PCNSA Securing Traffic — All Questions With Answers

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Question 2easymultiple choice

Read the full DNS explanation →

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Question 3hardmultiple choice

Review the full routing breakdown →

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Question 4easymultiple choice

Read the full Securing Traffic explanation →

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Question 5mediummultiple choice

Read the full Securing Traffic explanation →

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Question 6hardmulti select

Read the full DNS explanation →

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Question 7mediummulti select

Read the full Securing Traffic explanation →

Which THREE are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose three.)

Question 8hardmultiple choice

Read the full Securing Traffic explanation →

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Question 9hardmultiple choice

Read the full Securing Traffic explanation →

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Question 10mediummulti select

Read the full Securing Traffic explanation →

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Question 11easymultiple choice

Read the full Securing Traffic explanation →

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Exhibit

Refer to the exhibit.

admin@PA-5050> show running security-policy

  name                      from     to       source          destination  application  service    action
  ------------------------  -------  -------  --------------  -----------  ------------  ---------  -------
  1 allow-web               trust    untrust  10.0.0.0/8      192.0.2.0/24 web-browsing  http       allow
  2 block-malware           trust    untrust  any             any          any           any        deny
  3 allow-dns               trust    untrust  any             any          dns           udp/53     allow

  Total rules: 3

Question 12mediumdrag order

Read the full Securing Traffic explanation →

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediummatching

Read the full Securing Traffic explanation →

Match each PAN-OS component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Handles configuration and logging

Processes traffic and enforces policies

Manages routing and session setup

Aggregates logs from multiple firewalls

Question 14easymultiple choice

Read the full Securing Traffic explanation →

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Question 15mediummultiple choice

Read the full Securing Traffic explanation →

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Question 16hardmultiple choice

Read the full Securing Traffic explanation →

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Question 17easymultiple choice

Read the full Securing Traffic explanation →

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Question 18mediummultiple choice

Read the full NAT/PAT explanation →

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Question 19hardmultiple choice

Read the full Securing Traffic explanation →

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Question 20easymultiple choice

Read the full Securing Traffic explanation →

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Question 21mediummultiple choice

Read the full Securing Traffic explanation →

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

Question 22hardmultiple choice

Read the full Securing Traffic explanation →

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Question 23easymulti select

Read the full Securing Traffic explanation →

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Question 24mediummulti select

Read the full Securing Traffic explanation →

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Question 25hardmulti select

Read the full Securing Traffic explanation →

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Question 26mediummultiple choice

Read the full NAT/PAT explanation →

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

Exhibit

Refer to the exhibit.
Exhibit: CLI output from 'show running security-policy' shows:

```
set rulebase security rules "Allow_Web" from untrust to dmz source any destination 10.1.1.0/24 application web-browsing,ssl service tcp/80, tcp/443 action allow log-end
set rulebase security rules "Block_ALL" from any to any source any destination any application any service any action deny
```

Question 27hardmultiple choice

Read the full Securing Traffic explanation →

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit.
Exhibit: Config snippet:

```
set shared application-tunnel time-to-live 30
set shared application-tunnel policy "Block_Tor" action deny
set shared application-tunnel policy "Allow_SSH" action allow tunnel detection none
```

Question 28easymultiple choice

Read the full Securing Traffic explanation →

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

Exhibit

Refer to the exhibit.
Exhibit: Output from 'show session id 12345':

```
session id 12345
  application: ssl
  source: 192.168.1.10/20000
  destination: 203.0.113.5/443
  zone: inside -> outside
  rule: Allow_Outbound
  decrypted: yes
  decryption profile: Decrypt_Forward
  decrypted-policy: Decrypt_All
```

Question 29mediummultiple choice

Read the full Securing Traffic explanation →

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

Question 30easymultiple choice

Read the full NAT/PAT explanation →

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Question 31hardmultiple choice

Read the full Securing Traffic explanation →

An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?

Question 32mediummultiple choice

Read the full Securing Traffic explanation →

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

Question 33easymultiple choice

Read the full Securing Traffic explanation →

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

Question 34hardmultiple choice

Read the full Securing Traffic explanation →

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Question 35mediummultiple choice

Read the full Securing Traffic explanation →

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Question 36easymultiple choice

Read the full NAT/PAT explanation →

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

Question 37hardmultiple choice

Read the full Securing Traffic explanation →

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Question 38mediummulti select

Read the full Securing Traffic explanation →

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Question 39hardmulti select

Read the full Securing Traffic explanation →

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Question 40easymulti select

Read the full Securing Traffic explanation →

Which TWO security profile types are used to block known malware? (Choose two.)

Question 41mediummultiple choice

Read the full Securing Traffic explanation →

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Exhibit

Refer to the exhibit.

admin@PA-500> show running security-policy

Rules:
1. name: allow-http-from-trust-to-untrust
   source: 10.0.0.0/8
   destination: any
   application: http
   action: allow

2. name: deny-all-from-trust-to-untrust
   source: 10.0.0.0/8
   destination: any
   application: any
   action: deny

3. name: allow-dns-from-trust-to-untrust
   source: 10.0.0.0/8
   destination: any
   application: dns
   action: allow

Note: There are no other security rules.

