PCNSA Policy Evaluation and Management Practice Test 3 — 15 Questions

Question 1

A security administrator notices that a newly added security rule, designed to allow SSH traffic from the engineering department to a Linux server, is not being matched. The rule is placed above an existing 'deny all' rule. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule's source zone or address does not match the engineering department traffic.. If the zone or source address is misconfigured, the traffic will not match the intended rule and will be matched by later rules. Option A is wrong because rule ordering is correct (rule above deny all). Option C is wrong because hit count is irrelevant to the cause of no match. Option D is wrong because the rule is placed in the correct position.

Answer

The rule is placed below the deny all rule.

Answer

The rule has a low hit count.

Answer

The rule is placed after the deny all rule.

Question 2

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

Accepted Answer

Policy Optimizer. Policy Optimizer (Option A) is the correct answer because it analyzes existing firewall rules and provides recommendations to consolidate, merge, or remove redundant and unused rules, making it ideal for simplifying legacy policies before migration to a Palo Alto Networks firewall. Option B, WildFire, is a cloud-based threat analysis service and does not simplify rules. Option C, Application Override, is used to bypass application identification for specific traffic, not for policy simplification. Option D, User-ID, maps users to IP addresses for user-based policies, which does not address rule simplification.

Answer

WildFire

Answer

Application Override

Answer

User-ID

Question 3

An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?

Accepted Answer

Rule1. The first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.

Answer

Rule3

Answer

Rule2

Answer

No rule matched

Question 4

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. Logging at session start records the session creation, which corresponds to when the session is established. This meets the administrator's requirement to log traffic from engineering to server zone only when a session is established. Option A (log at both session start and end) is incorrect because it would create duplicate logs and potentially excessive logging. Option B (no log) is incorrect because it provides no audit trail. Option C (log at session end) is incorrect because it logs only when the session terminates, not at establishment.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 5

A security administrator is troubleshooting a rule that appears to be matching correctly but is not allowing traffic. The rule uses source zone 'Trust' and destination zone 'Untrust', and the action is 'allow'. The traffic source is in the 'DMZ' zone. What is the most likely reason the traffic is denied?

Accepted Answer

The source zone of the rule does not match the traffic's ingress zone.. The rule is configured with source zone 'Trust', but the traffic originates from the 'DMZ' zone. Since zones must match for a rule to apply, the rule does not match the traffic, so it is denied by the implicit deny rule. Options A, B, and D are incorrect: Security profiles (A) only apply after a rule matches; application identification (B) is not related to zone mismatch; and rule order (D) is irrelevant because the rule does not match due to zone mismatch.

Answer

Security profiles are blocking the traffic.

Answer

The application is not identified.

Answer

The rule is placed after a deny rule.

Question 6

An administrator is reviewing the rulebase and finds a rule with a hit count of 0 over the past 30 days. What action should the administrator consider?

Accepted Answer

Consider removing the rule as it is not being used.. A rule with no hits is unused and can be cleaned up to improve policy performance. Option A is wrong because increasing logging won't help if the rule is not matching. Option C is wrong because moving the rule higher won't cause matches if the rule doesn't match traffic. Option D is wrong because disabling the rule is not as good as removal for cleanup.

Answer

Move the rule higher in the rulebase.

Answer

Increase the log setting to capture more data.

Answer

Disable the rule to see if any traffic matches.

Question 7

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

Accepted Answer

Create an allow rule for internal source addresses, then a deny rule for any source.. Correct answer is C. Rule order is critical: Palo Alto firewalls evaluate rules top-down, and the first match is applied. By placing an allow rule for internal source addresses first, internal traffic is permitted. Then a subsequent deny rule for any source blocks all other traffic, including external IPs. Option A is incorrect because creating a deny rule for external IPs first would block external traffic but does not guarantee internal access if the deny rule is overly broad or if any later rule could inadvertently allow external traffic. Option B is incorrect because placing the allow rule after the deny rule would cause the deny rule to match all traffic first, including internal, since the deny rule typically covers any source. Option D is incorrect because a single deny rule with a user-ID condition cannot differentiate between internal and external users unless all internal users are authenticated, which is impractical for basic IP-based access control.

Answer

Create a deny rule for external IP addresses, then an allow rule for internal.

Answer

Place the allow rule after the deny rule.

Answer

Create a single rule with a 'Deny' action and apply a user-ID condition.

Question 8

An administrator is using Policy Tester to validate a rule before deployment. The rule allows HTTP and HTTPS from user 'John' (IP 10.1.1.10) to server 192.168.1.100. The tester shows 'No match' for traffic from John's IP to the server on port 80. What could be the reason?

