PCNSA Policy Evaluation and Management Practice Test 2 — 15 Questions

Question 1

Which TWO factors affect the order in which security rules are evaluated?

Accepted Answer

Whether the rule is intra-zone or inter-zone.. Correct: C and D. Security rules are evaluated in a specific order: first, intra-zone rules are evaluated separately from inter-zone rules, and within each zone type, rules are evaluated from top to bottom based on their position in the rulebase. Therefore, both the rule's zone type (intra-zone vs inter-zone) and its position (top-down) affect evaluation order. A is incorrect because the application does not determine evaluation order; it is a match criterion. B is incorrect because rule hit count is a statistic, not a factor in ordering. E is incorrect because the action (allow or deny) does not affect the order of evaluation.

Answer

Application used in the rule.

Answer

Rule hit count.

Answer

Rule action (allow or deny).

Question 2

Which THREE are valid methods to test security policy effectiveness before deployment?

Accepted Answer

Check rule hit counts after applying the policy to a small subset of users.. Option A is correct because applying the policy to a small subset of users and then checking rule hit counts provides real-world evidence of which rules are matching traffic, revealing overly broad, shadowed, or unused rules before full rollout. Option D is correct because deploying the policy in a lab environment and reviewing traffic logs lets you validate rule behavior, ordering, and logging against representative traffic without impacting production. Option E is correct because the Policy Tester tool in the web interface simulates how traffic would be evaluated against the policy, showing which rule would match and the resulting action without enforcing it. Option B is not a valid test method because disabling the policy and monitoring traffic only shows unfiltered traffic and does not evaluate the policy's effectiveness. Option C is not a valid test method by itself because packet capture analyzes traffic but does not exercise or evaluate the policy rules.

Answer

Disable the policy and monitor traffic.

Answer

Use packet capture (PCAP) to analyze traffic.

Question 3

Refer to the exhibit. The administrator wants to remove unused rules to improve performance. Which rule should be removed?

Accepted Answer

deny-ssh. The deny-ssh rule is the one to remove because it is unused; the exhibit shows no SSH traffic matching it, so it adds no security value and only consumes rulebase processing. Removing unused rules improves performance and simplifies the policy. The other rules are either actively matching traffic or serve as a necessary default deny.

Answer

deny-all

Answer

allow-dns

Answer

allow-web

Question 4

Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?

Accepted Answer

Deny. In Palo Alto Networks security policy, rules are evaluated top-down and the first match wins. The exhibit (not shown but implied) indicates that the Sales-to-Finance rule for destination 10.10.10.10 with application 'ssl' is configured with a Deny action, or a higher-priority rule denies it. Since the question states the traffic reaches the destination using application 'ssl' and the correct answer is Deny, the matching rule's action is deny, and the firewall drops the session.

Answer

The firewall will continue to the next rule

Answer

Allow

Answer

Allow only if no security profile blocks it

Question 5

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Accepted Answer

rule 2 (allow-dns). The DNS traffic from the trust zone to the untrust zone will match rule 2 (allow-dns) because that rule is specifically configured to permit DNS traffic between these zones. Security policies are evaluated top-down, and rule 2 explicitly allows DNS, so it takes precedence over the deny-all rule. Rule 1 (allow-http) does not match because the traffic is DNS, not HTTP.

Answer

No rule will match

Answer

rule 3 (deny-all)

Answer

rule 1 (allow-http)

Question 6

An administrator notices that traffic from a specific IP 10.10.10.5 is not matching the expected security rule that should allow HTTP traffic. The rule uses a source address object defined as '10.10.10.0/24'. Upon investigation, the administrator finds that the traffic is from IP 10.10.10.5, but the rule still does not match. What is the most likely cause?

Accepted Answer

The source address object is defined with a netmask of /32 instead of /24.. The address object uses a /24 netmask, so it should include .5. However, the object might have been defined with a wrong netmask or the rule is not using the object correctly. In this scenario, the issue is that the address object was accidentally set to /32, which matches only .0.

Answer

The traffic is being decrypted by a decryption policy before reaching the security rule.

Answer

The rule's source zone is set to 'DMZ' instead of 'Internal'.

Answer

A rule above this rule shadows it, blocking the traffic before evaluation.

Question 7

An administrator wants to require users in the Internal zone to authenticate via User-ID before accessing the Internet. Which policy configuration is necessary to enforce this requirement?

