PCNSA Securing Traffic Practice Test 3 — 15 Questions

Question 1

A network administrator is configuring a security policy rule to allow web browsing from the 'trust' zone to the 'untrust' zone. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, while all other applications are blocked. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule with application 'web-browsing' and 'ssl', but restrict the service to 'service-http' and 'service-https', action 'allow'.. To allow only HTTP and HTTPS while blocking other applications, the security rule should specify the applications 'web-browsing' and 'ssl' and restrict the service to 'service-http' and 'service-https'. This combination ensures that only web traffic on standard ports is permitted. The service restriction prevents other applications from using those ports, and the application specification ensures that only web-related traffic is allowed.

Answer

Create a rule with application 'web-browsing' and service 'service-http' and 'service-https', action 'allow'.

Answer

Create a rule with application 'web-browsing' and 'ssl', action 'allow'.

Answer

Create a rule with application 'ssl' and service 'service-https', action 'allow'.

Question 2

A network security administrator at a healthcare company has configured a security policy rule to allow only specific applications from the Trust zone to the Untrust zone. Users report that a custom internal application using TCP port 8443 is being blocked, even though the rule includes an application override for that port. The administrator verifies that the application override is correctly defined with TCP port 8443 and the rule uses the override application. What is the most likely reason the traffic is still blocked?

Accepted Answer

The application override is defined but the security policy rule is not matching because the override is not included in the rule's application list, and the rule is set to deny.. Application overrides must be explicitly selected in the security policy rule's application list to take effect. Even if the override is defined with the correct port, if it is not included in the rule, the firewall will not match the traffic to that override and may apply a default deny or a different rule. The correct answer highlights that the override must be referenced in the rule, which is a common oversight. This ensures the firewall correctly identifies the custom application and applies the intended policy.

Answer

The security policy rule is configured with an application that is not the override, and the override is not in the rule's application list.

Answer

The application override must be referenced in a separate security policy rule placed above the current rule.

Answer

The application override does not have a source or destination IP address specified, causing it to not match the traffic.

Question 3

A security administrator is configuring a Palo Alto Networks firewall to allow inbound access to a web server in the DMZ from the Untrust zone. The web server uses HTTP on port 80 and HTTPS on port 443. The administrator wants to ensure that only these services are accessible and that all other traffic is blocked. Which two configurations are required in the security policy rule to achieve this? (Choose two.)

Accepted Answer

Set the source zone to Untrust and the destination zone to DMZ.. To allow inbound access to a web server for HTTP and HTTPS only, the security policy rule must specify the correct source and destination zones (Untrust and DMZ) and the correct applications (web-browsing and ssl). These two configurations ensure that the rule matches the intended traffic and permits only the desired services. The action must be allow, but that is a given for an allow rule. Setting the service to application-default is a best practice but not strictly required if the applications are correctly selected. URL filtering is not relevant to restricting services.

Answer

Set the service to application-default.

Answer

Set the action to allow.

Answer

Attach a URL filtering profile to the rule.

Question 4

An administrator is configuring a security policy rule to allow traffic from the 'trust' zone to the 'untrust' zone. The administrator wants to log traffic at both the session start and session end for all allowed connections. Which two actions must be taken to achieve this? (Choose two.)

Accepted Answer

In the security policy rule, set the action to 'allow' and enable 'Log at Session Start'.. To log traffic at both session start and session end for allowed connections, the administrator must enable both 'Log at Session Start' and 'Log at Session End' in the security policy rule's action settings. These are distinct settings that control logging at different points in the session lifecycle. The action must also be set to 'allow' to permit the traffic, but the logging options are the specific actions required to generate the logs.

Answer

Configure a log forwarding profile to send logs to an external syslog server.

Answer

Enable 'Log at Session Start' and 'Log at Session End' in the security policy rule's action settings.

Answer

Set the security policy rule action to 'allow' and enable 'Log at Session Start' and 'Log at Session End' in the rule's action settings.

Question 5

A security administrator is troubleshooting why a security policy rule that allows traffic from the Trust zone to the Untrust zone is not matching. The rule is configured with source zone Trust, destination zone Untrust, source IP 'any', destination IP 'any', application 'web-browsing', and action 'allow'. The administrator notices that traffic from a user to a web server is being denied by a subsequent rule. What is the most likely reason the allow rule is not matching?

