PCNSA Securing Traffic Practice Test 5 — 15 Questions

Question 1

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule order is incorrect; the allow rule is below the 'Deny All' rule.. In Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Answer

The application 'web-browsing' is not being properly identified by App-ID.

Answer

The source address object for the allow rule is misconfigured with a wrong subnet mask.

Answer

The User-ID agent is overriding the allow rule and triggering a block action.

Question 2

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Accepted Answer

The log forwarding profile is not configured to forward logs for denied sessions.. In PAN-OS, log forwarding profiles have a separate checkbox for 'Denied Sessions' under the Traffic log type. Even if the profile includes the 'traffic' log type, denied traffic logs will not be forwarded unless this option is explicitly enabled. Since the SIEM receives allowed traffic logs but not denied ones, the most likely cause is that the profile is not configured to forward logs for denied sessions.

Answer

The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

Answer

The firewall is logging only at session end and the deny sessions are not completing.

Answer

The SIEM is not configured to receive syslog messages for deny actions.

Question 3

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Define separate security zones for Engineering and Finance.. Option B is correct because defining separate security zones for Engineering and Finance is the foundational step for segmenting internal traffic; zones are the logical containers that security rules reference, so distinct zones allow you to control and inspect traffic flowing between the two departments. Option E is correct because, once inter-zone rules exist between the Engineering and Finance zones, attaching Threat Prevention profiles (which bundle Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering) to those rules enforces the required threat inspection on that east-west traffic. Option A is incorrect because NAT policies only translate addresses for routing or hiding purposes and do not segment traffic or apply threat prevention. Option C is incorrect because a single security zone for all internal traffic collapses the segmentation boundary, preventing distinct inter-zone policy enforcement. Option D is incorrect because QoS policies manage bandwidth and prioritization, not segmentation or threat prevention.

Answer

Configure NAT policies to translate internal addresses.

Answer

Create a single security zone for all internal traffic.

Answer

Enable QoS policies between the zones.

Question 4

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

Accepted Answer

Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.. The traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Answer

Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.

Answer

Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.

Answer

Modify the rule to use application 'any' to allow all applications.

Question 5

A security administrator at a hospital needs to allow clinicians to access a cloud-based electronic health record (EHR) system at ehr.example.com. The firewall must inspect the traffic for threats, but the EHR vendor requires that the firewall not decrypt the traffic due to strict patient data privacy regulations. Which Security policy rule configuration should the administrator implement?

Accepted Answer

Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to no-decrypt, and create a Security policy rule that allows the application ssl and attaches the appropriate Security profiles.. The correct solution uses a Decryption policy rule with the no-decrypt action to exempt ehr.example.com from SSL decryption, honoring the privacy requirement. A separate Security policy rule allows the application ssl and applies Security profiles, ensuring threat inspection still occurs on the encrypted traffic. This two-policy approach is the standard method to selectively bypass decryption while maintaining security enforcement.

Answer

Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to decrypt, and create a Security policy rule that allows the application ssl without any Security profiles.

Answer

Create a Security policy rule that allows the application ssl, with the action allow, and attach a Decryption profile set to no-decrypt for the EHR server certificate.

Answer

Create a Security policy rule that allows the application ssl, with the action allow, and attach a URL Filtering profile that blocks the healthcare category.

Question 6

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal users and the internet. The security team wants to enforce different security profiles based on the destination country of outbound traffic. They have created a Security policy rule that allows web-browsing and ssl from the trust zone to the untrust zone. They now need to apply a URL Filtering profile that blocks malicious sites only when the destination IP is geolocated in a specific high-risk country. What should the administrator configure to achieve this?

Accepted Answer

Create a new Security policy rule above the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.. The correct configuration creates a new Security policy rule with a destination region match for the high-risk country, placed above the existing rule. This ensures that traffic to that country is evaluated first and receives the URL Filtering profile, while other traffic continues to be handled by the original rule. This leverages geolocation objects and rule ordering to apply security profiles conditionally.

Answer

Modify the existing Security policy rule to include a destination region object for the high-risk country and attach the URL Filtering profile.

Answer

Create a new Security policy rule below the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.