Accepted Answer

Configure a security rule with a user-id condition set to 'known-user' and action 'allow' with 'require authentication' selected.. To require users in the Internal zone to authenticate via User-ID before accessing the Internet, you must configure a security rule that includes a User-ID condition (e.g., 'known-user') and set the action to allow with 'require authentication' selected. This forces the firewall to prompt for authentication if the user is not already known, and only allows access once the user is authenticated. This is the correct policy configuration in PAN-OS.

Answer

Create an authentication policy that maps users to roles.

Answer

Configure a captive portal on the firewall to prompt for credentials.

Answer

Enable User-ID on the Internal zone under Zone properties.

Question 8

A network administrator is tasked with implementing a policy that allows traffic from the 'Sales' zone to the 'Internet' zone only for web-browsing (application: web-browsing) and blocks all other traffic. The administrator creates a rule at the top of the security policy with source zone Sales, destination zone Internet, application web-browsing, action allow. Below that, a rule with source zone Sales, destination zone Internet, application any, action deny. After committing, users in Sales can browse the web normally. However, the administrator discovers that some users are able to use applications like YouTube and Facebook which use web-browsing as part of their app-id. The administrator wants to ensure that only HTTP/HTTPS traffic for general web browsing is allowed, not other web-based applications. What should the administrator do?

Accepted Answer

Use URL filtering to block the social networking and streaming media categories.. App-ID 'web-browsing' is a broad application signature that encompasses HTTP/HTTPS traffic used by many web-based applications, including YouTube and Facebook, which tunnel over the same ports and protocols. Because the allow rule matches on App-ID 'web-browsing', PAN-OS permits any session that the decoder identifies as web-browsing, including those belonging to social media and streaming apps. To restrict users to general browsing only, the administrator must layer URL Filtering on top of the App-ID allow rule to block the social-networking and streaming-media URL categories.

Answer

Change the allow rule's application to include only HTTP and HTTPS.

Answer

Add a custom application filter to block social media applications.

Answer

Change the deny rule to block social media applications.

Question 9

An administrator has configured multiple security rules for a data center. There is a rule that allows SSH from the 'Management' zone to the 'Server' zone. Recently, the administrator added a new rule allowing SSH from a new 'Admin' zone to the 'Server' zone. The Admin rule is placed above the Management rule. Both rules specify the correct zones, application SSH, and action allow. After committing, SSH traffic from the Admin zone is being denied. What is the most likely issue?

Accepted Answer

There is a deny rule placed above the new Admin rule that matches the Admin zone traffic.. Palo Alto Networks firewalls evaluate security rules top-down and stop at the first match, so a deny rule positioned above the new Admin-to-Server SSH allow rule will match the Admin zone traffic first and drop it before the allow rule is ever evaluated. Since the Admin rule itself is correctly configured (zones, application SSH, action allow), the only explanation consistent with the symptom is a higher-priority deny rule intercepting the traffic. This is a classic rule-order/shadowing problem in PAN-OS policy evaluation.

Answer

The Admin rule has a typo in the destination address, causing it to not match the server.

Answer

The Management rule is shadowing the Admin rule due to overlapping conditions.

Answer

The Admin zone is not associated with the correct virtual router.

Question 10

Which TWO are required to configure a Forward Proxy Decryption rule?

Accepted Answer

A Certificate. A Forward Proxy Decryption rule requires a Certificate (option A) because the firewall must present its own certificate to the client and use it to re-sign (re-encrypt) the traffic after inspection, establishing the SSL/TLS session with the internal user. It also requires a Decryption Profile (option B), which defines the SSL protocol settings, cipher suites, and actions such as blocking expired certificates, untrusted issuers, or unsupported versions during the forward proxy inspection. Destination Zone (C), Source Zone (D), and URL Category (E) are not mandatory fields for configuring a Forward Proxy Decryption rule; while source/destination zones may appear in some decryption rule contexts, they are not the two required elements, and URL Category is an optional matching criterion rather than a required configuration component.

Answer

A Destination Zone

Answer

A Source Zone

Answer

A URL Category

Question 11

A user from 10.0.0.5 tries to access 8.8.8.8 on TCP 443. The traffic is matched to the above rule. Which additional configuration is required for the traffic to be decrypted?

Accepted Answer

Both a Decryption policy rule and a Decryption Profile. For traffic to be decrypted, a Decryption policy rule must explicitly match the traffic and a Decryption Profile with SSL Forward Proxy enabled must be applied. The rule alone only identifies traffic for potential decryption; the profile defines the decryption method (e.g., SSL Forward Proxy) and controls certificate handling. Without both, the firewall will not perform decryption even if the security rule allows the traffic.

