PCNSA Policy Evaluation and Management Practice Test 6 — 15 Questions

Question 1

An administrator is reviewing the rulebase and finds a rule with a hit count of 0 over the past 30 days. What action should the administrator consider?

Accepted Answer

Consider removing the rule as it is not being used.. A rule with a hit count of 0 over 30 days indicates no traffic has matched it, meaning it is likely obsolete, redundant, or misconfigured. Removing unused rules reduces the attack surface and simplifies the rulebase, which is a recommended hygiene practice in Palo Alto Networks best-practice assessments.

Answer

Move the rule higher in the rulebase.

Answer

Increase the log setting to capture more data.

Answer

Disable the rule to see if any traffic matches.

Question 2

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

Accepted Answer

Create an allow rule for internal source addresses, then a deny rule for any source.. The correct structure is to create an allow rule for internal source addresses first, then a deny rule for any source. Firewalls evaluate rules top-down and stop at the first match, so placing the specific allow rule before the broad deny ensures internal users are permitted while all other traffic, including external IPs, is denied by the subsequent catch-all deny. This implements a whitelist model with an explicit deny-all fallback, which is the recommended security posture.

Answer

Create a deny rule for external IP addresses, then an allow rule for internal.

Answer

Place the allow rule after the deny rule.

Answer

Create a single rule with a 'Deny' action and apply a user-ID condition.

Question 3

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Accepted Answer

Place most specific rules at the top of the rulebase.. Option B is correct because Palo Alto Networks evaluates security rules top-down and stops at the first match, so placing the most specific rules above broader ones ensures precise traffic handling and prevents a general rule from shadowing a narrower one. Option D is correct because the firewall tracks hit counts per rule, and periodically reviewing those counters to identify and delete rules with zero hits reduces rulebase bloat and shrinks the attack surface. Option A is not a best practice since logging every rule, including high-volume allow rules, generates excessive log traffic and storage overhead; logging should be targeted to security-relevant events. Option C is wrong because a single 'allow all' rule defeats the purpose of a least-privilege, zone-based policy and provides no visibility or control. Option E is wrong because disabling rather than removing unused rules leaves dead configuration in the rulebase, and proper hygiene calls for deletion after confirming zero hits.

Answer

Enable logging on all rules for maximum visibility.

Answer

Use a single 'allow all' rule to simplify management.

Answer

Disable unused rules instead of removing them.

Question 4

A network administrator adds a new security rule allowing HTTP from the Trust zone to the Untrust zone. After committing, traffic from the Trust zone to the Untrust zone is still blocked. What is the most likely cause?

Accepted Answer

The new rule is placed at the bottom of the policy, below an existing deny rule that matches the same traffic.. Palo Alto Networks security policies are evaluated top-down, and the first rule that matches the traffic is applied. If an existing deny rule that matches HTTP from Trust to Untrust sits above the new allow rule, the deny rule wins and traffic remains blocked. The new rule must be moved above the deny rule (or the deny rule modified) to take effect.

Answer

The source zone in the new rule is set to 'Untrust' instead of 'Trust'.

Answer

The application in the new rule is set to 'ssl' instead of 'http'.

Answer

The destination zone in the new rule is set to 'Trust' instead of 'Untrust'.

Question 5

A company wants to block all traffic from the Guest zone to the Corporate zone except DNS. What is the best practice for configuring the security policy?

Accepted Answer

Create an allow rule for DNS from Guest to Corporate, placed above a deny rule for any other traffic.. PAN-OS evaluates security policies top-down and stops at the first match, so the DNS allow rule must sit above the deny rule to permit DNS while blocking everything else. This explicit allow-then-deny ordering implements least privilege and makes the intent auditable.

Answer

Create a deny rule for any traffic from Guest to Corporate, placed above an allow rule for DNS.

Answer

Rely on the interzone default rule, which blocks all traffic, and add a rule to allow DNS.

Answer

Create a universal rule that applies to all zones with action 'allow' for DNS and 'deny' for everything else.

Question 6

Which THREE actions can be taken based on hit counts in security rules? (Select three.)