Accepted Answer

The application 'web-browsing' only matches HTTP traffic, but the user's traffic is HTTPS.. The allow rule is not matching because it specifies the web-browsing application, which only matches HTTP traffic. If the user is accessing an HTTPS site, the traffic is identified as ssl, and the rule does not match. Consequently, the traffic falls through to a subsequent deny rule. To resolve this, the administrator should add the ssl application to the allow rule or create a separate rule for HTTPS. This ensures that both HTTP and HTTPS traffic are permitted as intended.

Answer

The action is set to 'allow', but the rule is placed below a deny rule.

Answer

The destination zone is set to Untrust, but the web server is in the DMZ zone.

Answer

The source IP address in the allow rule is set to 'any', which does not match the user's IP address.

Question 6

A network security administrator at a manufacturing company configures a Security policy rule on a Palo Alto Networks firewall to allow traffic from the Trust zone to the Untrust zone. The rule specifies 'application: any' and 'service: application-default'. Users report that some business-critical applications, such as a custom database application using TCP port 1521, are being blocked. The administrator wants to allow these applications while maintaining strict security. What is the most likely cause of the block?

Accepted Answer

The 'service: application-default' setting allows only the default ports for each application; since the custom application uses a non-standard port (1521), it is not permitted.. The service setting 'application-default' restricts traffic to the default ports defined for each application. A custom database application using TCP port 1521 is not a predefined application with that port, so it is blocked. To resolve, the administrator can create a custom application with the correct port and reference it in the rule, or change the service to 'any' or a specific service object. This maintains security by explicitly allowing only the required port.

Answer

The 'application: any' setting blocks all applications that are not explicitly allowed; the administrator must specify the custom application in the rule.

Answer

The firewall requires a Security profile to be attached to the rule to allow custom applications; without it, all non-standard traffic is blocked.

Answer

The 'application: any' setting only allows applications that are recognized by the firewall's App-ID engine, and the custom database application is not recognized, so it is blocked.

Question 7

A security administrator is configuring a Palo Alto Networks firewall to secure traffic between an internal zone and an external zone. The administrator wants to implement Security profiles to protect against threats. Which two Security profile types can be attached to a Security policy rule to inspect traffic for threats? (Choose two.)

Accepted Answer

Antivirus. The two Security profile types that can be attached to a Security policy rule for threat inspection are Antivirus and Anti-Spyware. These profiles are part of the standard set of Security profiles in PAN-OS, along with Vulnerability Protection, URL Filtering, and File Blocking. Attaching them to a rule enables inspection of allowed traffic for viruses and spyware, respectively. QoS and Decryption are not Security profiles; QoS manages bandwidth, and Decryption is configured via Decryption policy.

Answer

Quality of Service (QoS)

Answer

Decryption

Answer

URL Filtering

Question 8

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.

Question 9

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 10

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 11

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Accepted Answer

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.. To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Answer

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Answer

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Answer

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Question 12

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 13

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

SSL Inbound Inspection. SSL Inbound Inspection (C) is a valid decryption method: the firewall is configured with the server's certificate and private key so it can decrypt traffic destined to an internal server, which is the standard approach for protecting inbound connections to your own web servers. SSL Forward Proxy (E) is also valid: the firewall acts as a man-in-the-middle, generating a forged certificate signed by a trusted CA and decrypting outbound client-initiated SSL/TLS sessions to inspect them. The other options are not decryption methods for SSL/TLS: IPsec Decryption (A) applies to IPsec VPN traffic, not SSL/TLS; SSH Proxy (B) is for controlling SSH sessions, not decrypting SSL/TLS; and Decryption Mirror (D) is a feature for copying decrypted traffic to a destination for analysis, not a method to decrypt SSL/TLS itself.

Answer

IPsec Decryption

Answer

SSH Proxy

Answer

Decryption Mirror

Question 14

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Accepted Answer

A rule with a broader match exists above the blocking rule in the rulebase.. In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Answer

The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

Answer

The custom object containing the malicious IP was not committed.

Answer

The device clock is out of sync, causing time-based rules to fail.

Question 15

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Accepted Answer

Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.. Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Answer

Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.

Answer

Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.

Answer

Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.