PCNSA Timed Practice Test 2 — 10 Questions

Question 1

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

10 minute time limit — choose an answer to begin.

Accepted Answer

Create an App-ID override for the application's specific IP addresses and ports.. An App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Answer

Disable App-ID for the security policy rule that allows this traffic.

Answer

Upgrade the App-ID database to the latest version.

Answer

Add the application's TCP port to the service definition in the security policy.

Question 2

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 3

Which TWO of the following are key benefits of using an Application-Based Security Policy compared to a Port-Based Security Policy? (Choose TWO.)

Accepted Answer

Ability to control applications regardless of port or protocol evasion. Option B is correct because an Application-Based Security Policy identifies traffic by the application signature itself rather than by TCP/UDP port, so it can still enforce policy even when an application uses non-standard ports, tunnels over another protocol, or otherwise attempts port/protocol evasion. Option D is correct because application-based policies natively identify the specific application in use, enabling granular logging, reporting, and auditing of application usage to satisfy compliance requirements. Option A is incorrect because application-based policies are generally more complex to configure than simple port-based rules for well-known protocols like HTTP (TCP 80) and FTP (TCP 21). Option C is incorrect because, while application identification can help with dynamic-port applications, the primary stated benefit is control regardless of port, and port-based policies can also be written to permit dynamic port ranges. Option E is incorrect because application-based inspection typically requires deep packet inspection, which adds processing overhead rather than increasing throughput.

Answer

Simpler configuration for traditional protocols like HTTP and FTP

Answer

Easier to allow applications that use dynamic ports

Answer

Increased throughput because firewall does not need to inspect ports

Question 4

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 5

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. Option E is correct because creating the virtual wire object under Network > Virtual Wires is the foundational step that defines the vwire and lets you bind its interfaces. Option A is correct because a virtual wire must have at least two interfaces assigned as members (typically a pair) so that traffic can be bridged transparently between them. Option C is correct because, as with any PAN-OS configuration change, the candidate configuration must be committed for the virtual wire to take effect. Option B is not valid because a virtual wire operates at Layer 2 and is transparent, so it does not have or require an IP address. Option D is not a required configuration step for the vwire itself; security policy is a separate function and is not part of the virtual wire setup process.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Question 6

An administrator wants to block all peer-to-peer file sharing traffic, but must ensure that legitimate business applications like FTP are not affected. Which approach is most effective?

Accepted Answer

Create an Application Filter that matches all P2P applications and use it in a deny rule.. Palo Alto Networks App-ID can identify peer-to-peer (P2P) traffic by application signature, regardless of port. Creating an Application Filter that matches all P2P applications (e.g., BitTorrent, eDonkey, Gnutella) and applying it in a deny rule ensures all P2P traffic is blocked while legitimate business applications like FTP (which uses distinct App-ID signatures) are not affected, as App-ID decodes traffic at Layer 7.

Answer

Create a security rule with 'application none' and block the common P2P ports.

Answer

Use a Service object to block all ports typically used by P2P applications.

Answer

Identify each known P2P application and add them individually to a block rule.

Question 7

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Accepted Answer

Deny the traffic because rule 2 matches and denies social-networking.. The firewall evaluates rules in order from top to bottom. Rule 2 explicitly denies the application 'social-networking', and since the user at 192.168.1.10 is attempting to access a social-networking site, rule 2 matches before any subsequent rule. Therefore, the traffic is denied. Option D is correct because rule 2 matches and denies the traffic.

Answer

Allow the traffic because rule 1 matches and allows all web traffic.

Answer

Allow the traffic because rule 3 allows all traffic.

Answer

Deny the traffic because no rule allows social-networking.

Question 8

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

Accepted Answer

It is a security rule that allows the session.. The rule 'Allow_Outbound' is a security rule that permits outbound traffic from the specified zone to the destination zone. In Palo Alto Networks firewalls, security rules define whether traffic is allowed or denied, and this rule explicitly allows the session.

Answer

It is a QoS rule that prioritizes the traffic.

Answer

It is a NAT rule that translates the source IP.

Answer

It is a decryption rule that decrypts the traffic.

Question 9

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 10

A company is expanding its network and needs to add a new data center. The two data centers will be connected via a WAN link. To protect the traffic between data centers, the security team wants to use site-to-site VPNs. Which Palo Alto Networks feature is used to route traffic between VPN tunnels and security zones?

Accepted Answer

Virtual routers. Virtual routers are the correct feature because they function as Layer 3 routing instances within Palo Alto Networks firewalls, enabling the routing of traffic between VPN tunnels (which terminate on tunnel interfaces) and security zones. When a site-to-site VPN is configured, the tunnel interface is assigned to a virtual router, which then uses static or dynamic routing protocols (e.g., BGP, OSPF) to forward traffic between the tunnel and the zone's egress interface. This allows the firewall to make forwarding decisions between the encrypted VPN path and the protected internal network segments.

Answer

Virtual wires

Answer

Security policies

Answer

Interface management profiles