PCNSE Practice Test 2 — 10 Questions

Question 1

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Option D is correct because resource profiles allow you to allocate CPU, session, and memory limits per vsys. Option A (QoS) manages bandwidth, not CPU. Option B (session limits) only restricts session count, not CPU. Option C (packet filtering) is not a resource allocation feature.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 2

A security engineer is troubleshooting a connectivity issue where traffic from a specific internal host is allowed by security policy but fails to establish a connection to an external server. The firewall logs show the session was created, but no response packets are seen. What is the most likely cause?

Accepted Answer

The source NAT is not configured.. When traffic from an internal host is allowed by security policy and the session is created but no response packets are seen, the most likely cause is that source NAT (also known as outbound NAT or PAT) is not configured. Without source NAT, the firewall forwards the packet with the internal private IP address as the source, and the external server sends responses back to that private address, which is not routable over the public internet. The firewall sees the session as created because it matched the security policy and forwarded the initial packet, but the return traffic never reaches the firewall, so no response packets are logged.

Answer

The destination NAT is configured incorrectly.

Answer

The security policy is missing the return traffic rule.

Answer

The firewall is in FIPS mode.

Question 3

Refer to the exhibit. A user attempts to access a banking site (category: finance) over HTTPS. What will happen?

Accepted Answer

The traffic is not decrypted because the second rule matches and overrides the first.. The correct answer is D because the firewall processes security rules from top to bottom, and the second rule explicitly matches HTTPS traffic to the finance category with an action of 'No Decrypt'. Since the second rule matches before any decryption rule, it overrides the first rule's decrypt action, and the traffic is not decrypted.

Answer

The traffic is decrypted because the first rule matches.

Answer

The traffic is dropped because no rule matches.

Answer

The traffic is decrypted only if the SSL certificate is installed.

Question 4

A firewall is using App-ID to identify applications running on non-standard ports. The administrator has configured a custom application with a default port of 8080, but traffic on port 8080 is still not being identified correctly. The application uses multiple connections on different ports. What is the most likely cause?

Accepted Answer

The application is defined with the wrong protocol (TCP vs UDP).. Custom applications require both a default port and a protocol type (TCP/UDP). If the protocol is not specified correctly, App-ID may fail. Option A (timeout setting) affects session termination but not identification. Option B (require URL categorisation) is for HTTP applications. Option D (disabling content-ID) might affect visibility but not basic identification. The issue is likely the protocol definition.

Answer

The application's timeout value is too short.

Answer

Content-ID is disabled on the security policy.

Answer

The application requires URL categorization to be enabled.

Question 5

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. Option B is correct because the most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 6

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. Option D is correct because the management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 7

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. Option A is correct because for an active/passive HA pair, both firewalls must be the same hardware model to ensure identical hardware resources (e.g., CPU, memory, ASICs) and port layouts. This is a mandatory requirement because the HA synchronization process relies on matching hardware capabilities to avoid configuration mismatches and failover failures.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 8

Which TWO of the following are true regarding Panorama's templates and device groups?

Accepted Answer

Templates are used to push network configurations such as interfaces, virtual routers, and zones.. Option B is correct because templates in Panorama are specifically designed to manage network-level configurations, including interfaces, virtual routers, zones, and other data-plane settings. This separation allows administrators to apply consistent network settings across multiple firewalls while using device groups for policy-based configurations.

Answer

Device groups can only contain firewalls of the same model.

Answer

Templates override device group settings when both are applied.

Answer

Panorama cannot manage firewalls in different geographic locations.

Question 9

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. Option B is correct because DNS Security and WildFire are cloud-delivered services that require an active internet connection to the Palo Alto Networks cloud for real-time analysis and signature retrieval. Unlike local threat prevention, these services offload processing to the cloud, enabling detection of unknown threats without consuming firewall resources.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 10

A company is deploying a Palo Alto Networks firewall in an existing Layer 2 switched environment. They need to inspect traffic between VLAN 10 and VLAN 20 without changing the IP addresses of hosts and without performing any routing. Which firewall mode should be used?

Accepted Answer

Transparent (Layer 2). Option C is correct because Transparent (Layer 2) mode allows the firewall to operate as a Layer 2 bridge, inspecting traffic between VLAN 10 and VLAN 20 without requiring any IP address changes or routing. The firewall forwards frames based on MAC addresses, preserving the existing IP subnet and host configurations, which is ideal for inserting security into an existing switched environment.

Answer

Virtual Wire

Answer

Tap mode

Answer

Layer 3