Accepted Answer

Identify unused rules for cleanup. Hit counts record how many times each security rule has matched traffic, so option A is correct because rules showing zero or near-zero hits over a long period are strong candidates for removal during rule cleanup. Option C is correct because hit counts reveal which rules are heavily used versus rarely used, letting administrators focus optimization and consolidation efforts on the rules that matter most. Option D is correct because comparing expected traffic against actual hit counts helps diagnose why traffic is or is not matching a given rule, exposing mis-ordered or mis-scoped rules. Option B is not correct because hit counts are observational statistics and do not themselves trigger or generate dynamic rule updates. Option E is not correct because shadowing is determined by analyzing rule order and overlapping match criteria, not by hit-count values alone.

Answer

Create dynamic updates to rules

Answer

Determine rule shadowing

Question 7

Which TWO methods can be used to help prevent rule shadowing? (Select two.)

Accepted Answer

Placing more specific rules above general rules. Placing more specific rules above general rules prevents rule shadowing by ensuring that traffic matching a specific condition is evaluated and permitted or denied by the intended rule before reaching a broader rule that might otherwise match it. In Palo Alto Networks firewalls, rule evaluation is first-match, so a general rule placed above a specific rule will shadow the specific rule, making it unreachable. This ordering principle directly addresses the root cause of shadowing.

Answer

Using rule hit counts

Answer

Using dynamic address groups

Answer

Using rule order analysis tools

Question 8

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Accepted Answer

The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.. The most likely cause is that a more specific route for 10.10.20.0/24 in the virtual router's routing table points to a different virtual router or interface that belongs to a different zone. In Palo Alto Networks firewalls, zone membership is determined by the ingress interface, not by the source IP address alone. If traffic from the new subnet enters through an interface in a different zone, the security rule with source zone 'Internal' will not match, and the SSH connection is denied or dropped. This explains why other subnets in Internal work while the new subnet does not, even though the source address object covers it.

Answer

The application is not correctly identified because the SSH server uses a non-standard port.

Answer

There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.

Answer

The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.

Question 9

A small business has a Palo Alto Networks firewall with a single security policy rule that allows all traffic from the 'Trust' zone to the 'Untrust' zone. The business recently experienced a malware infection originating from an internal host that communicated with known malicious IP addresses. The administrator wants to implement a security policy to block traffic to these malicious IP destinations. The administrator has a list of 500 malicious IP addresses that may change frequently. What is the most efficient way to create a policy to block traffic to these IPs?

Accepted Answer

Create an External Dynamic List (EDL) of the malicious IPs and reference it in a security rule as destination address, with action deny, placed above the allow rule.. An External Dynamic List (EDL) is the most efficient way to block a frequently changing list of 500 malicious IPs because the firewall automatically pulls updates from an external source (e.g., a text file on a web server), eliminating manual updates. The EDL is referenced as a destination address in a deny rule placed above the allow rule.

Answer

Create a security rule with an address group containing the 500 IPs as destination, action deny, placed above the allow rule.

Answer

Create a security rule with source zone Trust, destination zone Untrust, source address list containing the 500 IPs, action deny.

Answer

Create a security rule with source zone Trust, destination zone Untrust, destination address list containing the 500 IPs as separate address objects, action deny, placed above the allow rule.

Question 10

An administrator needs to allow a specific set of external IP addresses to access an internal web server on port 443, but all other traffic to that server must be blocked. The administrator creates a security policy rule that allows the specific IP addresses and places it at the bottom of the rulebase. What will be the result?

Accepted Answer

The rule will be evaluated last, and if no other rule matches, the specific IP addresses will be allowed and all others will be blocked by the implicit deny.. Security rules are evaluated from top to bottom. Placing a specific allow rule at the bottom means it will be evaluated after any earlier rules. If no earlier rule matches, the specific IP addresses will be allowed, and all other traffic will be blocked by the implicit deny. However, best practice is to place more specific rules above more general ones to ensure they are hit first.

Answer

The rule will be ignored because the implicit deny rule at the top blocks all traffic first.

