PCNSA Policy Evaluation and Management Practice Test 4 — 15 Questions

Question 1

An administrator is designing a security policy for a new branch office. The policy must allow access to specific business applications while minimizing the attack surface. Which two actions should the administrator take to follow Palo Alto Networks best practices for security policy design? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'application-default' service for rules that allow business applications.. Best practices for security policy design include using 'application-default' service to ensure correct ports for applications and enabling logging at session start for critical rules to capture detailed traffic information. These actions help minimize the attack surface while maintaining visibility. Allowing all traffic or using broad application filters would increase risk and are not recommended.

Answer

Create a rule at the bottom of the rulebase that allows all traffic from the branch to the internet.

Answer

Negate the source zone in the rule to exclude the branch office from the policy.

Answer

Use application filters instead of specific applications to simplify rule management.

Question 2

An administrator is configuring a security rule to allow access to a web server from the Internet. The rule must use the destination address object 'Web-Server' and the application 'ssl'. The administrator wants to ensure that the rule is as specific as possible and follows best practices. Which two configurations should be applied? (Choose two.)

Accepted Answer

Set the Application to 'ssl' and Service to 'application-default'.. To ensure the rule is specific and follows best practices, the administrator should set the Destination Zone to 'DMZ' and Destination Address to 'Web-Server', and set the Application to 'ssl' with Service 'application-default'. These configurations limit the rule to the intended server and application, reducing the risk of unintended access. Source zone and address are also important but less critical for specificity in this context.

Answer

Enable logging at session start and session end.

Answer

Set the Service to 'any' to allow all ports for SSL.

Answer

Set the Source Zone to 'Untrust' and Source Address to 'any'.

Question 3

An administrator is designing a security policy for a new branch office. The policy must allow access to specific business applications while minimizing the attack surface. Which two actions should the administrator take to follow Palo Alto Networks best practices for security policy design? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security rule with source zone 'Trust', destination zone 'Untrust', and use a dynamic address group that includes IP addresses of allowed countries.. To allow outbound web traffic only to specific countries, the administrator must enforce geo-restrictions. This can be done by specifying allowed countries as region objects in the destination address field of a security rule, or by using dynamic address groups populated with region tags. Both methods ensure that only traffic destined for the allowed countries is permitted, while other traffic is denied by default or by explicit rules.

Answer

Enable Geo-IP filtering in the URL Filtering profile to block traffic to disallowed countries.

Answer

Configure a security rule to allow all outbound web traffic and rely on the firewall's default Geo-IP blocking.

Answer

Create a security rule with source zone 'Trust', destination zone 'Untrust', and attach a URL Filtering profile that blocks categories not allowed.

Question 4

A network security administrator at a retail company is configuring a security policy on a Palo Alto Networks firewall. The company has a policy that allows all employees in the 'Trust' zone to access the 'Untrust' zone on any application, but they now want to block access to the 'Facebook' application specifically for the 'Guest' zone. The administrator creates a rule at the top of the rulebase that denies the Facebook application from the Guest zone to the Untrust zone. After committing, users in the Guest zone can still access Facebook. What is the most likely reason for this issue?

Accepted Answer

A more specific allow rule for Facebook is located above the deny rule in the rulebase.. Security rules in Palo Alto Networks firewalls are evaluated from top to bottom, and the first rule that matches the traffic is applied. If a deny rule for Facebook is placed at the top but users can still access it, a more specific allow rule for Facebook must be above it. The administrator should check the rule order and move the deny rule above any allow rules that permit Facebook access from the Guest zone.

Answer

The security rule does not have the correct application dependency.

Answer

The deny rule is not configured to log at session end, so the traffic is not blocked.

Answer

The rule is not matching because the Guest zone is not included in the source zone of the rule.

Question 5

A security administrator is configuring a new rule in the security policy. The rule is intended to allow DNS traffic from the 'Trust' zone to the 'DMZ' zone. The administrator sets the application to 'dns' and the service to 'application-default'. After committing, users report that DNS queries are failing. What is the most likely reason?

Accepted Answer

The service 'application-default' for DNS only allows UDP port 53, but DNS also uses TCP port 53 for large queries, which is blocked.. The 'dns' application with 'application-default' service allows only UDP port 53. However, DNS also uses TCP port 53 for large queries and zone transfers. If users are experiencing failures, it is likely because TCP-based DNS traffic is being blocked. The administrator should add a custom service for TCP 53 or create a separate rule to allow TCP DNS.

Answer

The application 'dns' is not a valid application; the correct application is 'dns-base'.

Answer

The security rule must specify the source and destination addresses; without them, the rule does not match.

Answer

DNS traffic is always allowed by the intrazone default rule, so a new rule is not needed.

Question 6

An administrator is reviewing the security policy and wants to ensure that the rulebase is optimized and follows best practices. Which two actions should the administrator take to improve security and performance? (Choose two.)

Accepted Answer

Regularly review and remove unused or redundant rules.. The two best practices are to place more specific rules above general rules and to regularly review and remove unused or redundant rules. Specific rules first ensures correct matching and avoids shadowing. Removing unused rules reduces clutter, improves performance, and minimizes potential security holes. These actions contribute to a well-optimized and secure rulebase.