Accepted Answer

The rule has an application override that is not set to HTTP.. Application override forces a specific application identification for traffic. If the rule uses application override but the override is not set to HTTP for HTTP traffic (port 80), the rule will not match, even though the traffic is HTTP. Option A is incorrect because rule ordering is irrelevant when testing a specific rule with Policy Tester; it evaluates the rule regardless of its position in the rulebase. Option B is incorrect because user-ID mapping correctness does not affect the match for HTTP traffic from the user; the issue is about application identification. Option C is incorrect because while a rule using only port 443 would not match HTTP on port 80, the question states the rule allows both HTTP and HTTPS, so the mismatch is due to application override, not port restriction.

Answer

The rule is placed after a deny rule.

Answer

The user-ID mapping is incorrect.

Answer

The rule uses port 443 only.

Question 9

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Placing the most specific rules at the top of the rulebase (option B) ensures that traffic is matched quickly and correctly, reducing latency. Regularly reviewing and removing unused rules using hit counts (option D) improves performance and reduces security risks. Option A is wrong because enabling logging on all rules can overwhelm storage and impact performance, not increase visibility effectively. Option C is wrong because using a single 'allow all' rule defeats the purpose of a security policy and allows any traffic. Option E is wrong because disabling unused rules leaves clutter and can cause confusion; it's better to remove them.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 10

Which TWO factors affect the order in which security rules are evaluated?

Accepted Answer

Whether the rule is intra-zone or inter-zone.. Correct: C and D. Security rules are evaluated in a specific order: first, intra-zone rules are evaluated separately from inter-zone rules, and within each zone type, rules are evaluated from top to bottom based on their position in the rulebase. Therefore, both the rule's zone type (intra-zone vs inter-zone) and its position (top-down) affect evaluation order. A is incorrect because the application does not determine evaluation order; it is a match criterion. B is incorrect because rule hit count is a statistic, not a factor in ordering. E is incorrect because the action (allow or deny) does not affect the order of evaluation.

Answer

Application used in the rule.

Answer

Rule hit count.

Answer

Rule action (allow or deny).

Question 11

Which THREE are valid methods to test security policy effectiveness before deployment?

Accepted Answer

Check rule hit counts after applying the policy to a small subset of users.. A, D, and E are correct. Rule hit counts after applying the policy to a subset of users (A) provides real-world feedback. Deploying the policy in a lab environment and reviewing traffic logs (D) allows controlled testing. The Policy Tester tool (E) simulates traffic to validate policy behavior. B is wrong because disabling the policy does not test effectiveness; it simply removes enforcement. C is wrong because packet capture is a troubleshooting tool, not a method to test policy effectiveness before deployment.

Answer

Disable the policy and monitor traffic.

Answer

Use packet capture (PCAP) to analyze traffic.

Question 12

Refer to the exhibit. The administrator wants to remove unused rules to improve performance. Which rule should be removed?

Accepted Answer

deny-ssh. The rule 'deny-ssh' has a hit count of 0, indicating it is not being used and should be removed to improve performance. Option A is incorrect because 'deny-all' has 73 hits. Option B is incorrect because 'allow-dns' has many hits. Option D is incorrect because 'allow-web' has many hits. Therefore, option C is correct.

Answer

deny-all

Answer

allow-dns

Answer

allow-web

Question 13

Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?

Accepted Answer

Deny. The firewall first checks Rule 1, which only matches traffic with application 'ms-office365'. Since the traffic uses 'ssl', it does not match. The firewall then checks Rule 2, which denies all traffic from Sales to Finance zone. Therefore, the firewall takes the action Deny. Option A is incorrect because while the firewall does evaluate the next rule, the action taken is Deny, not 'continue to the next rule'. Option B is incorrect because the traffic is not allowed. Option D is incorrect because there is no security profile involved; the deny rule blocks it without any profile.

Answer

The firewall will continue to the next rule

Answer

Allow

Answer

Allow only if no security profile blocks it

Question 14

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Accepted Answer

rule 2 (allow-dns). Rule 2 (allow-dns) specifically allows DNS application from trust zone to untrust zone. Option A is incorrect because rule 2 does match. Option B (deny-all) would only match if no prior rule matches, but rule 2 matches first. Option D (allow-http) only allows web-browsing, not DNS.

Answer

No rule will match

Answer

rule 3 (deny-all)

Answer

rule 1 (allow-http)

Question 15

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. The most likely cause is that the new rule is placed at the bottom of the security policy rulebase. Palo Alto Networks firewalls evaluate rules from top to bottom. If an existing deny rule that matches the same traffic (e.g., any-any deny) is placed above the new allow rule, the deny rule will match first and block the traffic. Therefore, the new allow rule never gets evaluated. Option C correctly identifies this issue.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.