PCNSA Policy Evaluation and Management Practice Test 3 — 15 Questions

Question 1

A network security administrator is reviewing the security policy on a Palo Alto Networks firewall. The rulebase contains a rule named 'Allow-Web' with source zone Trust, destination zone Untrust, source address any, destination address any, application web-browsing, and action allow. Below it, there is a rule named 'Block-Social' with source zone Trust, destination zone Untrust, source address any, destination address any, application facebook-base, and action deny. Users report that they can still access Facebook. Which action should the administrator take to ensure Facebook is blocked while allowing other web traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Move the 'Block-Social' rule above the 'Allow-Web' rule.. Security rules are processed in order from top to bottom, and the first rule that matches the traffic is applied. The 'Allow-Web' rule allows web-browsing, which encompasses Facebook traffic, so it matches before the 'Block-Social' rule. Moving the deny rule above the allow rule ensures Facebook is blocked while other web traffic is still permitted by the subsequent allow rule.

Answer

Change the application in the 'Allow-Web' rule to 'ssl' and 'web-browsing'.

Answer

Add a URL filtering profile to the 'Allow-Web' rule to block Facebook.

Answer

Modify the 'Block-Social' rule to use application 'facebook' instead of 'facebook-base'.

Question 2

An administrator has created a security policy rule that allows traffic from the Trust zone to the Untrust zone, but the rule is not matching any traffic. The administrator confirms that the source and destination addresses in the rule are correct and that the traffic is indeed flowing. What should the administrator check first to determine why the rule is not being hit?

Accepted Answer

Verify that the rule is placed above any shadowing rules in the security policy.. The correct answer is to verify that the rule is not shadowed by a preceding rule. Palo Alto Networks firewalls process rules sequentially, and the first matching rule is applied. If a rule above the intended rule matches the same traffic, the intended rule will never be hit. Therefore, checking rule order is the logical first step.

Answer

Check that the rule is configured with the correct application.

Answer

Ensure that the security profiles are attached to the rule.

Answer

Confirm that the rule is enabled and not disabled.

Question 3

A network security administrator is creating a security policy rule to allow only web browsing traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule permits HTTP and HTTPS but blocks all other applications, even if they use the same ports. Which configuration should be used in the security rule to achieve this requirement?

Accepted Answer

Set the application to 'web-browsing' and 'ssl' and the service to 'application-default'.. The rule must allow both HTTP and HTTPS while blocking other applications. Using application 'web-browsing' and 'ssl' with service 'application-default' leverages App-ID to correctly identify and permit only those applications on their standard ports. This ensures that any other application attempting to use ports 80 or 443 is denied, meeting the security requirement.

Answer

Set the application to 'ssl' and the service to 'application-default'.

Answer

Set the application to 'any' and the service to 'service-http' and 'service-https'.

Answer

Set the application to 'web-browsing' and the service to 'service-http'.

Question 4

An administrator needs to create a security rule that allows only the applications 'ssl' and 'web-browsing' between the Trust and Untrust zones, while ensuring that no other applications are permitted on those same sessions. The administrator sets the rule's Application field to 'ssl' and 'web-browsing'. Which additional setting must be configured to guarantee that the rule matches only those two applications and not any application that might be identified later on the same session?

Accepted Answer

Create an Application Override policy that maps the specific traffic to the ssl and web-browsing applications.. By default, App-ID can identify additional applications within a session after the first packet. To ensure a rule matches only the intended applications, an Application Override policy must be created to explicitly map the traffic to those applications. Without the override, the rule may match other applications that are detected later, violating the requirement.

Answer

Set the rule's Application field to 'any' and rely on the implicit deny rule to block unwanted applications.

Answer

Enable 'Disable Server Response Inspection' on the rule to prevent application identification from changing.

Answer

Set the rule's Action to 'Allow' and enable 'Log at Session End'.

Question 5

An administrator is configuring a security policy to allow access to a web server in the DMZ from the Internet. The web server must be accessible via HTTP and HTTPS. The administrator wants to ensure that only the necessary applications are allowed and that the traffic is inspected for threats. Which two actions should the administrator take when configuring the security rule? (Choose two.)

Accepted Answer

Attach a Security Profile Group to the rule to inspect the allowed traffic for threats.. The two correct actions are to attach a Security Profile Group to inspect the traffic for threats and to set the service to 'application-default' to restrict the applications to their default ports. These actions ensure that the allowed traffic is both necessary and inspected, aligning with security best practices. Specifying applications correctly is also important, but the options provided for that are not accurate.

Answer

Specify the applications as 'web-browsing' and 'ssl' to allow HTTP and HTTPS traffic.