Answer

A Decryption policy rule matching the same traffic

Answer

An SSL Forward Proxy certificate installed

Answer

A Decryption Profile with SSL Forward Proxy enabled

Question 12

A company has multiple branch offices connected via IPsec tunnels to a central datacenter. The central datacenter has a PA-5250 running PAN-OS 10.1. The security team wants to enforce that traffic between branches is inspected by the central firewall, not directly between branches. They configure security policies to allow inter-branch traffic through the central firewall. However, they notice that traffic between two branches (Branch A and Branch B) is not traversing the central firewall and is instead going directly between the branches via the IPsec tunnels which are configured as route-based VPNs. The security team has verified that the security policies are correctly configured to require the traffic to go through the central datacenter. What is the most likely cause?

Accepted Answer

The route-based VPN tunnels are using static routes that are more specific than the routes advertised by the central firewall.. The most likely cause is that the route-based VPN tunnels between branches use static routes with a more specific prefix (e.g., /24) than the routes advertised by the central firewall (e.g., /16). In route-based VPNs, the firewall makes forwarding decisions based on the routing table; more specific routes have a higher priority regardless of administrative distance or metric. Therefore, Branch A's traffic destined for Branch B matches the more specific static route pointing directly to Branch B's IPsec tunnel, bypassing the central firewall despite security policies requiring inspection.

Answer

The IPsec tunnel between branches is configured with a higher metric than the tunnel to the central firewall.

Answer

The security policy rules are not in the correct order; a rule allowing direct traffic is matched first.

Answer

The route-based VPN tunnels between branches are in the same virtual router and have a higher administrative distance than the central tunnel, causing a routing loop.

Question 13

An administrator needs to ensure that security rules referencing objects such as address groups and service groups always contain the most current members when the policy is evaluated. The firewall is running PAN-OS 10.1. Which configuration setting should the administrator verify?

Accepted Answer

The address group is configured as a dynamic address group with a tag-based filter and the firewall is registered with User-ID and an external dynamic list source.. Dynamic address groups use tag-based filters that are evaluated at policy evaluation time, so the firewall always uses the current set of IP addresses that match the tags. This avoids manual updates and ensures the rule reflects the latest membership. The correct configuration is a dynamic address group with the appropriate filter, not a static group or an external dynamic list used as a source.

Answer

The security rule is configured with a static address group instead of a dynamic address group.

Answer

The security rule is placed below a rule that uses the same address group to ensure policy order.

Answer

The security rule references an external dynamic list in the source field instead of an address group.

Question 14

A network security administrator is configuring a Palo Alto Networks firewall with a security policy that allows traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that only web browsing (HTTP and HTTPS) is permitted, while all other applications are blocked. However, after committing the policy, users report that they can still access FTP sites. The administrator verifies that the policy includes an application filter set to 'web-browsing' and 'ssl', and the action is set to allow. What is the most likely reason that FTP traffic is still allowed?

Accepted Answer

The security policy rule has the application set to 'any' instead of using the application filter.. The most likely reason FTP traffic is still allowed is that the security policy rule has the application field set to 'any' instead of using the application filter. When the application is 'any', the rule matches all applications, including FTP, regardless of any application filter settings. The administrator must set the application to the specific filter or applications to enforce the restriction. This is a common oversight in policy configuration.

Answer

The application filter is configured to allow 'web-browsing' and 'ssl', but FTP is being tunneled over HTTP or HTTPS.

Answer

The security policy rule is not matching the FTP traffic because the application filter is not applied correctly.

Answer

The firewall is not licensed for App-ID, so application filters are ignored and all traffic is allowed.

Question 15

A network security administrator needs to allow users in the 'Trust' zone to access web servers in the 'DMZ' zone using HTTP and HTTPS. The administrator wants to log all allowed sessions for auditing. Which configuration step is required to meet this requirement?

Accepted Answer

Create a security rule allowing the 'web-browsing' and 'ssl' applications from Trust to DMZ, and enable logging at session end.. Palo Alto Networks firewalls use App-ID, so the correct approach is to allow the applications 'web-browsing' and 'ssl'. Enabling logging at session end provides a complete record of each allowed session for auditing. This combination ensures both security and compliance with logging requirements.

Answer

Create a security rule allowing the 'http' and 'https' applications from Trust to DMZ, and enable logging at session end.

Answer

Create a security rule allowing the 'web-browsing' and 'ssl' applications from Trust to DMZ, and enable logging at session start.

Answer

Create a security rule allowing TCP ports 80 and 443 from Trust to DMZ, and enable logging at session start.