PCNSE Practice Test 11 — 15 Questions

Question 1

Which THREE factors must match between two IKE peers for successful IPsec tunnel establishment? (Choose three.)

Accepted Answer

IKE encryption algorithm. Option B (IKE encryption algorithm) is correct because both peers must agree on the same Phase 1 encryption algorithm (e.g., AES-256) in their IKE proposals; a mismatch causes the ISAKMP/IKE SA negotiation to fail. Option C (IKE authentication algorithm) is correct because the Phase 1 integrity/hash algorithm (e.g., SHA-256) must match on both peers for the IKE SA to be established. Option E (IKE version v1 or v2) is correct because IKEv1 and IKEv2 are incompatible protocols; peers must run the same version to negotiate the tunnel. Option A (dead peer detection interval) is not required to match, since DPD timers are locally significant and can differ between peers without preventing tunnel establishment. Option D (local certificate) is not required to match, because each peer presents its own identity credential; certificates need only be trusted/validated, not identical.

Answer

Dead peer detection interval

Answer

Local certificate

Question 2

Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)

Accepted Answer

Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.. Option A is correct because the decryption log is the primary place to identify the exact failure reason, and messages like 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed' directly point to cipher mismatch or certificate validation problems breaking the HTTPS session. Option C is correct because SSL decryption requires the firewall to present its own certificate to the client; if that forward-trust or decryption certificate is not trusted by the client, the TLS handshake fails and the site becomes inaccessible. Option E is correct because a packet capture of the SSL handshake across client, firewall, and server reveals where the handshake breaks, such as a failed ClientHello, certificate alert, or SNI mismatch, which is essential for isolating the fault. Option B does not belong because URL filtering database categorization affects policy enforcement, not the cryptographic SSL decryption process. Option D does not belong because disabling decryption globally is a disruptive workaround, not a troubleshooting step, and it would not identify the root cause of the decryption failure.

Answer

Update the URL filtering database to ensure the site is categorized correctly.

Answer

Disable decryption globally to see if the sites become accessible.

Question 3

To reduce the number of authentication prompts for users accessing multiple applications through the firewall, which configuration is recommended?

Accepted Answer

Enable session cookies in the authentication policy. Enabling session cookies in the authentication policy allows the firewall to store a session cookie on the user's browser after the first successful authentication. This cookie is then presented for subsequent requests to different applications, eliminating repeated authentication prompts. The firewall validates the cookie against the existing user session, providing a seamless single sign-on (SSO) experience without requiring re-authentication for each application.

Answer

Increase the authentication timeout value

Answer

Use certificate-based authentication

Answer

Disable authentication for commonly used applications

Question 4

Arrange the steps to deploy a new Panorama template to a managed firewall.

Accepted Answer

Create template, then add configuration objects, then assign template to device group, then commit template. The correct sequence for deploying a new Panorama template to a managed firewall is: first, create the template; second, add configuration objects such as interfaces and zones; third, assign the template to the relevant device group; and finally, commit the template to push the configuration to the managed firewalls. This order ensures that the template exists, contains the desired settings, is linked to the correct devices, and is then applied.

Answer

Add configuration objects, then create template, then assign template to device group, then commit template

Answer

Create template, then assign template to device group, then add configuration objects, then commit template

Answer

Create template, then add configuration objects, then commit template, then assign template to device group

Question 5

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2

Question 6

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 7

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Accepted Answer

Another rule earlier in the policy matches the traffic and allows it before reaching this rule.. In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.

Answer

The firewall is configured to not log interzone traffic.

Answer

The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

Answer

The logging profile is not applied to the rule.

Question 8

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Accepted Answer

Matching IKE version and encryption algorithms. Option A is correct because both peers must negotiate a compatible IKE version (IKEv1 or IKEv2) and agree on matching Phase 1/Phase 2 encryption, hash, authentication, and DH group algorithms, otherwise the ISAKMP/IPSec SA negotiation fails. Option D is correct because the proxy IDs (local and remote subnet selectors) must mirror each other on both firewalls; if the local subnet on one side does not match the remote subnet on the other, the tunnel will not establish or will fail to pass traffic. Option E is correct because authentication requires matching pre-shared keys or mutually trusted certificates, and a mismatch in PSK or certificate trust causes Phase 1 authentication to fail. Option B is not required because IPSec is a standards-based protocol and interoperates between different firewall vendors and models. Option C is not required because a shared certificate authority is only needed when using certificate-based authentication; PSK authentication works without any CA, and even with certificates the requirement is mutual trust, not necessarily the same CA.

Answer

Same firewall model

Answer

Same certificate authority

Question 9

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. Option B is correct because the firewall's management plane (MP) can retain logs locally on its management disk, and administrators can retrieve them through the web interface (or CLI) for reporting and forensic review. Option E is correct because the firewall natively supports forwarding logs via syslog to external log collectors (e.g., a syslog server or Panorama in log-collector mode), which is a standard method for centralized reporting and forensics. Option A is not valid because Azure Sentinel does not ingest Palo Alto logs directly without an intermediate, such as a syslog forwarder, Log Analytics agent, or CEF connector. Option C is incorrect because SNMPv3 traps are used for monitoring/alerting on MIB objects, not for transporting full log records of all log types. Option D is incorrect because email alerts are notification-only and do not provide a complete, structured log collection mechanism for reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 10

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

Accepted Answer

A configuration error causes duplicate SAs.. In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway. Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.