Answer

Enable 'Log at Session Start' to capture the beginning of each session for auditing.

Answer

Create a separate rule for HTTP and another for HTTPS to allow granular control.

Question 6

An administrator is creating a security policy rule to allow web traffic from the Trust zone to the Untrust zone. The rule is configured with source zone Trust, destination zone Untrust, application web-browsing, and action Allow. After committing, users report that HTTPS websites are not loading. What is the most likely cause?

Accepted Answer

The security rule must include the SSL application to allow HTTPS traffic.. The security rule allows only the web-browsing application, which identifies HTTP traffic. HTTPS traffic is identified by the SSL application. To permit HTTPS, the administrator must add SSL to the allowed applications in the rule. This is a common configuration oversight when setting up web access policies.

Answer

The application web-browsing only covers HTTP; SSL must be allowed separately.

Answer

The destination zone should be set to Internet instead of Untrust.

Answer

A URL filtering profile must be applied to allow HTTPS traffic.

Question 7

A security administrator is reviewing the security policy on a Palo Alto Networks firewall. The administrator notices that a rule allowing traffic from the Trust zone to the DMZ zone is not being hit, even though there is traffic matching the rule's source and destination addresses and applications. The administrator checks the rule order and sees that the rule is placed after several other rules. Which TWO factors could cause this rule to be skipped during policy evaluation? (Choose two.)

Accepted Answer

The rule has a source user configured, but the traffic does not have user information because User-ID is not enabled for the zone.. The two factors that could cause the rule to be skipped are an earlier rule with a more specific source address that matches the traffic, and a source user criterion in the rule that cannot be matched because User-ID is not enabled. Both are common reasons for a rule not being hit. The administrator should review the rulebase for overlapping rules and verify User-ID configuration.

Answer

The rule's action is set to 'deny', so it is not logged and appears as if it is not hit.

Answer

The rule is placed after a rule that has the same source and destination zones but a broader application definition, such as 'any'.

Answer

The rule is configured with a schedule that is currently inactive, so it is not evaluated.

Question 8

A security administrator is configuring a security policy to allow web browsing from the 'Trust' zone to the 'Untrust' zone. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and that all other applications are blocked. The administrator creates a rule with application 'web-browsing' and service 'application-default'. However, users report that HTTPS traffic is being blocked. What is the most likely cause?

Accepted Answer

The application 'ssl' must also be allowed in the same rule.. In PAN-OS, HTTP and HTTPS are treated as separate applications: 'web-browsing' for HTTP and 'ssl' for HTTPS. A security rule that only allows 'web-browsing' will not permit HTTPS traffic. To allow both, the rule must include both applications. Using 'application-default' service ensures that the correct ports are used for each application, maintaining security and simplicity.

Answer

The rule needs to be moved below the interzone-default rule.

Answer

SSL decryption must be enabled for HTTPS traffic to be allowed.

Answer

The service should be set to 'service-http' and 'service-https' instead of 'application-default'.

Question 9

An administrator has configured a security rule with Source Zone 'Trust', Destination Zone 'Untrust', Source Address 'any', Destination Address 'any', Application 'web-browsing', and Service 'application-default'. Users report that they cannot access a website on port 8080. What is the most likely cause?

Accepted Answer

The application 'web-browsing' does not include port 8080 by default.. The security rule uses Application 'web-browsing' and Service 'application-default'. 'application-default' restricts traffic to the default ports for the application. 'web-browsing' defaults to TCP/80 only. Since the website uses port 8080, the traffic does not match the application and is blocked. To allow it, the administrator should either use a custom application that includes port 8080 or set the Service to 8080/tcp.

Answer

The security rule needs to have the Service set to 'any' to allow port 8080.

Answer

The Service 'application-default' will allow any port for the application.

Answer

The application 'web-browsing' includes port 8080, so the issue is elsewhere.

Question 10

An administrator is creating a security policy rule to allow web traffic from the Trust zone to the Untrust zone. The rule uses the application 'web-browsing' but users report that HTTPS sites are failing while HTTP sites work. The administrator wants to allow both without creating a separate rule. Which action should the administrator take?

Accepted Answer

Add the 'web-browsing' application with service 'application-default' and also add 'ssl' application with service 'application-default'.. The correct approach is to include both 'web-browsing' and 'ssl' applications in the same security rule. The 'web-browsing' application handles HTTP traffic, while the 'ssl' application handles HTTPS traffic. Specifying 'application-default' as the service ensures that the default ports are used. This allows both HTTP and HTTPS web browsing without needing multiple rules, simplifying policy management and ensuring comprehensive coverage.

