PCNSA Securing Traffic Practice Test 2 — 15 Questions

Question 1

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad. Option D allows all traffic.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 2

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Accepted Answer

SSL Decryption with a dedicated decryption broker.. The decryption broker feature allows offloading decryption to a dedicated appliance while maintaining visibility for the firewall. Option B, SSL Forward Proxy with decryption mirroring, mirrors decrypted traffic but does not offload decryption. Option C, decryption port mirroring, is not a standard feature for offloading. Option D, TLS 1.3 decryption, refers to supporting a protocol version, not a decryption offloading solution.

Answer

SSL Forward Proxy with decryption mirroring.

Answer

Decryption port mirroring.

Answer

TLS 1.3 decryption.

Question 3

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. A security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 4

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Dynamic IP and Port (DIPP) NAT allows multiple internal users to share a pool of public IP addresses by using port address translation, which is ideal for outbound internet access. Option B (Bidirectional NAT) is typically used for static 1-to-1 mappings that allow both inbound and outbound translation, not for sharing a pool of addresses. Option C (Static NAT with source NAT) is used for static mapping of a private IP to a public IP, primarily for inbound traffic, not for sharing a pool. Option D (Destination NAT with port forwarding) is used to forward specific inbound traffic to internal servers, not for outbound internet access.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 5

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. Ensuring App-ID updates are current and using application identification enhancements (such as application override when needed) directly improves the accuracy of application identification. Option A (SSL Decryption) can help identify encrypted applications but does not directly address misidentification due to outdated signatures or custom needs. Option B (port-based rules) would reduce reliance on App-ID, which is counterproductive. Option C (custom application signatures) is useful but is not the first step; verifying updates and enhancements is a more fundamental action. Therefore, D is the best initial step.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.

Question 6

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Accepted Answer

Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.. Creating a security rule with the source zone (external), source IP, any destination, and action deny, placed at the top of the rulebase, is the simplest and most direct method to block all traffic from a specific IP. Option B (Zone Protection profile) is designed for flood protection and not for blocking specific IPs. Option C omits the source zone, which could allow traffic from other zones and is not as precise. Option D (DoS protection policy) is intended for rate limiting and anomaly detection, not for simply blocking a single IP address.

Answer

Use a Zone Protection profile to block the IP.

Answer

Create a security rule with source IP address and action deny.

Answer

Use a DoS protection policy to block the IP.

Question 7

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

Accepted Answer

User-ID mapping to ensure the user is correctly identified.. The issue is user-specific (only one user cannot access, others can). This suggests a problem with user identification or authentication. User-ID mapping ensures the user is correctly identified so that security rules tied to specific users (rather than just IP addresses) are applied properly. Checking User-ID mapping is the first logical step.

Answer

The application override configuration.

Answer

The security rule for the user's source zone.

Answer

The FTP server's health.

Question 8

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Accepted Answer

Create a decryption exclusion rule for specific URLs or categories.. Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites. Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Answer

Rely on the browser's security settings to prevent decryption.

Answer

Disable SSL Decryption globally when the user visits sensitive sites.

Answer

Use a policy to decrypt only HTTP traffic.

Question 9

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies. WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 10

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Accepted Answer

Antivirus. Options A, C, and E are correct. Antivirus blocks known malware, Anti-Spyware blocks spyware and grayware, and Vulnerability Protection blocks exploit attempts. Together, these three profile types provide comprehensive protection against malware. URL Filtering controls access based on categories, and File Blocking blocks specific file types, but they are not primarily malware-blocking profiles.

Answer

URL Filtering

Answer

File Blocking

Question 11

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Accepted Answer

Host Information Profile (HIP). The correct answers are Host Information Profile (HIP) and Client certificates. HIP checks device compliance (e.g., OS, antivirus, disk encryption) to ensure only compliant devices connect. Client certificates authenticate the device itself, providing an additional layer of security. Gateway configuration is basic connectivity, pre-logon is for always-on VPN, and App-IP mapping is irrelevant to device compliance.

Answer

Gateway configuration

Answer

App-IP mapping

Answer

Pre-logon

Question 12

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Accepted Answer

The policy "Allow_SSH" has tunnel detection set to none, so it does not match.. The Allow_SSH policy has tunnel detection set to 'none', which means the firewall will not detect SSH tunnels, so the policy does not match. The other options are incorrect: Option B is wrong because the Block_Tor policy only blocks Tor tunnels, not all tunnels. Option C is wrong because TTL is not related to SSH tunnel detection. Option D is wrong because the default action for application tunnels is not necessarily deny; it depends on the policy configuration.

Answer

The application tunnel policy "Block_Tor" is blocking all tunnels.

Answer

The time-to-live setting prevents SSH tunnel detection.

Answer

The default action for application tunnels is deny.

Question 13

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

Accepted Answer

It is a security rule that allows the session.. Based on the exhibit, the session output shows that the rule 'Allow_Outbound' matched and allowed the session. This rule is a security rule because it permits traffic. Options B, C, and D are incorrect: QoS rules prioritize traffic, NAT rules translate IP addresses, and decryption rules decrypt traffic. The session was allowed, indicating a security rule.

Answer

It is a QoS rule that prioritizes the traffic.

Answer

It is a NAT rule that translates the source IP.

Answer

It is a decryption rule that decrypts the traffic.

Question 14

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

Accepted Answer

There is an allow rule above the deny rule that matches the traffic first.. Any deny rule placed after a matching allow rule will not be evaluated if the allow rule is hit first. Rule order is critical in PAN-OS. Option A is wrong because removing the rule is not the cause. Option B is wrong because policy is not optional. Option C is wrong because implicit deny exists but only if no rule matches.

Answer

The security policy is not enabled on the firewall.

Answer

The deny rule was removed from the configuration.

Answer

The traffic is matching the implicit deny rule at the end.

Question 15

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Accepted Answer

Block the social-networking category and allow a custom URL category containing LinkedIn URLs.. It blocks the entire social-networking category and then creates a custom URL category for LinkedIn with an allow override, allowing LinkedIn while blocking all other social media. Option B is incorrect because alerting does not block, so social media would not be blocked. Option C is incorrect because it would block both the category and LinkedIn, resulting in LinkedIn being blocked. Option D is incorrect because allowing the social-networking category would allow all social media, including those that should be blocked.

Answer

Alert the social-networking category and block a custom URL category for LinkedIn.

Answer

Block the social-networking category and block a custom URL category for LinkedIn.

Answer

Allow the social-networking category and block a custom URL category for LinkedIn.