PCNSA Policy Evaluation and Management Practice Test 2 — 15 Questions

Question 1

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A previous rule with a broader match is denying the traffic before reaching the permit rule.. In a firewall rulebase, rules are evaluated from top to bottom. If a previous rule with a broader match denies the traffic, it will be blocked before reaching the permit rule lower in the list. Option B is incorrect because the implicit deny is only at the end of the rulebase; there is no implicit deny earlier. Options A and D are unrelated to the scenario: asymmetric routing from destination NAT and misconfigured application override do not cause denial when a matching permit rule exists.

Answer

The destination NAT is causing asymmetric routing.

Answer

The rule is too far down in the rulebase and a previous implicit deny is blocking.

Answer

The application override is misconfigured.

Question 2

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. Firewall policy changes only affect new sessions. Existing sessions continue to use the old policy until they time out. This explains why some users (with existing sessions) may still be affected by the old policy, while new users (new sessions) experience the new policy. Option A is incorrect because an incorrect source zone would cause consistent issues for all traffic matching that rule, not just some users. Option B is unrelated to the commit process; interface type mismatch would cause connectivity issues regardless of session state. Option C is incorrect because a committed configuration is no longer in candidate state; if it were still candidate, the changes would not take effect at all.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 3

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Application-ID allows granular control over applications, not just ports. Option B is a decryption policy and does not control application access. Option C is a security policy with service only, which restricts based on port/protocol, not application. Option D is policy-based forwarding, used for path selection, not for blocking applications.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 4

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. The rule specifies application 'web-browsing', but the traffic may be classified as a different application (e.g., 'ssl' or 'http-proxy'), causing a mismatch. Even though the traffic uses port 80, the firewall identifies applications by signature, not just port. Option A is not necessary; the application does not need to be 'any' to match. Option C is false; the log setting does not affect whether the rule is hit. Option D is incorrect; a broad destination address (any) is not an issue.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 5

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Policy Optimizer requires a valid support license to access the cloud-based service that analyzes rules. Options A, C, and D are not prerequisites; Policy Optimizer can analyze any rule regardless of security profiles, logging settings, or hit count rank.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 6

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Accepted Answer

The application ssl is not matching because HTTPS traffic may be classified as web-browsing.. HTTPS traffic is typically classified as application 'web-browsing', not 'ssl'. The rule specifies application 'ssl', so the traffic does not match because the application mismatch occurs before the service check. Option B is incorrect because the action 'allow' is valid; security profiles are optional and do not affect rule matching. Option C is misleading: although service 'https' uses TCP 443, the application 'ssl' is for VPN/encryption, not HTTPS; the issue is the application mismatch, not the service. Option D is incorrect because the destination address '10.10.10.0/24' includes the host 10.10.10.5.

Answer

The action should be 'allow with security profile'.

Answer

The service https requires TCP 443, but ssl application is used for encryption.

Answer

The destination address is a specific subnet but the user is accessing a host within that subnet.

Question 7

What does a 'shadowed' rule mean in the context of policy evaluation?

Accepted Answer

A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.. A shadowed rule is one that is never evaluated because a previous rule with the same or broader match already matches the traffic. This occurs when a rule is redundant due to an earlier rule covering the same or a superset of conditions. Option B is incorrect because a rule at the bottom is still evaluated if no earlier rule matches. Option C is incorrect because a disabled rule is not the same as a shadowed rule. Option D is incorrect because a rule without an action would still be evaluated but would likely result in an error or default action, not shadowing.

Answer

A rule that is never hit because it is at the bottom of the rulebase.

Answer

A rule that is disabled.

Answer

A rule that matches traffic but has no action configured.

Question 8

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

Accepted Answer

Use the Policy Optimizer tool to view rule hit counts.. The Policy Optimizer tool in Palo Alto Networks firewalls provides rule hit counts, allowing administrators to quickly identify which security rules are not being used. Option A, 'show rulebase', displays the rulebase but does not show hit counts. Option B, checking commit logs, reveals recent changes but not usage frequency. Option C, sorting rules by rule number, does not indicate whether rules are used.

