PCNSA Securing Traffic — Timed 20 Questions

Question 1

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Accepted Answer

Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.. When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Answer

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Answer

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Answer

The security policy uses an incorrect service object that doesn't match the application.

Question 2

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Accepted Answer

DNS Security profile. DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 3

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Accepted Answer

The virtual router does not have a default route to the external network.. The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Answer

A zone protection profile is blocking ICMP packets.

Answer

The decryption policy is blocking the traffic because it is not decrypted.

Answer

The NAT policy is missing for the outbound traffic.

Question 4

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Accepted Answer

Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action. Option D is correct because a security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Answer

Source Zone, Destination Zone, Application, and User

Answer

Source Zone, Destination Zone, Application, and Service

Answer

Source Zone, Destination Zone, Service, and Action

Question 5

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Accepted Answer

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.. To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Answer

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Answer

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Answer

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Question 6

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Accepted Answer

Enable DNS Security on the outbound DNS traffic.. Option A is correct because DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Answer

Allow all TCP traffic on port 53.

Answer

Enable logging on all DNS traffic for analysis.

Answer

Block all UDP traffic on port 53.

Question 7

Which THREE are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

SSH Proxy. SSH Proxy is a valid method for decrypting SSL/TLS traffic on a Palo Alto Networks firewall because it allows the firewall to act as a man-in-the-middle for SSH connections, decrypting the SSH tunnel to inspect the encapsulated traffic. This is distinct from SSL/TLS decryption but is grouped under the same decryption feature set for inspecting encrypted protocols.

Answer

IPsec Decryption

Answer

Decryption Mirror

Question 8

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Accepted Answer

The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.. Option A is correct because the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.

Answer

The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.

Answer

The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.

Answer

The firewall has insufficient memory to process URL lookups and is dropping packets.

Question 9

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Accepted Answer

A rule with a broader match exists above the blocking rule in the rulebase.. In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Answer

The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

Answer

The custom object containing the malicious IP was not committed.

Answer

The device clock is out of sync, causing time-based rules to fail.

Question 10

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Accepted Answer

Set the rule action to 'allow'.. Option B is correct because setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Answer

Set the rule action to 'reset-both'.

Answer

Set the rule action to 'deny'.

Answer

Enable 'Log at Session Start' in the rule.

Question 11

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Accepted Answer

Rule 1 (allow-web). Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Answer

Rule 3 (allow-dns)

Answer

Rule 2 (block-malware)

Answer

No rule matches; traffic is denied by default.

Question 12

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Question 13

Match each PAN-OS component to its role.

Question 14

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Accepted Answer

Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.. Option A is correct because using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad. Option D allows all traffic.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.

Answer

Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.

Question 15

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Accepted Answer

SSL Decryption with a dedicated decryption broker.. Option C is correct because the decryption broker offloads decryption to a dedicated appliance. Option A is decryption mirroring, not offloading. Option B is just a protocol version. Option D is port mirroring, not decryption offloading.

Answer

SSL Forward Proxy with decryption mirroring.

Answer

Decryption port mirroring.

Answer

TLS 1.3 decryption.

Question 16

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Accepted Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.. Option D is correct because rules are evaluated top-down; the deny rule must come before the allow rule to block the targeted users. Option A lacks user-ID. Option B order is wrong. Option C places deny after allow, so it will never be hit.

Answer

Create an allow rule for all users, then a deny rule for HR with application social-media.

Answer

Create a deny rule for the HR user group with application social-media before the allow rule.

Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.

Question 17

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. Option B is correct because a security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 18

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Option A is correct because Dynamic IP and Port (DIPP) allows many internal IPs to share a pool of public IPs using port address translation. Option B is for static 1-to-1 mapping. Option C is for inbound traffic. Option D is for two-way NAT.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 19

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. Option C is correct because ensuring App-ID updates are current and using application identification enhancements (like application override when needed) improves accuracy. Option A may help but not directly address misidentification. Option B is possible but not first step. Option D is regressive.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.

Question 20

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Accepted Answer

Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.. Option D is correct because creating a security rule with source zone, source IP, and action deny placed at the top of the rulebase is the direct and simplest method. Option A lacks source zone. Options B and C are more complex and intended for different purposes.

Answer

Use a Zone Protection profile to block the IP.

Answer

Create a security rule with source IP address and action deny.

Answer

Use a DoS protection policy to block the IP.