PCNSE Practice Test 12 — 15 Questions

Question 1

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rule with a 'deny' action appears earlier in the security policy.. The most likely reason the inter-zone rule is not matched is that a preceding rule with a 'deny' action is matching the traffic first. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom, and the first matching rule determines the action. If an earlier rule denies the traffic, the later allow rule will never be evaluated, even if it would otherwise match.

Answer

The source address 10.0.0.0/8 is not included in the source zone.

Answer

The destination address is set to 'any', which is not valid.

Answer

The traffic is intra-zone, not inter-zone.

Question 2

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

Accepted Answer

Enable session sync on HA2.. Enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Answer

Configure HA3 for stateful inspection.

Answer

Increase HA1 keepalive timer.

Answer

Enable config sync on HA1.

Question 3

Refer to the exhibit. What does the uptime indicate?

Accepted Answer

The firewall has been restarted approximately 3 hours ago.. The uptime displayed in the exhibit shows the firewall has been running for approximately 3 hours. This directly indicates that the firewall was restarted or rebooted about 3 hours ago, making option D correct. Uptime is a measure of time since the last system boot, not related to licensing, HA mode, or memory usage.

Answer

The firewall license is about to expire.

Answer

The firewall is in active-passive HA mode.

Answer

The firewall has high memory usage.

Question 4

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Accepted Answer

Log forwarding supports sending logs to multiple destinations. Option C is correct because Panorama log forwarding profiles allow you to define multiple server entries (up to four syslog servers, plus SNMP, email, or HTTP destinations) within a single log forwarding profile, so logs can be sent to several destinations simultaneously. Option D is correct because log forwarding profiles are attached directly to security policy rules (via the Actions tab's Log Forwarding setting), enabling per-rule control over where that rule's traffic and threat logs are sent. Option A is incorrect because TLS encryption is not mandatory for log forwarding; syslog forwarding can use UDP or plain TCP, and TLS is only one optional transport choice. Option B is incorrect because an external syslog server is not required — logs can be forwarded to Panorama itself, to another managed firewall, or to email/SNMP/HTTP destinations. Option E is incorrect because log forwarding is not limited to a single Panorama collector; multiple destinations, including multiple Panorama or syslog targets, can be configured in one profile.

Answer

Log forwarding must use TLS encryption

Answer

Log forwarding requires an external syslog server

Answer

Log forwarding can only send logs to a single Panorama collector

Question 5

Which THREE of the following are capabilities of GlobalProtect Host Information Profile (HIP)?

Accepted Answer

Check if antivirus is installed and running. Option C is correct because HIP collects host data on endpoint security software, including whether antivirus/anti-malware is installed, running, and up to date, which is a core HIP check. Option D is correct because HIP can verify disk encryption status (for example, BitLocker or FileVault) as part of its endpoint compliance data. Option E is correct because HIP reports the operating system version and patch level, allowing security policies to require a minimum OS version. Option A is not a HIP capability because HIP profiles endpoint host attributes, not the user's geographic location, which is handled by other means such as source region or GlobalProtect gateway selection. Option B is not a HIP capability because HIP does not natively report browser version; browser checks are not part of the standard HIP object categories.

Answer

Check the user's location

Answer

Check the browser version

Question 6

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Accepted Answer

Active/active requires enabling asymmetric routing support. In active/active HA mode, both firewalls can process traffic simultaneously, which requires enabling asymmetric routing support to handle traffic that may arrive at either firewall for the same session. This is necessary because active/active mode does not enforce a single path for traffic, unlike active/passive mode where only one firewall actively processes traffic.

Answer

Active/active eliminates the need for failover

Answer

Active/active automatically synchronizes configuration changes

Answer

Active/active is the default and most commonly deployed mode

Question 7

An organization has a pair of PA-5250 firewalls in active/passive HA. During a maintenance window, the active firewall is rebooted. After the reboot, the firewall that was passive becomes active and passes traffic. However, the other firewall remains in a non-functional state and shows 'unknown' as HA state. The administrator checks the HA configuration and finds both firewalls have the same HA settings. What is the most likely issue?

Accepted Answer

The HA control link is down or misconfigured.. After a reboot, the previously active firewall fails to join the HA pair and shows 'unknown' state, which indicates it cannot communicate with its peer. Since both firewalls have identical HA settings, the most likely cause is that the HA control link (the dedicated link used for heartbeat and state synchronization) is down or misconfigured, preventing the rebooted firewall from establishing a valid HA session.

Answer

The backup firewall has a different software version.

Answer

The floating IP addresses are not configured.

Answer

The HA keepalive timer is too short.