Question 42easymultiple choice

Read the full NAT/PAT explanation →

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Exhibit

Refer to the exhibit.

admin@PA-500> show running nat-policy

Rules:
1. name: source-nat-1
   source: 10.0.0.0/8
   destination: any
   service: any
   source-translation: interface-ip-address (ethernet1/2)
   action: dynamic-ip-and-port

2. name: no-nat-for-servers
   source: 10.0.0.0/8
   destination: 192.168.1.0/24
   service: any
   action: no-nat

Question 43hardmultiple choice

Read the full Securing Traffic explanation →

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Exhibit

Refer to the exhibit.

Log entry:

Time: 2024-03-01 10:00:00
Source IP: 10.1.1.100
Destination IP: 203.0.113.50
Application: ssl
Action: allow
Session End Reason: tcp-rst-from-client
Bytes Sent: 1024
Bytes Received: 10240

Context: The security policy allows all outbound traffic. The client is a web browser.

Question 44mediummultiple choice

Read the full Securing Traffic explanation →

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

Question 45hardmultiple choice

Read the full Securing Traffic explanation →

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

Question 46mediummulti select

Read the full Securing Traffic explanation →

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Question 47easymultiple choice

Review the full subnetting walkthrough →

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

Question 48mediummultiple choice

Review the full routing breakdown →

A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.

Question 49hardmultiple choice

Read the full NAT/PAT explanation →

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Question 50mediummultiple choice

Read the full network assurance explanation →

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Question 51mediummulti select

Read the full Securing Traffic explanation →

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Question 52hardmultiple choice

Read the full Securing Traffic explanation →

Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?

Exhibit

Refer to the exhibit.

security-policy {
    rules {
        rule1 {
            name "Allow-Web";
            source-zone "Trust";
            destination-zone "Untrust";
            source-address "10.0.0.0/24";
            destination-address "any";
            application "web-browsing";
            service "tcp-80";
            action "allow";
        }
        rule2 {
            name "Block-All";
            source-zone "any";
            destination-zone "any";
            application "any";
            service "any";
            action "deny";
        }
    }
}

Question 53easymultiple choice

Read the full DNS explanation →

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

Refer to the exhibit. admin@PA-5050> show running security-policy name from to source destination application service action ------------------------ ------- ------- -------------- ----------- ------------ --------- ------- 1 allow-web trust untrust 10.0.0.0/8 192.0.2.0/24 web-browsing http allow 2 block-malware trust untrust any any any any deny 3 allow-dns trust untrust any any dns udp/53 allow Total rules: 3

Refer to the exhibit. Exhibit: CLI output from 'show running security-policy' shows: ``` set rulebase security rules "Allow_Web" from untrust to dmz source any destination 10.1.1.0/24 application web-browsing,ssl service tcp/80, tcp/443 action allow log-end set rulebase security rules "Block_ALL" from any to any source any destination any application any service any action deny ```

Refer to the exhibit. Exhibit: Config snippet: ``` set shared application-tunnel time-to-live 30 set shared application-tunnel policy "Block_Tor" action deny set shared application-tunnel policy "Allow_SSH" action allow tunnel detection none ```

Refer to the exhibit. Exhibit: Output from 'show session id 12345': ``` session id 12345 application: ssl source: 192.168.1.10/20000 destination: 203.0.113.5/443 zone: inside -> outside rule: Allow_Outbound decrypted: yes decryption profile: Decrypt_Forward decrypted-policy: Decrypt_All ```

Refer to the exhibit. admin@PA-500> show running security-policy Rules: 1. name: allow-http-from-trust-to-untrust source: 10.0.0.0/8 destination: any application: http action: allow 2. name: deny-all-from-trust-to-untrust source: 10.0.0.0/8 destination: any application: any action: deny 3. name: allow-dns-from-trust-to-untrust source: 10.0.0.0/8 destination: any application: dns action: allow Note: There are no other security rules.

Refer to the exhibit. admin@PA-500> show running nat-policy Rules: 1. name: source-nat-1 source: 10.0.0.0/8 destination: any service: any source-translation: interface-ip-address (ethernet1/2) action: dynamic-ip-and-port 2. name: no-nat-for-servers source: 10.0.0.0/8 destination: 192.168.1.0/24 service: any action: no-nat

Refer to the exhibit. Log entry: Time: 2024-03-01 10:00:00 Source IP: 10.1.1.100 Destination IP: 203.0.113.50 Application: ssl Action: allow Session End Reason: tcp-rst-from-client Bytes Sent: 1024 Bytes Received: 10240 Context: The security policy allows all outbound traffic. The client is a web browser.

Refer to the exhibit. security-policy { rules { rule1 { name "Allow-Web"; source-zone "Trust"; destination-zone "Untrust"; source-address "10.0.0.0/24"; destination-address "any"; application "web-browsing"; service "tcp-80"; action "allow"; } rule2 { name "Block-All"; source-zone "any"; destination-zone "any"; application "any"; service "any"; action "deny"; } } }