Answer

The rule will allow the specific IP addresses but also allow all other traffic because the implicit deny is overridden.

Answer

The rule will not be evaluated because rules are processed in alphabetical order.

Question 11

An administrator is creating a new security rule at the top of the rulebase to allow specific web traffic. After committing, users report that all web traffic is now blocked, including traffic that was previously allowed by a lower rule. The new rule's action is set to 'Deny' and its source and destination are set to 'any'. What is the most likely cause?

Accepted Answer

The new deny rule is placed above the existing allow rules, so it matches all web traffic before the allow rules can be evaluated.. Security rules are processed in order from top to bottom. The first rule that matches the traffic determines the action. A broad deny rule placed at the top will match all web traffic and block it before any lower allow rules can be evaluated. To fix this, the administrator should move the deny rule below specific allow rules or narrow its match criteria.

Answer

The new rule has a higher priority because it was created more recently, overriding older rules regardless of position.

Answer

The firewall applies security rules in a random order, so the deny rule sometimes matches before the allow rules.

Answer

The deny rule is only evaluated after the allow rules, so it should not block allowed traffic; the issue is likely a misconfigured application filter.

Question 12

An administrator wants to ensure that a security policy rule is only active during business hours (9 AM to 5 PM) on weekdays. Which configuration element should be used?

Accepted Answer

Schedule. To activate a security rule only during specific times, a Schedule object must be created and attached to the rule. Schedules define time ranges and days of the week. Security Profiles, Application Filters, and External Dynamic Lists serve different purposes and do not control rule activation timing.

Answer

Application Filters

Answer

External Dynamic Lists

Answer

Security Profiles

Question 13

An administrator has configured a security rule that allows traffic from the 'Trust' zone to the 'Untrust' zone for specific applications. The rule is placed at position 5 in the rulebase. A user reports that traffic matching this rule is being denied. Upon inspection, the administrator finds that a rule at position 3 denies all traffic from 'Trust' to 'Untrust' for any application. What is the most likely cause of the denial?

Accepted Answer

The rule at position 3 is evaluated first and matches the traffic, so the deny action is applied.. Security rules are processed in order from top to bottom, and the first rule that matches the traffic determines the action. Because the deny rule at position 3 matches all Trust-to-Untrust traffic, it takes precedence over the allow rule at position 5. To resolve this, the administrator should move the allow rule above the deny rule or modify the deny rule to be more specific.

Answer

The rule at position 5 is not correctly configured with the appropriate applications.

Answer

The deny rule at position 3 is a default rule and cannot be overridden by any other rule.

Answer

The firewall requires a security profile to be attached to the allow rule for it to take effect.

Question 14

A security administrator is configuring a rule to allow access to a web application hosted on multiple servers with changing IP addresses. The administrator wants to ensure the rule automatically updates as the IP addresses change, without manual intervention. Which feature should be used?

Accepted Answer

Dynamic Address Group. Dynamic Address Groups automatically update their members based on tags. When an IP address is tagged, it becomes part of the group. This allows security rules to dynamically adapt to changing IP addresses without manual intervention. Static Address Groups, External Dynamic Lists, and Application Groups do not provide the same seamless dynamic membership based on tagging.

Answer

Static Address Group

Answer

Application Group

Answer

External Dynamic List

Question 15

An administrator is reviewing the security policy on a Palo Alto Networks firewall and notices that a rule allowing web browsing from the Trust zone to the Untrust zone has no application specified. The administrator wants the firewall to permit only web-browsing and ssl while blocking all other applications on ports 80 and 443. What should the administrator do to meet this requirement?

Accepted Answer

Add the applications web-browsing and ssl to the rule and set the action to Allow.. The Application column in a security rule determines which applications are allowed. By specifying web-browsing and ssl, the rule only permits those applications, and all other applications on ports 80 and 443 will not match and will be denied by subsequent rules or the default deny. This is the correct way to restrict traffic to specific applications.

Answer

Enable the 'Log at Session Start' option and monitor which applications are in use.

Answer

Create a new rule below the existing rule that denies any application on ports 80 and 443.

Answer

Change the service to application-default and remove any application specification.