PCNSE Troubleshoot Practice Questions

Question 1

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

Accepted Answer

Check the IPSec tunnel status and IKE/IPSEC SA rekey timers. The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Answer

Check the traffic logs for any denial events

Answer

Reboot the firewall to clear any stale sessions

Answer

Verify the routing table on both firewalls

Question 2

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

Accepted Answer

Asymmetric routing causes the firewall to drop the SYN packet. The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Answer

Session offload is causing the packet to bypass security checks

Answer

The firewall is unable to resolve the destination MAC address

Answer

The destination NAT is misconfigured

Question 3

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

Accepted Answer

Check the security policy rulebase order and matching. The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Answer

Verify the user-ID agent is mapping the IP correctly

Answer

Check the service configuration for the destination port

Answer

Check the NAT configuration for the user's subnet

Question 4

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

Accepted Answer

The firewall is dropping the return traffic due to a missing policy. Option D is correct because even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Answer

The application is using asymmetric routing

Answer

The security policy is not logging the traffic correctly

Answer

The firewall is not inspecting UDP traffic correctly

Question 5

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

Accepted Answer

The client does not trust the certificate authority that signed the portal certificate. The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Answer

The portal service is not running

Answer

The portal's IP address is not routable from the internet

Answer

The portal certificate's subject name does not match the portal URL

Question 6

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

Accepted Answer

The URL filtering database is up-to-date. After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Answer

The SSL decryption policy is configured correctly

Answer

The security rule is still referencing the correct URL filtering profile

Answer

The URL filtering license is still valid

Question 7

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

Accepted Answer

Add the URL to an allow list in the URL filtering profile. Option D is correct because the traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Answer

Disable URL filtering on the existing security rule

Answer

Check the user-ID mapping to ensure the user is authenticated

Answer

Create a new security rule allowing the user's IP to any

Question 8

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

Accepted Answer

The firewall's App-ID identified the traffic as a different application than the one specified in the rule. The 'application mismatch' log reason indicates that the firewall's App-ID engine identified the traffic as a different application than the one specified in the security rule. Even though the rule allows the application you intended, the actual traffic does not match that App-ID signature, so the session is denied. This is a common scenario when the application classification does not align with the rule's application object.

Answer

The application is not recognized by the firewall and is treated as unknown

Answer

The security rule is not configured to allow any application

Answer

The firewall's SSL decryption is misconfigured

Question 9

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Accepted Answer

Check the rule order to see if a rule earlier in the policy is also matching. When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Answer

Use the packet capture tool to capture the traffic

Answer

Enable logging at session end for all rules

Answer

Check the server's network connectivity

Question 10

Which THREE components should be verified when troubleshooting a site-to-site IPSec VPN that is not coming up?

Accepted Answer

Pre-shared key configuration on both ends. The pre-shared key (PSK) must match exactly on both VPN peers. If the PSK differs, IKE Phase 1 authentication fails, preventing the tunnel from establishing. This is a fundamental requirement for both IKEv1 and IKEv2, as the PSK is used to generate authentication keys during the main or aggressive mode exchange.

Answer

Zone protection profile on the untrust zone

Answer

Interface management profile on the external interface

Troubleshoot

PCNSE Troubleshoot — Key Topics

Where candidates lose marks on Troubleshoot