PCNSA Securing Traffic — 40 Questions

Question 1

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Accepted Answer

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action. A security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Answer

Source Zone, Destination Zone, Application, and User

Answer

Source Zone, Destination Zone, Application, and Service

Answer

Source Zone, Destination Zone, Service, and Action

Question 2

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Accepted Answer

The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.. The URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.

Answer

The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.

Answer

The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.

Answer

The firewall has insufficient memory to process URL lookups and is dropping packets.

Question 3

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 4

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Accepted Answer

Rule 1 (allow-web). Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Answer

Rule 3 (allow-dns)

Answer

Rule 2 (block-malware)

Answer

No rule matches; traffic is denied by default.

Question 5

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Accepted Answer

SSL Decryption with a dedicated decryption broker.. The Decryption Broker feature on Palo Alto Networks firewalls allows you to offload SSL decryption to a dedicated appliance (like a third-party security device) while maintaining visibility. This is achieved by configuring a decryption broker profile and forwarding decrypted traffic to the broker. This offloads decryption processing from the firewall.

Answer

SSL Forward Proxy with decryption mirroring.

Answer

Decryption port mirroring.

Answer

TLS 1.3 decryption.

Question 6

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. The correct answer is a security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering. This combination provides comprehensive threat inspection for traffic from the inside to the outside zone, covering malware, exploits, and malicious URLs. Applying all these profiles ensures that the firewall inspects the traffic for multiple threat vectors without causing a bottleneck, as the profiles are optimized to work together. A single profile like URL filtering or antivirus alone would not provide the necessary breadth of inspection.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 7

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. The [CORRECT] answer is D because App-ID accuracy depends on up-to-date application signatures and the firewall's ability to inspect traffic properly. Verifying that App-ID updates are current ensures the firewall recognizes the latest application versions, and enabling application identification enhancements (such as application override for custom or evasive apps) improves detection when standard signatures fail.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.

Question 8

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Accepted Answer

Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.. Creating a security rule with the source zone (external), source IP, any destination, and action deny, placed at the top of the rulebase, is the simplest and most direct method to block all traffic from a specific IP. Option B (Zone Protection profile) is designed for flood protection and not for blocking specific IPs. Option C omits the source zone, which could allow traffic from other zones and is not as precise. Option D (DoS protection policy) is intended for rate limiting and anomaly detection, not for simply blocking a single IP address.

Answer

Use a Zone Protection profile to block the IP.

Answer

Create a security rule with source IP address and action deny.

Answer

Use a DoS protection policy to block the IP.

Question 9

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

Accepted Answer

User-ID mapping to ensure the user is correctly identified.. The issue is user-specific (only one user cannot access, others can). This suggests a problem with user identification or authentication. User-ID mapping ensures the user is correctly identified so that security rules tied to specific users (rather than just IP addresses) are applied properly. Checking User-ID mapping is the first logical step.

Answer

The application override configuration.

Answer

The security rule for the user's source zone.

Answer

The FTP server's health.

Question 10

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Application-ID (option C) is correct because it is the Palo Alto Networks engine that identifies applications traversing the firewall regardless of port, protocol, or encryption, allowing the administrator to create security policies that permit only approved applications and deny all others. Content-ID (option E) is correct because it provides the application-layer inspection — including threat prevention, file blocking, data filtering, and URL filtering profiles — that is attached to those allow rules to enforce what the approved applications are allowed to do and block malicious or unauthorized content within them. Together, Application-ID identifies and controls which applications are permitted, while Content-ID inspects the traffic of those permitted applications, which is exactly what is needed to enforce an approved-application-only network. WildFire (option A) is a cloud-based malware analysis and sandboxing service, not an application control mechanism, so it does not by itself restrict which applications can be used. User-ID (option B) maps IP addresses to users for user-based policy, but it does not identify or enforce approved applications. URL Filtering (option D) controls access to web categories and sites rather than identifying and restricting applications, so it is not the feature that enforces application allow-listing.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 11

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Accepted Answer

Host Information Profile (HIP). Option B, Host Information Profile (HIP), is correct because HIP collects endpoint posture data (OS version, patch level, antivirus, disk encryption, etc.) and lets the gateway enforce HIP-based security policies so that only devices meeting the compliance profile are allowed to connect. Option C, Client certificates, is correct because requiring client certificates in the GlobalProtect portal/gateway configuration provides strong device/user authentication, ensuring only devices holding a valid, trusted certificate issued by the organization's CA can establish the tunnel. Together, HIP enforces compliance posture while client certificates enforce identity, which is exactly what is needed to restrict remote access to compliant devices. Option A, Gateway configuration, is not a distinct compliance feature but the general container where portal/gateway settings (including HIP and certificates) are defined. Option D, App-IP mapping, relates to App-ID and IP address correlation for visibility/policy, not endpoint compliance enforcement. Option E, Pre-logon, allows tunnel establishment before user login for machine-based access, but it does not by itself verify device compliance.

Answer

Gateway configuration

Answer

App-IP mapping

Answer

Pre-logon

Question 12

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

Accepted Answer

Allowed by rule Allow_Web because service tcp/443 matches.. The Allow_Web rule is configured with service tcp/443 and application ssl, and it matches the untrust zone source, the trust zone destination, and the destination IP 10.1.1.50. Since the HTTPS request uses TCP port 443 and the SSL application, the rule allows the traffic. The rule is evaluated before the Block_ALL rule, so the request is permitted.

