PCNSA Policy Evaluation and Management Practice Test 3 — 15 Questions

Question 1

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

Accepted Answer

Policy Optimizer. Option C is correct because Policy Optimizer analyzes existing rules and suggests merging or removing redundant rules. Option A is wrong because Application Override is not used for simplifying rules. Option B is wrong because WildFire is a threat analysis cloud. Option D is wrong because User-ID maps users to IPs, not simplify rules.

Answer

WildFire

Answer

Application Override

Answer

User-ID

Question 2

An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?

Accepted Answer

Rule1. Option A is correct because the first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.

Answer

Rule3

Answer

Rule2

Answer

No rule matched

Question 3

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. Option B is correct because logging at session start logs the session creation, which is when it is established. Option A is wrong because end logs only at termination. Option C is wrong because both start and end would log twice. Option D is wrong because no logging is not useful for auditing.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 4

A security administrator is troubleshooting a rule that appears to be matching correctly but is not allowing traffic. The rule uses source zone 'Trust' and destination zone 'Untrust', and the action is 'allow'. The traffic source is in the 'DMZ' zone. What is the most likely reason the traffic is denied?

Accepted Answer

The source zone of the rule does not match the traffic's ingress zone.. Option A is correct because zone mismatch is a common reason; the rule expects Trust zone, but traffic is from DMZ. Option B is wrong because rule order could be issue but zone mismatch prevents match. Option C is wrong because application dependency might cause deny, but the primary reason is zone mismatch. Option D is wrong because security profiles do not prevent matching.

Answer

Security profiles are blocking the traffic.

Answer

The application is not identified.

Answer

The rule is placed after a deny rule.

Question 5

An administrator needs to implement a policy where traffic from the 'Sales' zone to the 'Finance' zone is allowed only for the 'ms-office365' application, but traffic from 'Sales' to 'Finance' using any other application must be denied. Which rule design meets this requirement efficiently?

Accepted Answer

Create a rule that allows ms-office365 from Sales to Finance, and place a deny all rule after it.. Option D is correct because a rule allowing the specific application and a subsequent deny rule for other traffic is the simplest and most efficient. Option A is wrong because it allows all and then denies ms-office365, which is opposite. Option B is wrong because application default deny would need explicit deny for other apps. Option C is wrong because combining allow and deny in one rule is not possible.

Answer

Create a rule that denies all traffic from Sales to Finance, and then an application default deny rule that allows ms-office365.

Answer

Create a rule that allows all traffic from Sales to Finance, then a rule that denies ms-office365.

Answer

Create one rule that allows ms-office365 and denies all other traffic from Sales to Finance.

Question 6

An administrator is reviewing the rulebase and finds a rule with a hit count of 0 over the past 30 days. What action should the administrator consider?

Accepted Answer

Consider removing the rule as it is not being used.. Option B is correct because a rule with no hits is unused and can be cleaned up to improve policy performance. Option A is wrong because increasing logging won't help if the rule is not matching. Option C is wrong because moving the rule higher won't cause matches if the rule doesn't match traffic. Option D is wrong because disabling the rule is not as good as removal for cleanup.

Answer

Move the rule higher in the rulebase.

Answer

Increase the log setting to capture more data.

Answer

Disable the rule to see if any traffic matches.

Question 7

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

Accepted Answer

Create an allow rule for internal source addresses, then a deny rule for any source.. Option A is correct because rules are evaluated top-down; placing the internal allow rule first ensures internal traffic is allowed, and then external traffic is denied by the second rule. Option B is wrong because denying external first would also deny internal traffic if it matches the deny rule (if source IP ranges overlap). Option C is wrong because using a single rule cannot differentiate between internal and external sources easily. Option D is wrong because reverse order would allow external if it matches allow rule.

Answer

Create a deny rule for external IP addresses, then an allow rule for internal.

Answer

Place the allow rule after the deny rule.

Answer

Create a single rule with a 'Deny' action and apply a user-ID condition.

Question 8

An administrator is using Policy Tester to validate a rule before deployment. The rule allows HTTP and HTTPS from user 'John' (IP 10.1.1.10) to server 192.168.1.100. The tester shows 'No match' for traffic from John's IP to the server on port 80. What could be the reason?

Accepted Answer

The rule has an application override that is not set to HTTP.. Option A is correct because application override would require the application to be forced; if the rule expects specific applications but traffic is not identified as HTTP, it might not match. Option B is wrong because if the rule allows HTTP, port 80 should be expected. Option C is wrong because user-ID is for user mapping, but if the rule uses user, the tester should have user context. Option D is wrong because rule ordering is not an issue when testing a specific rule.

Answer

The rule is placed after a deny rule.

Answer

The user-ID mapping is incorrect.

Answer

The rule uses port 443 only.

Question 9

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. A and C are correct. Placing most specific rules first reduces latency and ensures correct match. Reviewing and removing unused rules improves performance and security. B is wrong because using a single rule for all traffic is poor practice. D is wrong because disabling rules leaves clutter. E is wrong because logging all sessions can impact performance and storage.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 10

Which TWO factors affect the order in which security rules are evaluated?

Accepted Answer

Whether the rule is intra-zone or inter-zone.. A and B are correct. Rule priority is determined by its position (top-down). Intra-zone vs inter-zone rules are evaluated separately in their respective sections. C is wrong because hit count does not affect order. D is wrong because rule type (allow/deny) does not determine evaluation order. E is wrong because application does not change evaluation order.

Answer

Application used in the rule.

Answer

Rule hit count.

Answer

Rule action (allow or deny).

Question 11

Which THREE are valid methods to test security policy effectiveness before deployment?

Accepted Answer

Check rule hit counts after applying the policy to a small subset of users.. A, C, and D are correct. Policy Tester is a built-in tool to simulate traffic. Rule hit counts after deployment provide feedback. Reviewing logs from lab environment tests effectiveness. B is wrong because disabling the policy is not a test method. E is wrong because packet capture is a troubleshooting tool, not a policy test.

Answer

Disable the policy and monitor traffic.

Answer

Use packet capture (PCAP) to analyze traffic.

Question 12

Refer to the exhibit. The administrator wants to remove unused rules to improve performance. Which rule should be removed?

Accepted Answer

deny-ssh. Option B is correct because rule 'deny-ssh' has 0 hit count, indicating it is not being used. Option A is wrong because deny-all has 73 hits. Option C is wrong because allow-web has many hits. Option D is wrong because allow-dns has many hits.

Answer

deny-all

Answer

allow-dns

Answer

allow-web

Question 13

Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?

Accepted Answer

Deny. Option A is correct because the first rule only matches 'ms-office365' application; 'ssl' does not match, so it goes to the second rule which denies any application. Option B is wrong because the first rule does not allow ssl. Option C is wrong because the deny rule will block it. Option D is wrong because the firewall does not need more rules; it has a deny all rule.

Answer

The firewall will continue to the next rule

Answer

Allow

Answer

Allow only if no security profile blocks it

Question 14

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Accepted Answer

rule 2 (allow-dns). Option B is correct because rule 2 specifically allows DNS application from trust to untrust. Option A is wrong because rule 1 allows web-browsing, not DNS. Option C is wrong because deny-all would match only if no prior rule matches. Option D is wrong because rule 2 explicitly matches DNS.

Answer

No rule will match

Answer

rule 3 (deny-all)

Answer

rule 1 (allow-http)

Question 15

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. This is the most common cause because security policies are evaluated top-down, and an existing deny rule placed above the new allow rule will match first and block the traffic.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.