PCNSE Troubleshoot Practice Questions

Question 1

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

Accepted Answer

Asymmetric routing causes the firewall to drop the SYN packet. The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Answer

Session offload is causing the packet to bypass security checks

Answer

The firewall is unable to resolve the destination MAC address

Answer

The destination NAT is misconfigured

Question 2

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

Accepted Answer

The firewall is dropping the return traffic due to a missing policy. Even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Answer

The application is using asymmetric routing

Answer

The security policy is not logging the traffic correctly

Answer

The firewall is not inspecting UDP traffic correctly

Question 3

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

Accepted Answer

The client does not trust the certificate authority that signed the portal certificate. The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Answer

The portal service is not running

Answer

The portal's IP address is not routable from the internet

Answer

The portal certificate's subject name does not match the portal URL

Question 4

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

Accepted Answer

The URL filtering database is up-to-date. After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Answer

The SSL decryption policy is configured correctly

Answer

The security rule is still referencing the correct URL filtering profile

Answer

The URL filtering license is still valid

Question 5

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Accepted Answer

Check the rule order to see if a rule earlier in the policy is also matching. When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Answer

Use the packet capture tool to capture the traffic

Answer

Enable logging at session end for all rules

Answer

Check the server's network connectivity

Question 6

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

Accepted Answer

The firewall might be incorrectly identifying the application as web-browsing when it is something else. When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Answer

The traffic is being blocked because the 'From Zone' is trust

Answer

The session is being denied by a different rule

Answer

The session is not being logged correctly

Question 7

A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?

Accepted Answer

The gateway's interface is not in the same subnet as the IP pool. The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.

Answer

The GlobalProtect client is outdated

Answer

The LDAP authentication profile is misconfigured

Answer

The client certificate is not trusted by the gateway

Question 8

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

Accepted Answer

The security policy rule's logging setting. Even though the security policy rule has 'Log at Session End' enabled, logs may still not be generated if the setting is not correctly applied to the rule or if a logging profile overrides it. The engineer should verify the rule's logging configuration to ensure it is properly set and that no other rule or logging profile is suppressing the logs. Option A is correct because checking the logging setting on the rule is the first step to troubleshoot missing logs.

Answer

The interface management profile

Answer

The log retention settings

Answer

The system log severity level

Question 9

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 10

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

Accepted Answer

A security policy rule with a geolocation-based deny is blocking the traffic. Even though the GlobalProtect tunnel is established successfully, a security policy rule with a geolocation-based deny can block traffic from the user's source IP address. Since the user is connecting remotely, their IP address may fall into a denied geolocation region, preventing access to internal resources while the tunnel itself remains up. This matches the symptom of successful tunnel establishment but inability to access internal resources.

Answer

Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

Answer

The GlobalProtect gateway is not configured with the correct client settings

Answer

The DNS proxy setting is misconfigured

Troubleshoot

PCNSE Troubleshoot — Key Topics

Where candidates lose marks on Troubleshoot