PCNSA Policy Evaluation and Management Practice Test 2 — 15 Questions

Question 1

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. Option D is correct because policy changes affect new sessions; existing sessions continue with old policy until timeout. Option A is false; commit finalizes the configuration. Option B is not related. Option C would affect all users, not some.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 2

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Option A is correct because application-ID allows granular control over applications, not just ports. Option B only uses port/protocol, not application. Option C is for path selection. Option D is for decryption.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 3

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. Option C is correct because the rule specifically allows web-browsing; if the traffic is classified as a different application, it won't match. Option A is not an issue; destination any is fine. Option B is not needed. Option D is false; log setting does not affect hit count.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 4

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Accepted Answer

The firewall must have a valid support license.. Option C is correct because Policy Optimizer requires a valid support license. Options A, B, and D are not prerequisites.

Answer

The rule must have at least one security profile attached.

Answer

The rule must have logging disabled.

Answer

The rule must be in the top 10 rules by hit count.

Question 5

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Accepted Answer

The application ssl is not matching because HTTPS traffic may be classified as web-browsing.. Option A is correct; SSL is a VPN/encryption protocol, not HTTPS. HTTPS traffic is typically classified as web-browsing. Option B is wrong because service match works if port matches (TCP 443), but the application mismatch is the issue. Option C should match. Option D is not needed.

Answer

The action should be 'allow with security profile'.

Answer

The service https requires TCP 443, but ssl application is used for encryption.

Answer

The destination address is a specific subnet but the user is accessing a host within that subnet.

Question 6

What does a 'shadowed' rule mean in the context of policy evaluation?

Accepted Answer

A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.. Option D is correct. A shadowed rule is one that is never evaluated because a previous rule with same or broader match already matches the traffic. Option A is wrong because a rule at the bottom is still evaluated if no earlier match. Option B is not possible. Option C is disabled, not shadowed.

Answer

A rule that is never hit because it is at the bottom of the rulebase.

Answer

A rule that is disabled.

Answer

A rule that matches traffic but has no action configured.

Question 7

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

Accepted Answer

Use the Policy Optimizer tool to view rule hit counts.. Option A is correct; Policy Optimizer provides rule hit counts. Option B is not a method. Option C shows changes, not usage. Option D 'show rulebase' alone does not show hits.

Answer

Use the 'show rulebase' command.

Answer

Check the commit logs for recent changes.

Answer

Sort rules by rule number in descending order.

Question 8

An administrator needs to apply a security profile that includes anti-malware and vulnerability protection to all traffic from the internal network to the internet. However, there is already a rule that allows this traffic without any profiles. What is the most efficient way to apply the profiles?

Accepted Answer

Create a new rule above the existing rule with the profiles and action 'allow', and ensure the rule is before the existing allow rule.. Option C is correct because creating a new rule above the existing rule with the profiles and action 'allow' will match first and enforce the profiles without modifying the existing rule. Option A is also possible but less efficient if the existing rule is complex. Option B would block traffic. Option D is disruptive.

Answer

Create a new rule above the existing rule with the profiles and action 'deny'.

Answer

Remove the existing rule and replace it with a new rule that includes the profiles.

Answer

Edit the existing rule to add the security profiles.

Question 9

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

Accepted Answer

Place more specific rules above more general rules.. Options A and D are correct. Placing specific rules above general rules ensures proper matching. Using security profile groups ensures consistent application of profiles. Option B is wrong because using intrazone-default to allow all intra-zone traffic is not recommended. Option C is wrong because logging should be enabled for security events. Option E is wrong because creating a rule per application leads to excessive rules.

Answer

Disable logging for frequently matched rules to improve performance.

Answer

Create a single rule for each application to simplify management.

Answer

Use the 'intrazone-default' rule to allow all traffic in the same zone.

Question 10

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Accepted Answer

The traffic does not match the source zone specified.. Options B, E, and F are correct. Option B: if the source zone does not match, the rule is skipped. Option E: a disabled rule is not evaluated. Option F: if the traffic's destination IP is not in any address object in the rule's address group, the rule does not match. Option A is wrong because a high hit count indicates it is being hit. Option C is wrong because even if the action is drop, the rule is still matched (and drops). Option D is wrong because log forwarding does not affect matching.

Answer

The rule has a high hit count.

Answer

The rule has a log forwarding profile configured.

Answer

The rule's action is set to drop.

Question 11

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a security rule that allows the traffic and includes a security profile group with threat prevention.. Options A and C are correct. A security rule with action 'allow' and a security profile group containing threat prevention is necessary to inspect traffic. Option B is optional for encrypted traffic but not required for all. Option D is not required for inspection. Option E is not needed.

Answer

Enable decryption to inspect encrypted traffic.

Answer

Configure NAT policies for outbound traffic.

Answer

Use application override to force detection.

Question 12

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

Accepted Answer

rule3.. Option B is correct because rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Answer

rule2.

Answer

rule1.

Answer

None, because rule1 and rule2 have specific applications.

Question 13

Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?

Accepted Answer

Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.. Option D is correct because creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 (or the appropriate subnet) with proper security profiles will permit the traffic without affecting other rules. Option A would allow all traffic matched by rule2, which might be too broad. Option B would cause rule2 to be evaluated before rule1, potentially denying traffic that should be allowed. Option C would modify rule1's source, possibly allowing unintended traffic.

Answer

Add 10.10.1.12 to rule1's source address.

Answer

Change rule2 to allow.

Answer

Move rule2 above rule1.

Question 14

Refer to the exhibit. A security rule is configured with destination address group 'internal-servers'. A packet with destination IP 10.10.20.5 arrives. Will the rule match?

Accepted Answer

Yes, because 10.10.20.5 is within the range of server2.. Option A is correct because 10.10.20.5 is within the IP range defined by server2 (10.10.20.1-10.10.20.10). Option B is wrong because address groups can contain multiple objects. Option C is wrong because the group does not include all internal addresses. Option D is wrong because destination can be a range or subnet.

Answer

No, because the destination must be a single IP address.

Answer

Yes, because the address group includes all internal addresses.

Answer

No, because the address group uses multiple objects.

Question 15

A security administrator notices that a newly added security rule, designed to allow SSH traffic from the engineering department to a Linux server, is not being matched. The rule is placed above an existing 'deny all' rule. What is the most likely cause?

Accepted Answer

The rule's source zone or address does not match the engineering department traffic.. Option B is correct because if the zone or source address is misconfigured, the traffic will not match the intended rule and will be matched by later rules. Option A is wrong because rule ordering is correct (rule above deny all). Option C is wrong because hit count is irrelevant to the cause of no match. Option D is wrong because the rule is placed in the correct position.

Answer

The rule is placed below the deny all rule.

Answer

The rule has a low hit count.

Answer

The rule is placed after the deny all rule.