Answer

Use the 'show rulebase' command.

Answer

Check the commit logs for recent changes.

Answer

Sort rules by rule number in descending order.

Question 9

An administrator needs to apply a security profile that includes anti-malware and vulnerability protection to all traffic from the internal network to the internet. However, there is already a rule that allows this traffic without any profiles. What is the most efficient way to apply the profiles?

Accepted Answer

Create a new rule above the existing rule with the profiles and action 'allow', and ensure the rule is before the existing allow rule.. Creating a new rule above the existing allow rule with the required security profiles and action 'allow' ensures the profiles are applied to all matching traffic without modifying the existing rule. This is the most efficient approach as it preserves the original rule and avoids disruption. Option A is incorrect because an action 'deny' would block traffic, not apply profiles. Option B is inefficient as it requires removing and recreating a rule, and could cause temporary gaps in security. Option D would work but is less efficient because it modifies an existing rule, potentially affecting other traffic or requiring careful testing.

Answer

Create a new rule above the existing rule with the profiles and action 'deny'.

Answer

Remove the existing rule and replace it with a new rule that includes the profiles.

Answer

Edit the existing rule to add the security profiles.

Question 10

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.

Question 11

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options with null label, A, and D are correct. The null option is correct because if the destination address object is not in the rule's referenced address group, the rule will not match the traffic. Option A is correct because the traffic must match the source zone specified in the rule; otherwise, the rule is skipped. Option D is correct because a disabled rule is not evaluated and thus will not be hit. Option B is incorrect because a high hit count indicates the rule is being hit, not that it is not matched. Option C is incorrect because log forwarding configuration does not affect rule matching. Option E is incorrect because even though the action is set to drop, the rule can still be matched (and then drops traffic), so it can be hit.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 12

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options C and D are correct. To ensure traffic is inspected by threat prevention features, you need a security rule that allows the traffic and includes a security profile group with threat prevention (C). Additionally, the rule's action must be set to 'allow' (D) for the traffic to pass through and be inspected; otherwise, traffic would be blocked. Option A (decryption) is only required for encrypted traffic, but the question does not specify that all traffic is encrypted, so it is not universally required. Option B (NAT) is for address translation, not inspection. Option E (application override) is not necessary for threat prevention.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 13

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

Accepted Answer

rule3.. Rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Answer

rule2.

Answer

rule1.

Answer

None, because rule1 and rule2 have specific applications.

Question 14

Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?

Accepted Answer

Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.. Creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 with appropriate security profiles will permit the desired traffic without affecting other rules. Rule order matters in Palo Alto firewalls; a rule placed higher in the list is evaluated first. Option A would broaden rule1's source, potentially allowing unintended traffic. Option B would change rule2 to allow, which could permit traffic that should still be denied. Option D would move rule2 above rule1, but since rule2 is a deny rule, the traffic would still be denied. Thus, adding a new allow rule above the deny rule is the best approach.

Answer

Add 10.10.1.12 to rule1's source address.

Answer

Change rule2 to allow.

Answer

Move rule2 above rule1.

Question 15

Refer to the exhibit. A security rule is configured with destination address group 'internal-servers'. A packet with destination IP 10.10.20.5 arrives. Will the rule match?

Accepted Answer

Yes, because 10.10.20.5 is within the range of server2.. 10.10.20.5 is within the IP range defined by server2 (10.10.20.1-10.10.20.10). Option B is wrong because address groups can contain multiple objects. Option C is wrong because the group does not include all internal addresses. Option D is wrong because destination can be a range or subnet.

Answer

No, because the destination must be a single IP address.

Answer

Yes, because the address group includes all internal addresses.

Answer

No, because the address group uses multiple objects.