PCNSA Securing Traffic Practice Test 3 — 15 Questions

Question 1

An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?

Accepted Answer

The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.. Option A is correct because the firewall's CA certificate must be trusted by client browsers. Without it, the dynamically generated certificates for remote sites are not trusted. Option B is wrong because the server certificate is not needed on clients. Option C is wrong because the decryption policy does not require a certificate on the firewall. Option D is wrong because CRL is for revocation, not trust.

Answer

The decryption policy does not specify a certificate for forward proxy.

Answer

The CRL (Certificate Revocation List) is not enabled on the firewall.

Answer

The server certificate for each HTTPS site is missing from the client's certificate store.

Question 2

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

Accepted Answer

Ensure the application is identified by App-ID and that the correct application name is used.. Option D is correct because the application might not be identified by App-ID if the traffic is encrypted or unknown. The administrator should verify the application is recognized. Option A is wrong because rule order is less likely if the rule matches. Option B is wrong because zones are configured. Option C is wrong because the rule already allows application; blocking is a different action.

Answer

Verify the source and destination zones are correct.

Answer

Confirm that the action is set to allow.

Answer

Check the order of security rules.

Question 3

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

Accepted Answer

Configure User-ID by integrating with Active Directory or using captive portal.. Option A is correct because User-ID requires user mapping from AD, captive portal, or other methods. Option B is wrong because URL filtering is separate. Option C is wrong because decryption is not needed for user identification. Option D is wrong because application identification is different.

Answer

Deploy SSL decryption to see user credentials.

Answer

Enable URL Filtering to track user visits.

Answer

Activate App-ID to detect user login events.

Question 4

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. Option B is correct because a deny rule with an exception can be implemented by placing a specific allow rule before a general deny rule. Option A is wrong because modifying the deny rule to allow would permit all. Option C is wrong because a single rule with allow and deny is not possible. Option D is wrong because creating a separate zone is unnecessary.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 5

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Accepted Answer

The profiles are set to 'alert' instead of 'block' for the critical threat categories.. Option D is correct because if the profile is applied but set to alert-only, it will not block. Option A is wrong because profiles are applied per rule. Option B is wrong because updating AV does not prevent all. Option C is wrong because profile order doesn't matter for blocking.

Answer

The antivirus signatures are outdated.

Answer

The security profiles are not attached to any security rule.

Answer

The profile groups are applied in the wrong order.

Question 6

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

Accepted Answer

Source NAT (Outbound). Option B is correct because source NAT (translation of source IP) is used to hide internal addresses. Option A is wrong because destination NAT translates incoming traffic. Option C is wrong because static NAT maps one-to-one and does not hide. Option D is wrong because this is not a standard PAN NAT type.

Answer

Dynamic IP and Port (DIPP)

Answer

Destination NAT

Answer

Static NAT

Question 7

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Accepted Answer

Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.. Option C is correct because inter-vsys traffic is controlled by a security policy with source zone in vsys1 and destination zone in vsys2. Option A is wrong because inter-vsys rules exist, it's not automatic. Option B is wrong because there is no global setting. Option D is wrong because intra-vsys is within same vsys.

Answer

Configure intra-vsys security policy for each vsys and allow the traffic.

Answer

Enable inter-vsys traffic globally in the firewall settings.

Answer

Traffic between vsys is automatically allowed.

Question 8

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Accepted Answer

Captive Portal. Options A and D are correct. User-ID agent collects user mappings from AD; Captive Portal authenticates users directly. LDAP sync is not a method for User-ID; it's a protocol. XML API can be used but not standard method. Kerberos is not directly used.

Answer

Kerberos Authentication

Answer

LDAP Synchronization

Answer

XML API

Question 9

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Accepted Answer

A root CA certificate installed in the trusted root store on client devices.. Options A, B, and D are correct. The root CA certificate must be installed on clients so they trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt. A decryption profile specifies the forward proxy certificate (the CA cert). Option C is wrong because the server certificate is not needed on clients. Option E is wrong because the private key is on the server, not required.

Answer

The private key of each destination server.

Answer

The server certificate for each destination server.

Question 10

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. Options A and C are correct. Antivirus blocks malware based on signatures. File Blocking blocks specific file types, which can include malicious files. Anti-spyware blocks spyware specifically. Vulnerability Protection blocks exploits, not malware files. URL Filtering controls URLs.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 11

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Accepted Answer

Rule 2: deny-all-from-trust-to-untrust (deny). Option A is correct because rule 1 matches HTTP only; HTTPS is a different application (ssl). Rule 2 does not match because it is after rule 1? Actually the traffic hits rule 1 first, but since application is http and not ssl, rule 1 does not match. Then rule 2 matches because it applies to any application from 10.0.0.0/8, so it matches and denies the traffic. Rule 3 is for DNS only. So traffic will be denied by rule 2.

Answer

Rule 1: allow-http-from-trust-to-untrust (allow)

Answer

Rule 3: allow-dns-from-trust-to-untrust (allow)

Answer

No rule matches; implicit deny will block the traffic.

Question 12

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Accepted Answer

Rule 1: source-nat-1. Option A is correct because the traffic matches source range 10.0.0.0/8 and destination does not match the exception rule (8.8.8.8 is not 192.168.1.0/24), so rule 1 is applied and translates the source IP to the interface IP. Option B is wrong because the destination does not match rule 2. Option C is wrong because multiple matches not possible; first match wins. Option D is wrong because a rule matches.

Answer

Rule 2: no-nat-for-servers

Answer

Both rules are applied.

Answer

No NAT rule matches; traffic is not translated.

Question 13

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. Option C is correct because a client may send a reset if it receives an unexpected response, such as a certificate error. HTTPS traffic is encrypted; if the server's certificate is invalid or the firewall's decryption is misconfigured, the client may reject the connection and send a reset. Option A is wrong because a timeout would show tcp-timeout. Option B is wrong because if the server reset, it would be tcp-rst-from-server. Option D is wrong because application is ssl; it's not blocked.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 14

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

Accepted Answer

Create a decryption exclusion rule for financial and banking websites.. Option B is correct because excluding certain sensitive or unnecessary categories (e.g., banking) reduces decryption load and related performance issues. Option A is incorrect because hardware offloading may not be available or may not address the root cause. Option C is incorrect because increasing session timeouts does not reduce decryption processing. Option D is incorrect because using high-strength ciphers increases processing overhead.

Answer

Increase the session timeout values for decrypted traffic.

Answer

Enable hardware SSL decryption offloading on the firewall.

Answer

Change the decryption profile to require only high-strength ciphers.

Question 15

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

Accepted Answer

Consolidate rules using Security Profile Groups (SPGs) and broader application groups.. Option D is correct because using Security Profile Groups (SPGs) allows multiple rules to share the same profiles, reducing duplication. Option A is incorrect as using default ports bypasses App-ID. Option B is incorrect because placing specific rules at top does not reduce count. Option C is incorrect because converting to service objects removes application visibility.

Answer

Use only default ports for services to avoid creating service objects.

Answer

Convert all application-based rules to use service objects instead.

Answer

Place the most specific rules at the top of the rulebase.