PCNSA Policy Evaluation and Management — 30 Questions

Question 1

A security administrator is troubleshooting a policy misconfiguration. The firewall is configured with a security rule that allows traffic from the 'Engineering' zone to the 'Servers' zone. However, traffic from an Engineering user to a server in the 'DMZ' zone is being denied. What is the most likely cause?

Accepted Answer

The rule only allows traffic from Engineering to Servers zone, not DMZ.. The security rule explicitly permits traffic from the 'Engineering' zone to the 'Servers' zone. Traffic destined to the 'DMZ' zone is a different zone, so the rule does not apply. By default, Palo Alto Networks firewalls enforce a deny-all policy for any traffic that does not match an explicit allow rule, which is why the traffic is denied.

Answer

The rule is configured as an intrazone rule.

Answer

The rule is disabled in the rulebase.

Answer

SSL decryption is blocking the traffic.

Question 2

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Accepted Answer

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.. Option A is correct because it uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

Answer

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Answer

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Answer

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Question 3

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Accepted Answer

The rule is positioned below an allow rule that matches the same traffic.. Option C is correct because the Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

Answer

The source IP is negated in the rule.

Answer

The rule is placed at the top of the rulebase and overridden by a later rule.

Answer

The rule is disabled in the rulebase.

Question 4

An organization has a security policy that requires all outbound HTTP traffic from the 'Corporate' zone to the 'Internet' zone to be inspected by the URL Filtering profile. However, the administrator notices that some users can still access blocked categories. What is the most likely cause?

Accepted Answer

The URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories.. Option D is correct because if the URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories, the firewall will log the violation but still allow the traffic to pass. This means users can access blocked categories even though the rule is correctly applied, as the profile does not enforce a blocking action.

Answer

The firewall is configured to use DNS sinkholing, which bypasses URL filtering.

Answer

The rule is placed too low in the rulebase and a higher rule allows traffic without URL filtering.

Answer

The rule uses a source zone of 'Corporate' but the users are in a different zone.

Question 5

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Accepted Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.. Option B is correct because it uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Answer

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Question 6

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Use zone-based policies instead of IP-based policies whenever possible.. Option B is correct because zone-based policies reduce complexity and improve scalability by grouping interfaces into security zones, allowing policies to be applied based on traffic direction (e.g., from Trust to Untrust) rather than individual IP addresses. This aligns with Palo Alto Networks' best practice of using zones to simplify rule management and enhance security posture, as IP-based policies become unmanageable in dynamic environments.

Answer

Enable logging on all rules to ensure complete audit trails.

Answer

Sort rules alphabetically by name to simplify rulebase navigation.

Answer

Use service objects based on TCP/UDP ports to define application traffic.

Question 7

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. Option A is correct because the firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 8

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Accepted Answer

Deny the traffic because rule 2 matches and denies social-networking.. The firewall evaluates rules in order from top to bottom. Rule 2 explicitly denies the application 'social-networking', and since the user at 192.168.1.10 is attempting to access a social-networking site, rule 2 matches before any subsequent rule. Therefore, the traffic is denied. Option D is correct because rule 2 matches and denies the traffic.

Answer

Allow the traffic because rule 1 matches and allows all web traffic.

Answer

Allow the traffic because rule 3 allows all traffic.

Answer

Deny the traffic because no rule allows social-networking.

Question 9

A company has a Palo Alto Networks firewall in production. They recently configured a new security policy rule to allow outbound HTTPS traffic from the internal network (10.0.0.0/8) to the internet. The rule is placed after a block rule that denies all traffic from 10.0.0.0/8 to any external destination. After committing, users report that HTTPS access is still blocked. The administrator checks the firewall logs and sees that the traffic is being denied by the block rule. The administrator verifies the rule order: the new allow rule is at position 5, and the block rule is at position 3. The administrator also checks that the source zone (Trust) and destination zone (Untrust) are correct. What is the most likely cause of the issue?

Accepted Answer

The allow rule is placed below the block rule, so the block rule is evaluated first.. The Palo Alto Networks firewall evaluates security policy rules in sequential order from top to bottom. Since the block rule at position 3 is evaluated before the allow rule at position 5, traffic matching the block rule is denied immediately, and the allow rule is never reached. This is the most likely cause of the issue, as the rule order directly determines which rule is applied first.