Answer

Multiple Phase 2 tunnels are established.

Answer

Multiple Phase 1 proposals are accepted.

Answer

The firewall is under DDoS attack.

Question 11

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Accepted Answer

Verify the routing table on both firewalls.. Option A is correct because when a site-to-site VPN tunnel is up but traffic does not pass, the most common cause is a missing or incorrect route on one or both firewalls; verifying the routing table ensures that traffic destined for the remote subnet is directed into the tunnel interface rather than out a default or wrong interface. Option B is correct because firewall policies (security rules) must explicitly permit traffic between the local and remote tunnel zones; even with a healthy IPSec SA, an implicit deny or missing allow rule for the tunnel zone will silently drop packets. Option D is correct because proxy IDs (traffic selectors) define which source/destination subnets are permitted through the tunnel, and if the local and remote peers have mismatched proxy IDs, Phase 2 may appear up while traffic for the actual subnets is dropped or not encrypted. Option C is not correct because increasing the IPSec SA lifetime only affects how often keys are renegotiated and does not resolve a no-traffic condition when the tunnel is already established. Option E is not correct because placing the tunnel interface in a virtual router is a design/configuration choice, not a troubleshooting step, and a tunnel can pass traffic without being bound to a virtual router.

Answer

Increase the IPSec SA lifetime.

Answer

Ensure the tunnel interface is placed in a virtual router.

Question 12

Which THREE components should be verified when troubleshooting a site-to-site IPSec VPN that is not coming up?

Accepted Answer

Pre-shared key configuration on both ends. When a site-to-site IPSec VPN fails to establish, the IKE Phase 1 negotiation is the first thing to verify, and option C (pre-shared key configuration on both ends) is critical because a mismatched PSK causes IKE authentication to fail immediately. Option D (peer IP address in the tunnel interface configuration) is correct because the local device must reference the correct remote peer's public IP as the IKE gateway; a wrong or unreachable peer IP prevents any IKE exchange from starting. Option E (IKE version v1 vs v2 compatibility) is correct because both peers must agree on IKEv1 or IKEv2; a version mismatch means the devices cannot negotiate Phase 1 at all. Options A and B are not part of the core IPSec VPN bring-up path: a zone protection profile (A) affects flood/scan protection on the untrust zone and does not govern tunnel negotiation, and an interface management profile (B) controls which management services (ping, SSH, HTTPS, etc.) are permitted on the interface, which is unrelated to IPSec tunnel establishment.

Answer

Zone protection profile on the untrust zone

Answer

Interface management profile on the external interface

Question 13

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. Traffic fails over correctly, but after a failover, existing sessions from external users to internal servers are broken. The security team wants to prevent this disruption. Which feature must be enabled?

Accepted Answer

Session State Synchronization. Session State Synchronization (option C) is required because it ensures that session table entries—including TCP state, sequence numbers, and application-layer metadata—are replicated from the active firewall to the passive firewall in real time. Without this, after a failover, the newly active firewall has no knowledge of existing sessions, causing it to drop packets and forcing clients to re-establish connections. This feature is specifically designed to maintain stateful session continuity during HA failovers.

Answer

Link Monitoring

Answer

Virtual Router Redundancy

Answer

Path Monitoring

Question 14

An administrator has configured an authentication profile with LDAP and sets the authentication sequence to 'continue on failure'. A user enters an incorrect password first, then correct. Will the user be authenticated?

Accepted Answer

No, because the sequence stops on success, but the first attempt failed.. The authentication sequence 'continue on failure' only proceeds to the next authentication method if the current method fails (e.g., server timeout or unreachable). It does NOT retry the same LDAP server with a different password. Since the first attempt failed due to an incorrect password, the sequence stops, and the user is not authenticated. The second correct password is never attempted because the failure is treated as a final rejection, not a retry opportunity.

Answer

Yes, because the sequence continues on failure and the second attempt succeeds.

Answer

Yes, but only if the LDAP server is configured for multiple attempts.

Answer

No, because the first failure blocks authentication.

Question 15

During a troubleshooting session, a user reports that they cannot access an internal web server through the firewall's public IP. The firewall is configured with destination NAT. The engineer checks the NAT policy and sees the rule is active. What should be the next step to verify the NAT is functioning correctly?

Accepted Answer

Check the session table to see if the NAT translation is occurring.. Checking the session table (e.g., using 'show session all' or 'show session id <id>') directly confirms whether the destination NAT (DNAT) translation is being applied to the traffic. If the session shows the original destination IP being translated to the internal server's IP, the NAT rule is functioning; if not, the issue lies elsewhere (e.g., policy order, matching conditions). This is the most immediate and definitive verification step in a Palo Alto Networks firewall.

Answer

Check the application dependency.

Answer

Check the security policy for the post-NAT zone.

Answer

Check the routing table for the destination.