PCNSA Policy Evaluation and Management Practice Test 7 — 15 Questions

Question 1

An administrator is configuring a security policy to allow access to a critical application. The application uses multiple protocols and dynamic ports. The administrator wants to ensure that the policy is as secure as possible while allowing legitimate traffic. Which two actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use App-ID to identify the application and allow only the specific application, rather than allowing the underlying ports.. To securely allow an application with dynamic ports, the administrator should use App-ID to identify the application and create a custom signature if needed. These actions ensure that only the specific application is allowed, regardless of port, while maintaining security. Allowing all ports or disabling inspection would weaken security and are not recommended.

Answer

Set the security rule to allow the application based on the destination port only, as dynamic ports are not supported by App-ID.

Answer

Allow all TCP and UDP ports from the source zone to the destination zone to ensure the application works.

Answer

Disable application inspection for the traffic to improve performance, since the application uses dynamic ports.

Question 2

A network security administrator is reviewing the security policy on a Palo Alto Networks firewall. The administrator wants to ensure that traffic from the Trust zone to the Untrust zone is inspected by a specific security profile group. Which policy component should the administrator configure to attach the security profile group?

Accepted Answer

The security rule that permits the traffic. Security profile groups are attached directly to security rules. When traffic matches a security rule, the firewall applies the attached profile group to inspect the traffic for threats, malware, and other risks. NAT, decryption, and application override rules serve different purposes and do not provide the field to attach security profile groups. The administrator must edit the security rule that permits the traffic.

Answer

The decryption policy rule that matches the traffic

Answer

The application override policy rule

Answer

The NAT rule that translates the source address

Question 3

A network security administrator at a university wants to allow students in the 'Student' zone to access the internet, but only during exam periods should they be blocked from social media. The administrator creates a security rule at the top of the rulebase that denies social media applications from the Student zone to the Internet zone and schedules it to be active only during exam weeks using a schedule object. Which statement correctly describes the evaluation of this rule?

Accepted Answer

The rule will be evaluated only when the schedule is active; outside the schedule, it is skipped and later rules are evaluated.. Security rules can be associated with schedule objects to make them active only during specific time periods. When the schedule is inactive, the rule is skipped entirely during policy evaluation, allowing subsequent rules to be processed. This enables temporary enforcement without manual rule changes, which is ideal for time-bound restrictions like exam-period social media blocks.

Answer

The rule will always be evaluated, but the action will be changed to allow when the schedule is inactive.

Answer

The rule will be evaluated only if the schedule is active, and if inactive, the default interzone-default rule will be applied immediately.

Answer

The rule will be evaluated regardless of schedule, but logging will be suppressed when the schedule is inactive.

Question 4

An administrator is reviewing the security policy and notices a rule that allows all traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that only web browsing (HTTP and HTTPS) is allowed, while all other traffic is blocked. What should the administrator do?

Accepted Answer

Modify the existing rule to allow only the 'web-browsing' and 'ssl' applications, and ensure the rule is placed above any other permissive rules.. To restrict traffic to only HTTP and HTTPS, the existing permissive rule should be modified to allow only the 'web-browsing' and 'ssl' applications. The implicit deny at the bottom will block all other traffic. It is also important to ensure the rule is positioned correctly in the rulebase, above any other rules that might allow broader traffic. Creating unnecessary deny rules is not best practice.

Answer

Create a new rule to deny all traffic from Trust to Untrust, and place it above the existing allow rule.

Answer

Modify the existing rule to allow only the 'web-browsing' and 'ssl' applications, and add a deny rule below for all other traffic.

Answer

Leave the rule as is and create a new rule to deny all non-web traffic, placing it below the allow rule.

Question 5

A security administrator is configuring a policy to allow access from the Guest zone to the Internet zone. The administrator wants to ensure that only HTTP and HTTPS traffic is allowed, and all other traffic is blocked. The administrator creates a rule with source zone Guest, destination zone Internet, application web-browsing and ssl, and action Allow. However, users report that they cannot access websites. What is the most likely cause?

Accepted Answer

The rule is placed below a more general deny rule that blocks all traffic from Guest to Internet.. Security rules are processed in order from top to bottom, and the first rule that matches the traffic is applied. If a deny rule for all traffic from Guest to Internet is placed above the allow rule for web-browsing and ssl, the deny rule will match first and block all traffic, preventing users from accessing websites. The allow rule must be moved above the deny rule to take effect.

