PCNSE Practice Test 4 — 10 Questions

Question 1

An administrator wants to ensure that all traffic from the internal network to the internet uses a specific public IP address for source NAT. There are multiple public IP addresses available. What is the best way to achieve this?

Accepted Answer

Create a dynamic IP and port (DIPP) NAT policy with the specific IP as translated address. Option C is correct because a Dynamic IP and Port (DIPP) NAT policy allows you to specify a single translated address (the specific public IP) while still performing port address translation (PAT) to handle multiple internal sessions. This ensures all outbound traffic uses that exact public IP, unlike a pool which would distribute across multiple IPs. DIPP is the standard method for source NAT with a single IP when many internal hosts need concurrent internet access.

Answer

Configure a NAT IP pool

Answer

Use a static NAT policy

Answer

Use a PAT pool

Question 2

Which TWO of the following are prerequisites for configuring User-ID on an interface?

Accepted Answer

A User-ID agent must be installed.. Option C is correct because a User-ID agent (or the built-in User-ID service on the firewall) is required to map IP addresses to usernames. Without an agent—such as the PAN-OS User-ID Agent, Terminal Services Agent, or GlobalProtect—the firewall cannot collect user mapping data from directory services (e.g., Active Directory) or authentication logs. Option D is correct because User-ID must be explicitly enabled on the zone; if the zone does not have User-ID enabled, the firewall will not perform user mapping for traffic traversing that zone, even if the interface is configured correctly.

Answer

The firewall must be in FIPS mode.

Answer

The interface must be in a zone.

Answer

An authentication profile must be configured.

Question 3

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 4

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 5

A company has a pair of Palo Alto Networks firewalls in active/passive HA. The active firewall manages all traffic. Recently, the network team reconfigured the virtual router by adding a new static route to a remote subnet via a next-hop IP on the same interface. After committing, they noticed that the passive firewall's management IP became unreachable. The active firewall continues to pass traffic normally. What is the most likely cause?

Accepted Answer

The passive firewall has lost its management route. In an active/passive HA pair, the passive firewall synchronizes its configuration from the active firewall, including virtual router settings. However, management IP reachability depends on the management network's routing table, which is separate from the dataplane virtual router. Adding a static route to the virtual router does not automatically add a corresponding management route. The passive firewall's management IP became unreachable because it lost its default gateway or specific management route, likely due to a misconfiguration or failure to synchronize the management plane's routing information, which is not part of the HA config sync.

Answer

The HA link is down

Answer

The static route is causing a routing loop

Answer

The virtual router configuration is not synchronized to the passive peer

Question 6

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 7

An administrator needs to generate a tech support file for TAC. Which CLI command accomplishes this?

Accepted Answer

generate tech-support. The correct command to generate a tech support file on Palo Alto Networks firewalls is 'generate tech-support'. This command collects all relevant logs, configurations, and diagnostic data into a single archive file for TAC analysis. The 'generate' keyword is specific to Palo Alto's CLI syntax for creating output files, unlike Cisco's 'show' or 'request' commands.

Answer

debug generate dump

Answer

show tech-support

Answer

request tech-support

Question 8

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

Accepted Answer

The HA3 link is not configured or is misconfigured.. In an active/passive HA configuration, session synchronization occurs over the HA2 link (control link) and HA3 link (packet forwarding link). The HA3 link is specifically responsible for synchronizing session tables between the peers. If the HA3 link is not configured or is misconfigured, session synchronization will fail even though the HA state shows 'active' and 'passive' correctly. The HA2 link handles keepalives and configuration sync, not session sync, so its status being up does not guarantee session synchronization.

Answer

The HA2 link is down.

Answer

The passive firewall does not have management API access.

Answer

The logging settings on both firewalls are different.

Question 9

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

Accepted Answer

Syslog over TCP with buffering enabled in the log forwarding profile.. Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Answer

Email (SMTP) for each log.

Answer

Syslog over UDP with a log forwarding profile.

Answer

Syslog over SSL without optional buffering.

Question 10

An administrator wants to receive SNMP traps from the firewall for critical events such as failed login attempts and high CPU usage. Which configuration step is required?

Accepted Answer

Configure an SNMP trap destination under Device > Setup > SNMP Trap.. To receive SNMP traps from a Palo Alto Networks firewall, you must configure the trap destination under Device > Setup > SNMP Trap. This step defines where the firewall sends SNMP notifications (traps) for events like failed login attempts and high CPU usage. Without a configured trap destination, the firewall will not transmit any SNMP traps, even if other SNMP settings are enabled.

Answer

Enable SNMP monitoring on the interface.

Answer

Set up a log forwarding profile with SNMP action.

Answer

Create an SNMP read-only community string.