule 3 (allow-dns)

Answer

Rule 2 (block-malware)

Answer

No rule matches; traffic is denied by default.

Question 14

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Accepted Answer

Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.. Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Answer

Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.

Answer

Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.

Answer

Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.

Question 15

Match each PAN-OS component to its role.

Accepted Answer

Management Plane: Handles device configuration, management access, and logging.. The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Answer

Management Plane: Processes and forwards network traffic based on security policies.

Answer

Data Plane: Handles device configuration, management access, and logging.

Question 16

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad. Option D allows all traffic.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 17

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Accepted Answer

SSL Decryption with a dedicated decryption broker.. The decryption broker feature allows offloading decryption to a dedicated appliance while maintaining visibility for the firewall. Option B, SSL Forward Proxy with decryption mirroring, mirrors decrypted traffic but does not offload decryption. Option C, decryption port mirroring, is not a standard feature for offloading. Option D, TLS 1.3 decryption, refers to supporting a protocol version, not a decryption offloading solution.

Answer

SSL Forward Proxy with decryption mirroring.

Answer

Decryption port mirroring.

Answer

TLS 1.3 decryption.

Question 18

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. A security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 19

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Dynamic IP and Port (DIPP) NAT allows multiple internal users to share a pool of public IP addresses by using port address translation, which is ideal for outbound internet access. Option B (Bidirectional NAT) is typically used for static 1-to-1 mappings that allow both inbound and outbound translation, not for sharing a pool of addresses. Option C (Static NAT with source NAT) is used for static mapping of a private IP to a public IP, primarily for inbound traffic, not for sharing a pool. Option D (Destination NAT with port forwarding) is used to forward specific inbound traffic to internal servers, not for outbound internet access.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 20

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. Ensuring App-ID updates are current and using application identification enhancements (such as application override when needed) directly improves the accuracy of application identification. Option A (SSL Decryption) can help identify encrypted applications but does not directly address misidentification due to outdated signatures or custom needs. Option B (port-based rules) would reduce reliance on App-ID, which is counterproductive. Option C (custom application signatures) is useful but is not the first step; verifying updates and enhancements is a more fundamental action. Therefore, D is the best initial step.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.