PCNSA Policy Evaluation and Management Practice Test 5 — 15 Questions

Question 1

A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The traffic will be allowed because Rule1 matches before Rule2.. Palo Alto Networks firewalls use first-match policy evaluation: the first rule that matches the traffic's source zone, destination zone, source/destination IP, application, and user determines the action. Since Rule1 (allow) appears before Rule2 (deny), traffic from Engineering to Servers matches Rule1 first and is allowed, regardless of later deny rules.

Answer

To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.

Answer

Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.

Answer

The firewall evaluates all rules and applies the most restrictive action (deny).

Question 2

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure HA interfaces (control link and data link), then Set HA mode to Active-Passive, then Configure device priority (lower value = higher priority), then Configure peer IP address, then Enable preemption and session synchronization.. HA configuration requires setting up interfaces, mode, priority, peer IP, preemption, and synchronization.

Answer

Configure device priority, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Enable preemption and session synchronization.

Answer

Configure HA interfaces, then Set HA mode to Active-Passive, then Configure peer IP address, then Configure device priority, then Enable preemption and session synchronization.

Answer

Enable preemption and session synchronization, then Configure HA interfaces, then Set HA mode to Active-Passive, then Configure device priority, then Configure peer IP address.

Question 3

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Accepted Answer

A previous rule with a broader match is denying the traffic before reaching the permit rule.. In a firewall rulebase, rules are evaluated from top to bottom. If a previous rule with a broader match denies the traffic, it will be blocked before reaching the permit rule lower in the list. Option B is incorrect because the implicit deny is only at the end of the rulebase; there is no implicit deny earlier. Options A and D are unrelated to the scenario: asymmetric routing from destination NAT and misconfigured application override do not cause denial when a matching permit rule exists.

Answer

The destination NAT is causing asymmetric routing.

Answer

The rule is too far down in the rulebase and a previous implicit deny is blocking.

Answer

The application override is misconfigured.

Question 4

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Accepted Answer

The commit was successful but the changes are applied only to new sessions, not existing sessions.. In PAN-OS, committing a candidate configuration pushes the new policy into the running configuration, but security policy evaluation happens at session setup. Existing sessions continue to be evaluated against the policy that was in force when the session was created, so users with long-lived or already-established sessions keep the old behavior while users opening new sessions get the new rule. This explains why only some users report issues after the commit.

Answer

The new rule has an incorrect source zone.

Answer

There is a mismatch between the virtual wire vs layer3 interface.

Answer

The committed configuration is still in candidate state.

Question 5

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Accepted Answer

Security policy with application-ID.. Application-ID allows granular control over applications, not just ports. Option B is a decryption policy and does not control application access. Option C is a security policy with service only, which restricts based on port/protocol, not application. Option D is policy-based forwarding, used for path selection, not for blocking applications.

Answer

Decryption policy.

Answer

Security policy with service only.

Answer

Policy-based forwarding.

Question 6

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. The rule specifies application 'web-browsing', but the traffic may be classified as a different application (e.g., 'ssl' or 'http-proxy'), causing a mismatch. Even though the traffic uses port 80, the firewall identifies applications by signature, not just port. Option A is not necessary; the application does not need to be 'any' to match. Option C is false; the log setting does not affect whether the rule is hit. Option D is incorrect; a broad destination address (any) is not an issue.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 7

What does a 'shadowed' rule mean in the context of policy evaluation?

Accepted Answer

A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.. A shadowed rule is one that is never evaluated because a previous rule with the same or broader match already matches the traffic. This occurs when a rule is redundant due to an earlier rule covering the same or a superset of conditions. Option B is incorrect because a rule at the bottom is still evaluated if no earlier rule matches. Option C is incorrect because a disabled rule is not the same as a shadowed rule. Option D is incorrect because a rule without an action would still be evaluated but would likely result in an error or default action, not shadowing.

Answer

A rule that is never hit because it is at the bottom of the rulebase.

Answer

A rule that is disabled.

Answer

A rule that matches traffic but has no action configured.

Question 8

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

Accepted Answer

Use the Policy Optimizer tool to view rule hit counts.. The Policy Optimizer tool in Palo Alto Networks firewalls provides rule hit counts, allowing administrators to quickly identify which security rules are not being used. Option A, 'show rulebase', displays the rulebase but does not show hit counts. Option B, checking commit logs, reveals recent changes but not usage frequency. Option C, sorting rules by rule number, does not indicate whether rules are used.