Answer

There is a NAT policy that is interfering with the allow rule.

Answer

The allow rule has an incorrect application (e.g., ssl instead of web-browsing).

Answer

The allow rule has the wrong source address (e.g., 10.0.0.0/8 is correct).

Question 10

A security administrator notices that traffic from an internal user to a specific external web application is being blocked unexpectedly. The user's IP is 10.10.1.50 and the destination is 203.0.113.5 on port 443. The administrator has already verified that there is a security rule allowing the traffic. Which two logs should the administrator check first to diagnose the issue?

Accepted Answer

Check the Traffic log and the URL Filtering log.. Option A is correct because when a security rule explicitly allows traffic but the traffic is still blocked, the issue often lies in a secondary policy layer. The Traffic log will show whether the session was denied or allowed, and if allowed, the URL Filtering log can reveal that the destination URL was categorized as blocked by the URL filtering profile, even though the security rule permits the traffic. This is a common scenario where the security rule permits the session but a URL filtering profile applied to that rule blocks the specific web application.

Answer

Check the System log for configuration changes that might have added a rule.

Answer

Check the HIP Match log to see if the user's device lacks required security software.

Question 11

A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?

Accepted Answer

The traffic will be allowed because Rule1 matches before Rule2.. Option A is correct because Palo Alto Networks firewalls use first-match policy evaluation: the first rule that matches the traffic's source zone, destination zone, source/destination IP, application, and user determines the action. Since Rule1 (allow) appears before Rule2 (deny), traffic from Engineering to Servers matches Rule1 first and is allowed, regardless of later deny rules.

Answer

To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.

Answer

Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.

Answer

The firewall evaluates all rules and applies the most restrictive action (deny).

Question 12

Refer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?

Accepted Answer

Rule 2 (Allow-Any-Web). Rule 2 (Allow-Any-Web) is correct because it is a broad rule that permits HTTP (port 80) traffic from any source to any destination, which matches the user's attempt to browse to an external website. The traffic originates from the Sales subnet (10.10.1.50) and targets IP 203.0.113.50 on port 80, and since no more specific rule (like Rule 1) matches the destination, Rule 2 applies as the first general web access rule.

Answer

Rule 4 (Allow-DNS)

Answer

Rule 3 (Block-Restricted-Apps)

Answer

Rule 1 (Allow-Sales-to-App)

Question 13

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Question 14

Match each security rule type to its purpose.

Question 15

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Accepted Answer

A previous rule with a broader match is denying the traffic before reaching the permit rule.. Option B is correct because rule order matters; a previous rule with a broader match and deny action will block traffic before reaching the permit rule. Option A is wrong because the implicit deny is at the end, but rules above can deny. Option C is irrelevant; application override does not cause denial. Option D is about NAT, not denial.

Answer

The destination NAT is causing asymmetric routing.

Answer

The rule is too far down in the rulebase and a previous implicit deny is blocking.

Answer

The application override is misconfigured.

Question 16

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. Option D is correct because policy changes affect new sessions; existing sessions continue with old policy until timeout. Option A is false; commit finalizes the configuration. Option B is not related. Option C would affect all users, not some.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 17

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Option A is correct because application-ID allows granular control over applications, not just ports. Option B only uses port/protocol, not application. Option C is for path selection. Option D is for decryption.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 18

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. Option C is correct because the rule specifically allows web-browsing; if the traffic is classified as a different application, it won't match. Option A is not an issue; destination any is fine. Option B is not needed. Option D is false; log setting does not affect hit count.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 19

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Option C is correct because Policy Optimizer requires a valid support license. Options A, B, and D are not prerequisites.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 20

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Accepted Answer

The application ssl is not matching because HTTPS traffic may be classified as web-browsing.. Option A is correct; SSL is a VPN/encryption protocol, not HTTPS. HTTPS traffic is typically classified as web-browsing. Option B is wrong because service match works if port matches (TCP 443), but the application mismatch is the issue. Option C should match. Option D is not needed.

Answer

The action should be 'allow with security profile'.

Answer

The service https requires TCP 443, but ssl application is used for encryption.

Answer

The destination address is a specific subnet but the user is accessing a host within that subnet.