PCNSA Securing Traffic Practice Test 3 — 15 Questions

Question 1

An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.. The firewall's CA certificate must be installed in the trusted root certificate store on client workstations; otherwise, the dynamically generated certificates for HTTPS sites will not be trusted, causing certificate errors. Option B is incorrect because the decryption policy does specify a certificate for forward proxy (typically the firewall's own CA certificate), so the issue is not a missing certificate in the policy. Option C is incorrect because the CRL (Certificate Revocation List) is used to check revocation status; not enabling it may allow revoked certificates but does not directly cause certificate trust errors. Option D is incorrect because the server certificate is presented by the web server during the TLS handshake and does not need to be pre-installed on clients; the client validates it against the trusted root store.

Answer

The decryption policy does not specify a certificate for forward proxy.

Answer

The CRL (Certificate Revocation List) is not enabled on the firewall.

Answer

The server certificate for each HTTPS site is missing from the client's certificate store.

Question 2

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

Accepted Answer

Ensure the application is identified by App-ID and that the correct application name is used.. If a security policy allows a specific application but traffic from that application is blocked, the most likely cause is that the application is not being correctly identified by App-ID. The administrator should first verify that the application is recognized by App-ID and that the correct application name is used in the rule. Option B is correct. Option A is wrong because zones being correct is necessary but not the first check if the application is allowed. Option C is wrong because the action is already allow; the issue is identification. Option D is wrong because rule order matters only if multiple rules match, but here the rule matches yet traffic is blocked, so identification is the primary concern.

Answer

Verify the source and destination zones are correct.

Answer

Confirm that the action is set to allow.

Answer

Check the order of security rules.

Question 3

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

Accepted Answer

Configure User-ID by integrating with Active Directory or using captive portal.. User-ID requires integration with Active Directory, a captive portal, or other user mapping methods to identify users for security policies. Option A is incorrect because SSL decryption is not required; user identification relies on mapping IP addresses to usernames, not decrypting credentials. Option C is incorrect because URL Filtering is used for categorizing web traffic, not for identifying users. Option D is incorrect because App-ID identifies applications, not users.

Answer

Deploy SSL decryption to see user credentials.

Answer

Enable URL Filtering to track user visits.

Answer

Activate App-ID to detect user login events.

Question 4

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Accepted Answer

Add a new allow rule above the deny rule that matches the specific traffic.. The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule. This is a standard method of creating an exception to a broader deny rule.

Answer

Create a single rule with both allow and deny actions based on source.

Answer

Place the specific servers in a different zone and create a new policy for that zone.

Answer

Modify the existing deny rule to allow all traffic.

Question 5

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

Accepted Answer

The profiles are set to 'alert' instead of 'block' for the critical threat categories.. If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight. Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Answer

The antivirus signatures are outdated.

Answer

The security profiles are not attached to any security rule.

Answer

The profile groups are applied in the wrong order.

Question 6

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

Accepted Answer

Source NAT (Outbound). Source NAT (Outbound). Source NAT translates the source IP address of internal hosts to a public IP address when traffic goes out to the Internet, effectively hiding internal IP addresses. Option B (Dynamic IP and Port) is a type of source NAT that also hides addresses, but it is a specific method, not the broad category. Option C (Destination NAT) translates destination IP addresses for inbound traffic, not outbound. Option D (Static NAT) provides a one-to-one mapping and does not hide the internal IP because the translation is fixed and often bidirectional.

Answer

Dynamic IP and Port (DIPP)

Answer

Destination NAT

Answer

Static NAT

Question 7

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

Accepted Answer

Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.. In Palo Alto firewalls, inter-vsys traffic is controlled by creating a security policy rule that specifies the source zone from vsys1 and the destination zone from vsys2 with action allow. This selectively permits traffic between specific virtual systems. Option A is incorrect because intra-vsys refers to traffic within the same vsys, not between different vsys. Option B is incorrect because there is no global 'inter-vsys' enable setting; inter-vsys traffic is governed by security policies. Option C is incorrect because inter-vsys traffic is not automatically allowed; it must be explicitly permitted via policy.

Answer

Configure intra-vsys security policy for each vsys and allow the traffic.

Answer

Enable inter-vsys traffic globally in the firewall settings.

Answer

Traffic between vsys is automatically allowed.

Question 8

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Accepted Answer

Captive Portal. Options A and E are correct. Captive Portal authenticates users directly by requiring them to log in, and User-ID Agent collects user-to-IP mappings from directory services like Active Directory. Option B (Kerberos Authentication) is a protocol used for authentication but not a dedicated User-ID method. Option C (LDAP Synchronization) is a method for synchronizing directory data, not for identifying users in real time. Option D (XML API) is an interface for configuration, not a standard User-ID identification method.