Answer

In the Security policy rule, add a source region object for the high-risk country and attach the URL Filtering profile.

Question 7

An administrator needs to allow DNS traffic from the Trust zone to the Untrust zone. The security policy rule uses the application 'dns' and service 'application-default'. Which port will be allowed by default?

Accepted Answer

TCP and UDP port 53. The 'dns' application in Palo Alto Networks firewalls uses both TCP and UDP port 53. When 'application-default' is selected, the firewall automatically allows these ports. This ensures that DNS queries, responses, and zone transfers function properly without manual service definition.

Answer

TCP port 53 only

Answer

UDP port 53 only

Answer

TCP port 853

Question 8

An administrator wants to block all peer-to-peer (P2P) file sharing applications while allowing other traffic. Which security policy action should be used to achieve this?

Accepted Answer

Create a rule that denies the 'p2p' application group and place it above the allow rules.. To block P2P applications, create a security policy rule with the action 'deny' and specify the 'p2p' application group. Place this rule above any allow rules that permit general internet traffic. This ensures P2P is blocked while other applications are allowed. Rule order is critical because the firewall evaluates rules top-down.

Answer

Create a rule that allows all applications except P2P, using the 'negate' option for the application.

Answer

Use an application filter that excludes P2P applications in the allow rule.

Answer

Configure a URL filtering profile that blocks P2P websites and apply it to the allow rule.

Question 9

A network security administrator is configuring a security policy rule to allow DNS traffic from the Trust zone to the Untrust zone. The rule uses application dns and service application-default. Users report that DNS queries to external servers are failing. The administrator notices that the firewall is allowing the DNS queries but the responses are being dropped. What is the most likely cause?

Accepted Answer

The DNS responses are being dropped due to asymmetric routing where the response takes a different path and the firewall does not see the return traffic.. Stateful firewalls require that return traffic for a session traverse the same firewall. If DNS responses take a different path (asymmetric routing), the firewall does not recognize them as part of an existing session and drops them. This is a frequent cause of DNS failures when multiple paths exist. Ensuring symmetric routing or using NAT can resolve the issue.

Answer

The return traffic is being dropped because the security policy rule does not allow the dns application in the reverse direction.

Answer

The firewall is performing DNS sinkholing and dropping the responses.

Answer

The security policy rule does not allow the dns-base application.

Question 10

A security administrator needs to create a policy that allows users in the 'trust' zone to access the internet, but blocks access to a specific set of known malicious URLs. The administrator has subscribed to a URL filtering service and wants to use a custom URL category to block the malicious sites. Which configuration should be used?

Accepted Answer

Create a custom URL category containing the malicious URLs, then create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the custom category.. To block specific malicious URLs while allowing general internet access, the administrator should create a custom URL category with those URLs and apply a URL filtering profile that blocks that category. The security policy rule must allow web-browsing so that traffic is permitted and then inspected by the URL filtering profile. This ensures that only the listed malicious URLs are blocked, while all other web traffic is allowed.

Answer

Create a custom URL category containing the malicious URLs, then create a security policy rule that denies web-browsing and applies a URL filtering profile that allows the custom category.

Answer

Create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.

Answer

Create a security policy rule that denies web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.

Question 11

A security administrator has configured a security policy rule to allow SSH from the Trust zone to the Untrust zone. The rule uses the application 'ssh' and the service 'application-default'. Users report that SSH connections to external servers on port 2222 are failing, while SSH on port 22 works. What is the most likely cause of the failure?

Accepted Answer

The service 'application-default' only allows the default port for the application, so port 2222 is blocked.. The service 'application-default' restricts traffic to the default ports of the selected applications. For SSH, the default port is 22, so connections on port 2222 are blocked. To allow SSH on a non-standard port, the administrator must either set the service to 'any' or create a custom service for port 2222 and apply it to the rule. This ensures that the firewall permits the traffic on the desired port while still identifying it as SSH.

Answer

The application 'ssh' does not support non-standard ports; a custom application must be created.

Answer

The application 'ssh' is not included in the rule's application list; instead, 'any' is used.

Answer

The security policy rule is missing a URL filtering profile to allow SSH on port 2222.