Answer

The rule is missing a security profile that allows web browsing.

Answer

The rule's service is set to application-default, but the users are using non-standard ports.

Answer

The application web-browsing does not include HTTPS traffic, so ssl must be replaced with web-browsing.

Question 6

An administrator has configured a security policy with a rule that allows traffic from the 'Trust' zone to the 'Untrust' zone for the application 'web-browsing'. The rule includes a source user group called 'Marketing'. However, users in the Marketing group report that they cannot access the internet. The administrator checks the traffic logs and sees that the sessions are being denied by the implicit deny rule. What is the most likely cause?

Accepted Answer

The source user group 'Marketing' is not properly synchronized with the firewall's user-ID agent.. User-based rules require User-ID to map IP addresses to users and groups. If the 'Marketing' group is not synchronized, the firewall cannot match the source user, and the session falls through to the implicit deny. Verifying User-ID agent connectivity and group mapping is the first troubleshooting step for user-based policy failures.

Answer

The application 'web-browsing' is not correctly defined in the application filter.

Answer

The security rule is placed below the implicit deny rule.

Answer

The destination zone in the rule is incorrectly set to 'Untrust' instead of 'Trust'.

Question 7

A security administrator is configuring a security policy rule to allow access to a web server from the internet. The rule is set to allow HTTP and HTTPS traffic to the server's public IP address. However, after committing the change, users report that they cannot access the web server from the internet. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit rule. What is the most likely cause of the issue?

Accepted Answer

The security rule does not have the correct source zone specified.. The correct answer is that the source zone is likely incorrect. For inbound traffic from the internet, the source zone should be the Untrust zone (or the zone of the external interface). If the source zone is set to Trust or another internal zone, the rule will not match, and the traffic will be denied by the interzone-default rule.

Answer

The security rule is placed below the intrazone-default rule.

Answer

The security rule is placed below the interzone-default rule.

Answer

The security rule is configured with the wrong destination address.

Question 8

An administrator is designing a security policy for a Palo Alto Networks firewall. The administrator wants to ensure that the policy is efficient and follows best practices for rule evaluation. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable logging at the end of the session for rules that allow critical traffic.. Ordering rules from specific to general ensures that intended traffic matches the correct rule before a broader rule can apply. Logging at session end for critical allow rules provides necessary visibility. Using any in source/destination or placing a deny all at the top would create security gaps or block legitimate traffic. Application filters may be too broad for precise control. These two practices support an efficient and secure rulebase.

Answer

Use any as the source and destination in rules to simplify policy management.

Answer

Place a deny all rule at the top of the rulebase to block unwanted traffic immediately.

Answer

Use application filters instead of specific applications to reduce the number of rules.

Question 9

An administrator has created a security rule that allows traffic from the 'Guest' zone to the 'Internet' zone for web browsing. Users in the Guest zone report that they can access some websites but not others. The administrator checks the traffic logs and sees that some sessions are being denied by the implicit deny rule. What is the most likely reason?

Accepted Answer

The security rule is only allowing the 'web-browsing' application, but some websites use other applications such as 'ssl' or 'facebook-base'.. The allow rule only permits the 'web-browsing' application. Some websites use HTTPS or other applications that are not matched by this rule, so those sessions fall through to the implicit deny. The administrator should add the necessary applications, such as 'ssl', to the rule to allow complete web access.

Answer

The implicit deny rule is evaluated before the custom rule, so all traffic is denied unless explicitly allowed above it.

Answer

The rule is placed below the implicit deny rule, so it is never evaluated.

Answer

The security rule is not logging traffic, so the administrator cannot see which rule is allowing the traffic.

Question 10

An administrator is configuring a security policy to allow access to a critical application. The application uses multiple protocols and dynamic ports. The administrator wants to ensure that the policy is as secure as possible while allowing legitimate traffic. Which two actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

application-default. The application-default option in the Service column restricts the rule to the default ports for the selected application. This ensures that the application is only allowed on its standard ports, and any attempt to use a non-standard port will not match the rule, effectively blocking it. This is the correct way to enforce default port usage.