Answer

Add the 'ssl' application to the rule and set the service to 'application-default'.

Answer

Add the 'ssl' application to the rule.

Answer

Add the 'web-browsing' application with service 'application-default' and also add 'ssl' application.

Question 11

A network administrator is configuring a security rule to allow DNS queries from the 'Trust' zone to the 'DMZ' zone. The administrator wants to ensure that only DNS traffic is allowed and that it is logged for auditing purposes. Which action should the administrator take to meet these requirements?

Accepted Answer

Set the application to 'dns' and enable logging at session end.. To allow only DNS traffic and log it for auditing, the administrator should set the application to 'dns' and enable logging at session end. This ensures that only DNS applications are permitted and that session details are recorded when the session ends, providing a comprehensive audit trail.

Answer

Set the application to 'dns' and enable logging at session start.

Answer

Set the application to 'dns' and enable 'Log at Session Start' and 'Log at Session End'.

Answer

Set the service to 'dns' and enable logging at session end.

Question 12

A network security administrator is configuring a Palo Alto Networks firewall to allow DNS queries from the Guest zone to the Internet. The administrator creates a security rule with source zone Guest, destination zone Untrust, application 'dns', and action allow. However, users in the Guest zone report that DNS resolution is failing. The administrator checks the traffic logs and sees that DNS traffic is being denied by an implicit rule. What is the most likely cause of this issue?

Accepted Answer

The security rule's destination zone is set to Untrust, but the DNS server is in a different zone, such as DMZ.. The most likely cause is that the destination zone in the security rule is incorrect. The administrator set the destination zone to Untrust, but if the DNS server resides in a different zone, such as DMZ, the rule will not match. The firewall uses the destination zone determined by the routing and interface configuration. The administrator should verify the zone of the DNS server and adjust the rule accordingly.

Answer

The security rule does not include the service 'dns' in the service field, so it defaults to 'any' and is not matching.

Answer

The security rule is placed below an implicit deny rule, so it is never evaluated.

Answer

The security rule is not matching because the application 'dns' is not recognized by App-ID.

Question 13

An administrator is reviewing the security policy and notices a rule that allows traffic from the 'Guest' zone to the 'Internet' zone. The administrator wants to ensure that this rule is only active for users who have authenticated via Captive Portal. Which configuration should be applied to the rule?

Accepted Answer

Set the source user to 'guest' and enable Captive Portal on the Guest zone interface.. Captive Portal authentication assigns users to the 'guest' user group. To restrict a security rule to only Captive Portal authenticated users, the source user must be set to 'guest'. Enabling Captive Portal on the interface ensures that unauthenticated users are redirected to the portal. This combination enforces authentication before allowing access.

Answer

Set the source user to 'any' and enable Captive Portal on the Guest zone interface.

Answer

Set the source user to 'pre-logon' and enable Captive Portal on the Guest zone interface.

Answer

Set the source user to 'known-user' and enable Captive Portal on the Guest zone interface.

Question 14

An administrator has configured a security rule with source zone Trust, destination zone Untrust, source address 10.0.0.0/24, destination address any, application any, and action Allow. Users in the 10.0.0.0/24 subnet report that they cannot access a web server at 203.0.113.5 on port 8080. The firewall's default deny rule is logged. What is the most likely reason for the block?

Accepted Answer

The security rule does not specify a service, so the default service 'application-default' only allows standard ports, and port 8080 is not standard.. The security rule has application 'any', which sets the service to 'application-default'. This restricts traffic to default ports for each application. Port 8080 is not a default port for common applications, so the traffic is blocked. To allow it, the administrator must define a custom service for port 8080 and reference it in the rule.

Answer

The application 'any' does not include port 8080.

Answer

The source address 10.0.0.0/24 is not matching the user's IP address.

Answer

The service port 8080 is not allowed by the security rule.

Question 15

A security administrator is asked to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for threats. Which security profile group should be applied to the security rule to meet this requirement?

Accepted Answer

A profile group that includes Antivirus, Anti-Spyware, Vulnerability Protection, and URL Filtering.. To inspect all traffic for threats, the security rule should have a security profile group that includes Antivirus, Anti-Spyware, Vulnerability Protection, and URL Filtering. These profiles work together to detect and block a wide range of threats. Applying this group ensures comprehensive threat inspection for traffic from Guest to Internet.

Answer

A profile group that includes Vulnerability Protection and Anti-Spyware.

Answer

A profile group that includes only Antivirus and Anti-Spyware.

Answer

A profile group that includes File Blocking and Data Filtering.