Answer

Denied because the source is not specified in Allow_Web.

Answer

Denied by rule Block_ALL because it is the last rule.

Answer

Allowed by rule Allow_Web because application ssl matches.

Question 13

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Accepted Answer

The policy "Allow_SSH" has tunnel detection set to none, so it does not match.. The most likely cause is that the security policy `Allow_SSH` has tunnel detection set to `none`, meaning it does not inspect for SSH tunnels. Therefore, SSH tunnel traffic does not match this rule and is subsequently blocked by a default deny rule or another policy. To allow SSH tunnels, the policy must have tunnel detection enabled (e.g., `ssh-tunnel`) to properly identify and permit the traffic.

Answer

The application tunnel policy "Block_Tor" is blocking all tunnels.

Answer

The time-to-live setting prevents SSH tunnel detection.

Answer

The default action for application tunnels is deny.

Question 14

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

Accepted Answer

There is an allow rule above the deny rule that matches the traffic first.. Palo Alto Networks firewalls evaluate security policy rules top-down and stop at the first match. If an allow rule appears above the deny rule and its match conditions (zones, source/destination, application, user) cover the traffic in question, the allow rule wins and the deny rule is never evaluated. This is the classic 'rule order matters' scenario in PAN-OS policy evaluation. The fix is to move the deny rule above the allow rule or tighten the allow rule's match criteria.

Answer

The security policy is not enabled on the firewall.

Answer

The deny rule was removed from the configuration.

Answer

The traffic is matching the implicit deny rule at the end.

Question 15

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

Accepted Answer

Source NAT (Outbound). Source NAT (Outbound). Source NAT translates the source IP address of internal hosts to a public IP address when traffic goes out to the Internet, effectively hiding internal IP addresses. Option B (Dynamic IP and Port) is a type of source NAT that also hides addresses, but it is a specific method, not the broad category. Option C (Destination NAT) translates destination IP addresses for inbound traffic, not outbound. Option D (Static NAT) provides a one-to-one mapping and does not hide the internal IP because the translation is fixed and often bidirectional.

Answer

Dynamic IP and Port (DIPP)

Answer

Destination NAT

Answer

Static NAT

Question 16

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Accepted Answer

Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.. To allow traffic from vsys1 to vsys2 while blocking other inter-vsys traffic, you must create a security policy rule that specifies the source zone from vsys1 and destination zone from vsys2 with an allow action. This explicitly permits only that traffic.

Answer

Configure intra-vsys security policy for each vsys and allow the traffic.

Answer

Enable inter-vsys traffic globally in the firewall settings.

Answer

Traffic between vsys is automatically allowed.

Question 17

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. Antivirus (D) is correct because it scans traffic for known malware signatures and blocks or alerts on files containing viruses, worms, and trojans as they pass through the firewall. File Blocking (A) is correct because it blocks file transfers based on file type, and it can be configured to block files that are known to carry malware, such as executables, thereby preventing known malicious file types from entering the network. URL Filtering (B) is not correct because it controls access to websites based on URL categories rather than blocking malware itself. Anti-Spyware (C) is not correct because it targets spyware, adware, and command-and-control traffic, not known malware files. Vulnerability Protection (E) is not correct because it blocks exploits targeting software vulnerabilities rather than known malware signatures.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 18

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Accepted Answer

Rule 2: deny-all-from-trust-to-untrust (deny). The traffic is HTTPS, which uses the SSL application, not HTTP. Rule 1 only matches HTTP, so it does not match. Rule 2 is a deny-all rule that applies to all traffic from the trust zone to the untrust zone, so it matches and denies the HTTPS traffic. Rule 3 only matches DNS, and the implicit deny is not reached because Rule 2 explicitly denies the traffic. Therefore, the correct rule is Rule 2 (deny-all-from-trust-to-untrust).

Answer

Rule 1: allow-http-from-trust-to-untrust (allow)

Answer

Rule 3: allow-dns-from-trust-to-untrust (allow)

Answer

No rule matches; implicit deny will block the traffic.

Question 19

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Accepted Answer

Rule 1: source-nat-1. The workstation at 10.0.0.5 sending traffic to 8.8.8.8 will match Rule 1: source-nat-1. This rule likely performs source NAT for internal addresses going to external destinations. Rule 2: no-nat-for-servers likely applies to server addresses or specific destinations, and since the source is a workstation, it does not match. Therefore, Rule 1 is applied.

Answer

Rule 2: no-nat-for-servers

Answer

Both rules are applied.

Answer

No NAT rule matches; traffic is not translated.

Question 20

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. A TCP reset (RST) sent by the client immediately after the TLS handshake typically indicates the client's TLS stack rejected the server's certificate — for example, an untrusted CA, hostname mismatch, or expired cert — and tore down the connection. The client, not the server or firewall, is the originator of the RST, which rules out policy-based blocking (which would silently drop or send its own RST from the firewall). This is the classic signature of a certificate validation failure in the client's browser or application.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.