Question 8

A medium-sized enterprise recently deployed a PA-5250 firewall in a data center as the primary internet gateway. The network team configured the security policies to allow all outbound web traffic (HTTP/HTTPS) from the internal trust zone to the untrust zone, with URL filtering and threat prevention enabled. After the deployment, users complain that some legitimate websites, such as banking and healthcare portals, are being blocked. The team checks the URL filtering logs and sees that these sites are categorized as 'web-hosting' or 'dynamic-dns', which are in the block list. The company's compliance requires that all web traffic be inspected. What should the network engineer do to resolve the issue without reducing security?

Accepted Answer

Create a URL category override for each legitimate site to reclassify it as 'business-economy' or 'health-medicine'. URL category overrides allow you to reclassify specific URLs into a more appropriate category (e.g., 'health-medicine') without altering the global block action for 'web-hosting' or 'dynamic-dns'. This preserves the security posture by keeping the broad categories blocked for unknown or risky sites, while permitting the legitimate sites that were miscategorized by the Palo Alto Networks URL filtering database.

Answer

Add the specific URLs to the 'Allow List' in the URL filtering profile

Answer

Set the URL filtering profile action for 'web-hosting' to 'alert' instead of 'block'

Answer

Remove the 'web-hosting' and 'dynamic-dns' categories from the block list

Question 9

A company has configured multi-factor authentication (MFA) via an authentication sequence using LDAP and RADIUS. Users authenticate successfully with LDAP but the MFA prompt from RADIUS does not appear. What is the most likely cause?

Accepted Answer

The authentication sequence must be configured to 'require all' or 'continue on success' to enforce each factor.. When using an authentication sequence in Palo Alto Networks firewalls, the sequence must be configured with the 'require all' or 'continue on success' option to enforce each factor in order. With 'continue on success', after LDAP succeeds, the firewall proceeds to the next factor (RADIUS MFA). If the sequence is set to 'continue on failure' (the default), the firewall stops after the first successful authentication and never attempts the second factor, so the MFA prompt never appears.

Answer

The RADIUS server profile has the wrong shared secret.

Answer

The authentication policy only covers HTTP applications.

Answer

The authentication sequence is set to 'continue on failure' and the LDAP authentication succeeds.

Question 10

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 11

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

Accepted Answer

Syslog over TCP with buffering enabled in the log forwarding profile.. Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Answer

Email (SMTP) for each log.

Answer

Syslog over UDP with a log forwarding profile.

Answer

Syslog over SSL without optional buffering.

Question 12

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

Accepted Answer

Traffic Report. The Traffic Report is the correct choice because it provides detailed logs of all traffic passing through the firewall, including both allowed and denied sessions. By filtering the report to show only denied traffic over the past week, the administrator can generate the exact report needed. Other report types focus on specific categories like applications, threats, or URLs, not general traffic denials.

Answer

Application Report

Answer

Threat Report

Answer

URL Filtering Report

Question 13

An organization is implementing SSL Forward Proxy decryption to inspect outbound HTTPS traffic. They want to exclude traffic to specific internal applications that cannot handle decryption due to certificate pinning. The firewall is configured with a decryption policy that decrypts all traffic from the internal network to the internet. To exclude the pinned applications, which approach is best practice?

Accepted Answer

Create a custom URL category for the applications and add it to a decryption policy rule with action 'no-decrypt'.. Creating a custom URL category for the pinned applications and referencing it in a decryption policy rule with action 'no-decrypt' is the best practice for excluding specific traffic from SSL Forward Proxy decryption. This approach allows the firewall to selectively bypass decryption based on the destination URL, which is more granular and manageable than IP-based exceptions, and it aligns with the decryption policy's ability to match traffic by URL category.

Answer

Configure an SSL/TLS Service Profile with an exception list for the destination IPs.

Answer

Use GlobalProtect client settings to bypass decryption for the pinned applications.

Answer

Reduce the SSL/TLS protocol version on the decryption policy to cause fail-closed for those applications.

Question 14

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

Accepted Answer

Exclude known high-traffic sites from decryption.. Excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Answer

Increase the SSL session cache to 1024.

Answer

Upgrade the firewall to a higher model.

Answer

Enable SSL session re-use.

Question 15

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

Accepted Answer

show high-availability state. The 'show high-availability state' command is the correct CLI command to verify the health of HA1, HA2, and HA3 links because it displays the current status, link state, and any failures for each HA link in a Palo Alto Networks firewall. This command provides a comprehensive view of the HA control link (HA1), data link (HA2), and backup link (HA3), including their operational status and packet statistics, which is essential for troubleshooting high-availability configurations.

Answer

show session info

Answer

show running np-ips

Answer

show device-info