PCNSA Securing Traffic Practice Test 2 — 15 Questions

Question 1

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.. To allow traffic from vsys1 to vsys2 while blocking other inter-vsys traffic, you must create a security policy rule that specifies the source zone from vsys1 and destination zone from vsys2 with an allow action. This explicitly permits only that traffic.

Answer

Configure intra-vsys security policy for each vsys and allow the traffic.

Answer

Enable inter-vsys traffic globally in the firewall settings.

Answer

Traffic between vsys is automatically allowed.

Question 2

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. Antivirus (D) is correct because it scans traffic for known malware signatures and blocks or alerts on files containing viruses, worms, and trojans as they pass through the firewall. File Blocking (A) is correct because it blocks file transfers based on file type, and it can be configured to block files that are known to carry malware, such as executables, thereby preventing known malicious file types from entering the network. URL Filtering (B) is not correct because it controls access to websites based on URL categories rather than blocking malware itself. Anti-Spyware (C) is not correct because it targets spyware, adware, and command-and-control traffic, not known malware files. Vulnerability Protection (E) is not correct because it blocks exploits targeting software vulnerabilities rather than known malware signatures.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 3

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Accepted Answer

Rule 2: deny-all-from-trust-to-untrust (deny). The traffic is HTTPS, which uses the SSL application, not HTTP. Rule 1 only matches HTTP, so it does not match. Rule 2 is a deny-all rule that applies to all traffic from the trust zone to the untrust zone, so it matches and denies the HTTPS traffic. Rule 3 only matches DNS, and the implicit deny is not reached because Rule 2 explicitly denies the traffic. Therefore, the correct rule is Rule 2 (deny-all-from-trust-to-untrust).

Answer

Rule 1: allow-http-from-trust-to-untrust (allow)

Answer

Rule 3: allow-dns-from-trust-to-untrust (allow)

Answer

No rule matches; implicit deny will block the traffic.

Question 4

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Accepted Answer

Rule 1: source-nat-1. The workstation at 10.0.0.5 sending traffic to 8.8.8.8 will match Rule 1: source-nat-1. This rule likely performs source NAT for internal addresses going to external destinations. Rule 2: no-nat-for-servers likely applies to server addresses or specific destinations, and since the source is a workstation, it does not match. Therefore, Rule 1 is applied.

Answer

Rule 2: no-nat-for-servers

Answer

Both rules are applied.

Answer

No NAT rule matches; traffic is not translated.

Question 5

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. A TCP reset (RST) sent by the client immediately after the TLS handshake typically indicates the client's TLS stack rejected the server's certificate — for example, an untrusted CA, hostname mismatch, or expired cert — and tore down the connection. The client, not the server or firewall, is the originator of the RST, which rules out policy-based blocking (which would silently drop or send its own RST from the firewall). This is the classic signature of a certificate validation failure in the client's browser or application.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 6

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

Accepted Answer

Create a decryption exclusion rule for financial and banking websites.. Excluding financial and banking websites from SSL decryption reduces the processing load on the firewall, alleviating performance degradation while still maintaining security for most outbound traffic. These websites typically use high-grade encryption and are trusted, so decryption is unnecessary and can cause performance issues. Option B is incorrect because increasing session timeouts does not reduce decryption processing overhead. Option C is incorrect because hardware SSL decryption offloading may not be supported on all models or may not fully address the performance impact of decrypting all traffic. Option D is incorrect because requiring only high-strength ciphers increases processing overhead, worsening performance.

Answer

Increase the session timeout values for decrypted traffic.

Answer

Enable hardware SSL decryption offloading on the firewall.

Answer

Change the decryption profile to require only high-strength ciphers.

Question 7

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

Accepted Answer

Consolidate rules using Security Profile Groups (SPGs) and broader application groups.. Security Profile Groups bundle multiple threat-prevention profiles (antivirus, anti-spyware, vulnerability, URL filtering, etc.) into a single reusable object, and broader application groups let you match families of applications instead of individual App-IDs. Applying one SPG and a consolidated app group to fewer rules preserves security visibility while dramatically cutting rule count. This is Palo Alto's recommended approach for rulebase optimization in large enterprises.

Answer

Use only default ports for services to avoid creating service objects.

Answer

Convert all application-based rules to use service objects instead.

Answer

Place the most specific rules at the top of the rulebase.

Question 8

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Accepted Answer

Create a security rule with a URL category set to 'internal-ip'.. The correct answers are B and E. Option B is valid because the 'internal-ip' URL category automatically applies to traffic from internal IP addresses, effectively bypassing URL filtering for internal users when used in a security rule with an allow action. Option E is valid because you can create a custom URL category listing internal websites that should be allowed, then use it in a security rule that allows traffic for internal users while applying strict filtering to external traffic. Option A is incorrect because URL Filtering profile override is not a standard feature; User-ID agent configuration does not provide such override. Option C is incorrect because setting the action to 'alert' only logs the traffic, it does not bypass the filtering (the traffic is still subject to the block action if matched). Option D is incorrect because there is no IP exemption list in URL filtering profiles; exemptions are based on URL categories, not IP addresses.

Answer

Enable URL Filtering profile override on the user-id agent configuration.

Answer

Set the URL Filtering profile action to 'alert' instead of 'block'.

Answer

Add the user's IP address to an exemption list in the URL filtering profile.