Answer

Set the action of all rules to 'deny' by default and only allow specific traffic.

Answer

Use application 'any' and service 'any' to ensure all traffic is inspected by security profiles.

Answer

Use 'any' for source and destination addresses to simplify rule management.

Question 7

A network security administrator is reviewing the security policy on a Palo Alto Networks firewall. The administrator notices that a rule allowing outbound traffic from the Trust zone to the Untrust zone has the Service field set to 'any'. The administrator wants to restrict this rule to allow only HTTP and HTTPS while blocking all other services. What is the most efficient way to achieve this?

Accepted Answer

Modify the existing rule's Service field to include only 'service-http' and 'service-https'.. The most efficient method is to modify the existing rule's Service field to include only service-http and service-https. This directly restricts the rule to the desired services without creating additional rules or altering application settings. It leverages the existing rule structure and minimizes configuration changes while achieving the required restriction.

Answer

Modify the existing rule's Service field to 'application-default' and specify HTTP and HTTPS in the Application field.

Answer

Add a new rule below the existing rule that denies all services except HTTP and HTTPS.

Answer

Create separate rules for HTTP and HTTPS, and place them above the existing rule.

Question 8

A security administrator has configured a security rule that allows traffic from the Trust zone to the DMZ zone for the application 'ms-rdp'. Users report that they can connect to DMZ servers using RDP, but they are also able to use other applications on the same servers. The administrator verifies that the rule's Application field is set to 'ms-rdp' and the Service field is set to 'application-default'. What is the most likely cause of this behavior?

Accepted Answer

The rule has 'application-default' in the Service field, which allows all default ports for the applications, but the application 'ms-rdp' may have dependencies that allow other applications.. The use of 'application-default' in the Service field allows the default ports for the specified application and any dependent applications. Since ms-rdp may have dependencies, other applications can be permitted inadvertently. To strictly allow only ms-rdp, the administrator should explicitly define the service ports instead of using application-default, or ensure that dependencies are not allowed.

Answer

The firewall is configured with a Security Profile that allows all applications.

Answer

The rule's Action is set to 'Allow' and the default security profiles are not applied.

Answer

The application 'ms-rdp' is not being correctly identified, and the firewall is falling back to service-based matching.

Question 9

A firewall administrator is troubleshooting why a security rule is not matching traffic from the Trust zone to the Untrust zone. The rule allows the application 'web-browsing' and has source address 'any', destination address 'any', and service 'application-default'. The administrator runs a packet capture and sees that the traffic is indeed web-browsing on port 80, but the session is being denied by the implicit deny rule. What is the most likely reason the rule is not matching?

Accepted Answer

There is a rule above it that denies the traffic.. The most likely reason is that a deny rule above the allow rule is matching the traffic first. Since security rules are processed in order, the first match determines the action. The administrator should examine the rules preceding the allow rule to find any that could match the traffic, such as a rule with a broad source or destination that denies web-browsing.

Answer

The application 'web-browsing' is not correctly identified.

Answer

The rule is disabled.

Answer

The service 'application-default' is not compatible with web-browsing.

Question 10

A security administrator is troubleshooting a policy misconfiguration. The firewall is configured with a security rule that allows traffic from the 'Engineering' zone to the 'Servers' zone. However, traffic from an Engineering user to a server in the 'DMZ' zone is being denied. What is the most likely cause?

Accepted Answer

The rule only allows traffic from Engineering to Servers zone, not DMZ.. The security rule explicitly permits traffic from the 'Engineering' zone to the 'Servers' zone. Traffic destined to the 'DMZ' zone is a different zone, so the rule does not apply. By default, Palo Alto Networks firewalls enforce a deny-all policy for any traffic that does not match an explicit allow rule, which is why the traffic is denied.

Answer

The rule is configured as an intrazone rule.

Answer

The rule is disabled in the rulebase.

Answer

SSL decryption is blocking the traffic.

Question 11

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Accepted Answer

Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.. It uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

Answer

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Answer

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Answer

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Question 12

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Accepted Answer

The rule is positioned below an allow rule that matches the same traffic.. The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.

Answer

The source IP is negated in the rule.

Answer

The rule is placed at the top of the rulebase and overridden by a later rule.

Answer

The rule is disabled in the rulebase.

Question 13

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Accepted Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.. It uses an LDAP group as the source user attribute, which allows dynamic membership management without manual IP updates. The first rule permits SSH for the group, and the second rule logs and drops all other SSH attempts, ensuring only authorized administrators are allowed while unauthorized attempts are recorded for auditing. This approach is scalable for a large number of administrators because it leverages user-based policies rather than IP-based rules.

Answer

Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.

Answer

Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.

Question 14

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. The firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 15

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Accepted Answer

Deny the traffic because rule 2 matches and denies social-networking.. The firewall evaluates rules in order from top to bottom. Rule 2 explicitly denies the application 'social-networking', and since the user at 192.168.1.10 is attempting to access a social-networking site, rule 2 matches before any subsequent rule. Therefore, the traffic is denied. Option D is correct because rule 2 matches and denies the traffic.

Answer

Allow the traffic because rule 1 matches and allows all web traffic.

Answer

Allow the traffic because rule 3 allows all traffic.

Answer

Deny the traffic because no rule allows social-networking.