Answer

Use the 'show rulebase' command.

Answer

Check the commit logs for recent changes.

Answer

Sort rules by rule number in descending order.

Question 9

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

Accepted Answer

rule3.. Rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Answer

rule2.

Answer

rule1.

Answer

None, because rule1 and rule2 have specific applications.

Question 10

Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?

Accepted Answer

Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.. Creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 with appropriate security profiles will permit the desired traffic without affecting other rules. Rule order matters in Palo Alto firewalls; a rule placed higher in the list is evaluated first. Option A would broaden rule1's source, potentially allowing unintended traffic. Option B would change rule2 to allow, which could permit traffic that should still be denied. Option D would move rule2 above rule1, but since rule2 is a deny rule, the traffic would still be denied. Thus, adding a new allow rule above the deny rule is the best approach.

Answer

Add 10.10.1.12 to rule1's source address.

Answer

Change rule2 to allow.

Answer

Move rule2 above rule1.

Question 11

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

Accepted Answer

Policy Optimizer. Policy Optimizer is a Palo Alto Networks tool that analyzes existing security policies to identify redundant, shadowed, or unused rules and recommends consolidation. It helps administrators simplify complex rule sets by showing which rules can be merged or removed, making it ideal for cleaning up a legacy policy before migration. This directly addresses the problem of overlapping source and destination objects.

Answer

WildFire

Answer

Application Override

Answer

User-ID

Question 12

An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?

Accepted Answer

Rule1. Rule1 allows any to any with logging at session start, so it matches the traffic first and permits it, generating a log entry. Since Rule1 is evaluated before Rule2 and Rule3, the traffic is processed by Rule1 and never reaches the subsequent rules. The log confirms that the session was allowed, consistent with Rule1's action.

Answer

Rule3

Answer

Rule2

Answer

No rule matched

Question 13

An administrator wants to ensure that all traffic from the engineering zone to the server zone is logged, but only when a session is established. Which log setting should be configured in the security rule?

Accepted Answer

Log at session start. In Palo Alto Networks security rules, the Log at Session Start option generates a log entry when the session is first established, which satisfies the requirement to log only when a session is established. This captures the connection initiation without logging at session end.

Answer

Log at both session start and end

Answer

No log

Answer

Log at session end

Question 14

A security administrator is troubleshooting a rule that appears to be matching correctly but is not allowing traffic. The rule uses source zone 'Trust' and destination zone 'Untrust', and the action is 'allow'. The traffic source is in the 'DMZ' zone. What is the most likely reason the traffic is denied?

Accepted Answer

The source zone of the rule does not match the traffic's ingress zone.. The rule is configured with source zone 'Trust', but the traffic originates from the 'DMZ' zone. Since zones must match for a rule to apply, the rule does not match the traffic, so it is denied by the implicit deny rule. Options A, B, and D are incorrect: Security profiles (A) only apply after a rule matches; application identification (B) is not related to zone mismatch; and rule order (D) is irrelevant because the rule does not match due to zone mismatch.

Answer

Security profiles are blocking the traffic.

Answer

The application is not identified.

Answer

The rule is placed after a deny rule.

Question 15

An administrator needs to implement a policy where traffic from the 'Sales' zone to the 'Finance' zone is allowed only for the 'ms-office365' application, but traffic from 'Sales' to 'Finance' using any other application must be denied. Which rule design meets this requirement efficiently?

Accepted Answer

Create a rule that allows ms-office365 from Sales to Finance, and place a deny all rule after it.. In Palo Alto firewalls, security rules are either allow or deny, not both. To allow only 'ms-office365' and deny all other traffic from Sales to Finance, you create an allow rule for that application, followed by a deny-all rule for the same source/destination. This ensures efficiency by allowing the specific traffic first, then blocking everything else. Option A is incorrect as it uses a deny-all first, then tries to allow with an application default deny, which is not a valid concept and would require an explicit allow rule. Option B is incorrect because allowing all traffic and then denying the specific application defeats the purpose. Option D is invalid because a single rule cannot contain both allow and deny actions.

Answer

Create a rule that denies all traffic from Sales to Finance, and then an application default deny rule that allows ms-office365.

Answer

Create a rule that allows all traffic from Sales to Finance, then a rule that denies ms-office365.

Answer

Create one rule that allows ms-office365 and denies all other traffic from Sales to Finance.