Question 9

A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.

Accepted Answer

The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'.. The logs show traffic from remote users is being matched to a rule that denies inter-zone traffic from GlobalProtect to internal, meaning the intended allow rule is not matching. If the security rule's source zone is set to 'Trust' instead of 'GlobalProtect', traffic sourced from the GlobalProtect zone will not match that rule and will instead hit the default inter-zone deny rule. Option A is about security profiles, which would not cause a rule mismatch. Option B (User-ID) affects user mapping but not zone-based rule matching. Option C (routes/split-tunneling) affects routing but not policy matching; the users can connect and get IPs, so routing is working, but the traffic is being denied by policy, not routing.

Answer

The internal resources require a specific security profile that is not applied to the rule.

Answer

The User-ID agent is not mapping remote usernames correctly.

Answer

The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings.

Question 10

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Accepted Answer

The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.. The malware uses a custom packer not recognized by current Anti-Malware signatures. The default Anti-Malware profile may not block unknown malware effectively because it relies on signatures. WildFire would provide cloud-based analysis for unknown threats, but the question states the firewall is missing the latest content updates for WildFire, which could also be a factor. However, the most direct reason is that the Anti-Malware profile is set to 'default', which may not have the necessary heuristics or WildFire integration to block unknown malware. The other options are either contradicted by the scenario or less likely.

Answer

The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Answer

The firewall is missing the latest content updates for WildFire.

Answer

The decryption exclusion list includes the domain of the malware source.

Question 11

Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?

Accepted Answer

Create a custom application that matches TCP port 8080 and add it to rule1.. The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.

Answer

Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.

Answer

Remove the service restriction from rule1.

Answer

Change the application in rule1 to 'any' to match all applications.

Question 12

A security administrator configured a security policy rule to allow web browsing from the Trust zone to the Untrust zone. The rule uses the application 'web-browsing' and service 'application-default'. Users report that HTTPS websites are not loading, but HTTP sites work fine. What is the most likely cause?

Accepted Answer

The security policy rule does not include the 'ssl' application, which is required for HTTPS traffic.. HTTPS traffic is identified by the 'ssl' application, not 'web-browsing'. A rule that only allows 'web-browsing' will permit HTTP but deny HTTPS. Adding the 'ssl' application to the rule resolves the issue. The service 'application-default' then automatically permits TCP 443 for SSL.

Answer

SSL decryption is not enabled, so the firewall cannot inspect HTTPS traffic and drops it.

Answer

The service 'application-default' does not include TCP port 443, so HTTPS is blocked.

Answer

The security policy rule is missing a URL filtering profile, which is required for HTTPS.

Question 13

A company has a security policy rule that allows traffic from the Trust zone to the DMZ zone. The rule includes the application 'ftp' and service 'application-default'. Users can connect to the FTP server but cannot transfer files in passive mode. What is the most likely cause?

Accepted Answer

The firewall is not configured to allow the dynamic ports used by FTP passive mode, and a custom application or service must be created.. Passive FTP uses random high ports for data transfer. While Palo Alto Networks firewalls can dynamically open these ports via App-ID, issues can arise when the control channel is not properly inspected or NAT is involved. A common workaround is to create a custom application or service that allows the specific passive port range used by the FTP server.

Answer

The security policy rule is missing the 'ftp-data' application, which is required for file transfers.

Answer

The service 'application-default' only allows TCP port 21, so passive mode data ports are blocked.

Answer

The application 'ftp' does not include the dynamic ports used in passive mode, so a separate rule is needed.

Question 14

An administrator wants to allow only business-critical SaaS applications while blocking all other SaaS apps for users in the 'trust' zone accessing the 'untrust' zone. The firewall is running PAN-OS 10.1 with a valid SaaS application subscription. Which configuration should be used?

Accepted Answer

Create a security policy rule that allows specific business-critical SaaS applications (e.g., salesforce, office365) and a subsequent rule that denies the 'saas' application group.. To allow only specific SaaS applications while blocking others, the firewall must evaluate allow rules for the desired applications before a deny rule that blocks the broader SaaS application group. Since security policies are processed top-down, the allow rules must precede the deny rule. This ensures business-critical SaaS traffic is permitted while all other SaaS applications are denied.

Answer

Create a security policy rule with application filter 'saas' and action 'allow'.

Answer

Create a security policy rule that denies the 'saas' application group and a subsequent rule that allows specific business-critical SaaS applications.

Answer

Create a security policy rule with application 'saas' and action 'allow'.

Question 15

A security administrator has configured a security policy rule that allows web browsing from the Trust zone to the Untrust zone. Users report that they can access HTTP sites but receive timeouts when accessing HTTPS sites. The administrator verifies that the rule allows application web-browsing and service application-default. Which action should the administrator take to resolve the issue while maintaining security best practices?

Accepted Answer

Verify that the web-browsing application includes the ssl dependency and that App-ID is up to date.. For HTTPS traffic to be allowed as web-browsing, PAN-OS requires the ssl application as a dependency. If ssl is not allowed or App-ID is outdated, the firewall may not correctly identify the session, leading to drops. Allowing the ssl application or updating App-ID ensures proper identification without broadening access unnecessarily.

Answer

Change the service to any to allow HTTPS traffic.

Answer

Enable SSL decryption for the traffic to properly identify HTTPS.

Answer

Add the ssl application to the security policy rule.