Question 12

An administrator has configured a security policy rule to allow traffic from the 'trust' zone to the 'untrust' zone with application 'any' and service 'any'. The administrator wants to ensure that the firewall logs all allowed traffic, but notices that not all sessions are being logged. What is the most likely reason?

Accepted Answer

The security policy rule is not matching all traffic because it is placed after a more specific rule that denies or allows traffic without logging.. The most likely reason for not all allowed sessions being logged is that another rule earlier in the rulebase is matching some traffic and either has logging disabled or is a deny rule. The 'any/any' rule only logs sessions that it processes. If a more specific rule above it handles certain traffic without logging, those sessions will not appear in the logs. Therefore, reviewing rule order and logging settings is necessary to ensure all allowed traffic is logged.

Answer

The security policy rule does not have 'Log at Session End' enabled.

Answer

The firewall is not configured to log at session start, and some sessions are not being logged because they are not completing.

Answer

The firewall's log storage is full, causing new logs to be dropped.

Question 13

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal zones. The security team wants to ensure that all traffic from the Users zone to the Servers zone is inspected for threats, but they also need to allow specific applications that use non-standard ports. They create a Security policy rule with 'application: any' and 'service: any', and attach a Vulnerability Protection profile. However, they notice that some traffic is not being inspected because it is being allowed by a more specific rule higher in the rulebase that allows only web-browsing and ssl. What should the administrator do to ensure all traffic is inspected?

Accepted Answer

Move the rule with 'application: any' and 'service: any' above the more specific rule in the rulebase.. Security policy rules are processed in order, and the first matching rule determines the action and profiles applied. The more specific rule allowing web-browsing and ssl is matched before the broader rule with 'any' application and the Vulnerability Protection profile. To ensure all traffic is inspected, the administrator must move the broader rule with the inspection profile above the specific rule. This way, all traffic from Users to Servers is matched by the inspection rule first, and threat inspection is applied.

Answer

Create a new rule at the top of the rulebase that denies all traffic from Users to Servers, forcing traffic to be inspected by the next rule.

Answer

Enable 'Log at Session Start' on the more specific rule to ensure inspection occurs.

Answer

Modify the more specific rule to include 'application: any' and attach the same Vulnerability Protection profile.

Question 14

A network administrator is configuring a Security policy rule on a Palo Alto Networks firewall to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule only allows HTTP traffic on its default port. Which service setting should be used?

Accepted Answer

application-default. The 'application-default' service setting is the correct choice because it allows traffic only on the default ports defined for the selected application. For HTTP, the default port is TCP 80. This setting ensures that the rule permits HTTP only on its standard port, aligning with least privilege. It also automatically updates if application definitions change, reducing administrative overhead. Using 'any' would be too permissive, while specific service objects like TCP-80 are static and less flexible.

Answer

service-http

Answer

any

Answer

TCP-80

Question 15

A company uses a Palo Alto Networks firewall to secure outbound internet access. The security team wants to ensure that users cannot access malicious websites. They have configured a URL Filtering profile with the 'malware' category set to 'block' and attached it to a Security policy rule that allows web-browsing. However, users report that they can still access some known malicious sites that are categorized as 'malware'. What is the most likely reason?

Accepted Answer

The 'malware' category is set to 'block', but the site is using HTTPS and the firewall is not decrypting traffic, so the URL Filtering profile cannot inspect the URL.. URL Filtering can only block based on URL categories if the firewall can see the full URL. For HTTPS traffic, the URL is encrypted within the TLS session, so without SSL decryption, the firewall cannot inspect the URL and thus cannot enforce URL Filtering for those sites. The most likely reason users can access malicious HTTPS sites is that SSL decryption is not enabled. Enabling SSL Forward Proxy decryption would allow the firewall to see the URL and apply the URL Filtering profile correctly.

Answer

The URL Filtering profile is attached to the wrong Security policy rule; there is a more specific rule above that allows the traffic without URL Filtering.

Answer

The URL Filtering profile is not applied because the Security policy rule does not have the correct source and destination zones.

Answer

The URL Filtering profile is configured to block the 'malware' category, but the firewall's URL database is outdated and does not contain those sites.