Answer

Kerberos Authentication

Answer

LDAP Synchronization

Answer

XML API

Question 9

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Accepted Answer

A root CA certificate installed in the trusted root store on client devices.. Options A, D, and E are correct. A root CA certificate installed on client devices is required so clients trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt. A decryption profile specifies the forward proxy certificate (CA certificate) used by the firewall. Option B is incorrect because the firewall does not need the private key of each destination server; it generates its own certificate for the session. Option C is incorrect because the server certificate is not required on clients for forward proxy decryption.

Answer

The private key of each destination server.

Answer

The server certificate for each destination server.

Question 10

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. The correct answers are A (File Blocking) and D (Antivirus). Antivirus blocks known malware by comparing files against signature databases. File Blocking prevents specific file types (e.g., executables, archives) from being transferred, which can stop malware delivery. URL Filtering (B) controls web access based on categories, not malware blocking. Anti-Spyware (C) targets spyware specifically, not all known malware. Vulnerability Protection (E) blocks exploit attempts, not malware files themselves.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 11

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

Accepted Answer

Rule 2: deny-all-from-trust-to-untrust (deny). The traffic is HTTPS, which uses the SSL application, not HTTP. Rule 1 only matches HTTP, so it does not match. Rule 2 is a deny-all rule that applies to all traffic from the trust zone to the untrust zone, so it matches and denies the HTTPS traffic. Rule 3 only matches DNS, and the implicit deny is not reached because Rule 2 explicitly denies the traffic. Therefore, the correct rule is Rule 2 (deny-all-from-trust-to-untrust).

Answer

Rule 1: allow-http-from-trust-to-untrust (allow)

Answer

Rule 3: allow-dns-from-trust-to-untrust (allow)

Answer

No rule matches; implicit deny will block the traffic.

Question 12

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

Accepted Answer

Rule 1: source-nat-1. Rule 1 matches first because the source 10.0.0.5 falls within the source range (10.0.0.0/8) and the destination 8.8.8.8 is not excluded by the exception rule (which only excludes 192.168.1.0/24). Therefore, Rule 1 is applied and performs source NAT to the interface IP. Option A is incorrect because Rule 2 is a no-NAT rule that would only apply if the destination matched 192.168.1.0/24, which it does not. Option B is incorrect because only the first matching rule is applied; NAT rules are processed in order. Option C is incorrect because Rule 1 does match.

Answer

Rule 2: no-nat-for-servers

Answer

Both rules are applied.

Answer

No NAT rule matches; traffic is not translated.

Question 13

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Accepted Answer

The client detected a certificate error and closed the connection.. The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection. Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Answer

The connection timed out.

Answer

The security policy blocked the traffic.

Answer

The web server sent a reset to the client.

Question 14

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

Accepted Answer

Create a decryption exclusion rule for financial and banking websites.. Excluding financial and banking websites from SSL decryption reduces the processing load on the firewall, alleviating performance degradation while still maintaining security for most outbound traffic. These websites typically use high-grade encryption and are trusted, so decryption is unnecessary and can cause performance issues. Option B is incorrect because increasing session timeouts does not reduce decryption processing overhead. Option C is incorrect because hardware SSL decryption offloading may not be supported on all models or may not fully address the performance impact of decrypting all traffic. Option D is incorrect because requiring only high-strength ciphers increases processing overhead, worsening performance.

Answer

Increase the session timeout values for decrypted traffic.

Answer

Enable hardware SSL decryption offloading on the firewall.

Answer

Change the decryption profile to require only high-strength ciphers.

Question 15

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

Accepted Answer

Consolidate rules using Security Profile Groups (SPGs) and broader application groups.. Consolidating rules using Security Profile Groups (SPGs) and broader application groups reduces rule count while maintaining visibility. SPGs allow multiple rules to share the same security profiles, reducing duplication, and application groups bundle related applications to minimize rule entries. Option A is incorrect as using default ports bypasses App-ID, losing application visibility. Option B is incorrect because converting to service objects removes application visibility and does not reduce rule count. Option D is incorrect; placing specific rules at the top does not reduce rule count—it only affects rule matching order.

Answer

Use only default ports for services to avoid creating service objects.

Answer

Convert all application-based rules to use service objects instead.

Answer

Place the most specific rules at the top of the rulebase.