Answer

any

Answer

service-http

Answer

service-https

Question 11

An administrator is configuring a security policy to allow access to a critical application. The application uses multiple protocols and dynamic ports. The administrator wants to ensure that the policy is as secure as possible while allowing legitimate traffic. Which two actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User Group. To restrict a security rule to a specific user group and to weekdays, the administrator must use a User Group in the Source User field and a Schedule in the Schedule field. User Groups require User-ID to be configured. Schedules define the active times. Other options like Application Filters, External Dynamic Lists, and Security Profiles do not fulfill these specific requirements.

Answer

External Dynamic List

Answer

Application Filter

Answer

Security Profile

Question 12

A security administrator is configuring a rule to allow access to a web server. The rule uses a URL category as the destination. The administrator notices that the rule is not matching traffic to the web server's IP address when users connect directly via IP. What is the most likely reason?

Accepted Answer

URL categories are only evaluated for HTTP and HTTPS traffic, and direct IP access may not be categorized.. URL categories are derived from the URL or SNI in the request. When users connect directly to an IP address without a hostname, the firewall often cannot determine a URL category, so a rule that references a URL category will not match. The traffic may then be evaluated against other rules or the implicit deny. To allow such traffic, the administrator should use an IP address or address group in the destination field instead of a URL category.

Answer

The security profile attached to the rule is blocking the traffic before the rule can match.

Answer

The firewall requires a DNS sinkhole to be configured for URL category rules to work.

Answer

The rule's source zone is incorrect, causing the traffic to be evaluated against a different rule.

Question 13

A security administrator is reviewing the rulebase and notices that a rule allowing traffic from the 'Trust' zone to the 'Untrust' zone has the action set to 'Allow' but is not being hit. The administrator confirms that there is traffic matching the source and destination zones, addresses, and applications. What is the most likely reason the rule is not being hit?

Accepted Answer

A rule above it with a broader match is already allowing the traffic, so the lower rule is never evaluated.. A rule is not hit if a rule above it matches the traffic first. The administrator should examine the rules above the one in question to see if any of them match the same traffic. This is the most common reason for a rule not being hit when its criteria seem correct.

Answer

The rule is not being hit because the application is not recognized by App-ID and is being denied by the implicit deny rule.

Answer

The rule is not being hit because the security policy is not committed.

Answer

The rule is not being hit because the source and destination addresses are incorrect.

Question 14

An administrator has configured a security policy with a rule that allows traffic from the 'Guest' zone to the 'Internet' zone. The rule uses the application 'web-browsing' and 'ssl' with service 'application-default'. Users in the Guest zone report that they cannot access a specific website that uses a non-standard port for HTTPS (port 8443). What is the most likely cause of the issue?

Accepted Answer

The service 'application-default' only allows default ports, so port 8443 is blocked. A custom service must be added to the rule.. The service 'application-default' restricts traffic to the default ports for the selected applications. For 'ssl', the default port is 443. Since the website uses port 8443, the traffic does not match the service and is blocked. To allow it, the administrator must create a custom service for port 8443 and add it to the security rule, ensuring the application is still identified correctly.

Answer

The security rule is not matching because the application 'web-browsing' does not cover HTTPS traffic.

Answer

The firewall is configured to block non-standard ports by default, and a security profile must be applied to allow them.

Answer

The application 'ssl' does not support non-standard ports; a custom application must be created.

Question 15

A firewall administrator is reviewing the security policy and notices that a rule allowing DNS from the Trust zone to the Untrust zone has a hit count of zero. The administrator confirms that DNS traffic is being generated and that the rule is enabled. Which action should the administrator take to troubleshoot why the rule is not being hit?

Accepted Answer

Check if there is a rule above that matches DNS traffic and has a deny action.. Security rules are evaluated top-down. If a rule above the DNS allow rule matches DNS traffic and denies it, the DNS allow rule will never be reached, resulting in zero hits. The administrator should examine the rules above for any that might match DNS and have a deny action, or any action that would prevent the DNS rule from being evaluated.

Answer

Verify that the DNS application is included in the rule's Application column.

Answer

Ensure that the source and destination zones are correctly configured as Trust and Untrust.

Answer

Check if the rule is placed after a more general allow rule that permits all traffic.