PCNSE Practice Test 13 — 15 Questions

Question 1

An organization has deployed GlobalProtect with certificate authentication. Users on macOS report that after updating their client, they cannot connect and see error 'Certificate validation failed: The certificate hash does not match.' What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The certificate pinning configuration on the gateway has a hash mismatch. The error 'Certificate validation failed: The certificate hash does not match' specifically indicates a certificate pinning mismatch. GlobalProtect certificate pinning allows the gateway to enforce that the client's certificate matches a specific hash (SHA-256 fingerprint). When the client updates, its certificate may change (e.g., due to a new key pair or renewal), causing the hash stored in the gateway's pinning configuration to no longer match, resulting in this exact error.

Answer

The root CA certificate is not trusted on the client

Answer

The CRL is not reachable

Answer

The GlobalProtect gateway certificate is expired

Question 2

Based on the exhibit, what caused the last failover?

Accepted Answer

The HA1 keepalive from the peer was lost.. The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Answer

The HA2 link went down.

Answer

A preemption event occurred.

Answer

The peer firewall was rebooted.

Question 3

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

Accepted Answer

The portal authentication profile requires both certificate and password. When a GlobalProtect portal authentication profile is configured to require both certificate and password, the client will prompt for username and password even if a valid certificate is present. This is because the authentication profile explicitly enforces multi-factor authentication, meaning the certificate alone is insufficient for portal authentication. The client must satisfy all configured authentication factors before proceeding.

Answer

The certificate is expired

Answer

The client certificate does not match the username

Answer

The root CA certificate is not imported into the firewall

Question 4

Match each security profile type to its purpose.

Accepted Answer

Antivirus: Scans for malware and viruses in files.. The correct matches are: Antivirus scans for malware, Anti-Spyware protects against spyware, Vulnerability Protection prevents exploitation. URL Filtering categorizes URLs, and File Blocking blocks file types. Options D and E swap these definitions.

Answer

URL Filtering: Blocks files based on type and direction.

Answer

File Blocking: Categorizes URLs and controls access based on categories.

Question 5

Based on the exhibit, what is the most likely cause of the warnings?

Accepted Answer

Both the primary and backup HA2 links are down. The exhibit shows warnings indicating that both the primary and backup HA2 links are down. HA2 is the control link used for session synchronization and configuration state exchange in an active/passive or active/active firewall pair. When both HA2 links fail, the firewalls cannot synchronize session tables, leading to warnings about potential asymmetric traffic and failover issues. Option C correctly identifies this as the most likely cause.

Answer

The HA3 link is misconfigured

Answer

Configuration synchronization is failing

Answer

The HA2 keepalive timer is set too low

Question 6

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Accepted Answer

Download, then Upload, then Install, then Reboot, then Verify. The correct sequence for upgrading PAN-OS on a standalone firewall is: Download the new image from the support portal, Upload it to the firewall, Install the image, Reboot the firewall to load the new version, and Verify the upgrade was successful. Common mistakes include swapping the order of upload and download, installing before upload, or reboot before install.

Answer

Download, then Install, then Upload, then Reboot, then Verify

Answer

Upload, then Download, then Install, then Reboot, then Verify

Answer

Download, then Upload, then Reboot, then Install, then Verify

Question 7

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

Accepted Answer

The server is sending a FIN/RST prematurely due to application layer issues.. When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.

Answer

A deny all security policy is blocking the traffic.

Answer

Asymmetric routing is causing the session to be torn down.

Answer

Packet buffer exhaustion on the firewall is causing drops.

Question 8

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Accepted Answer

First configure the GlobalProtect portal, then configure the GlobalProtect gateway, then configure the GlobalProtect agent (client configuration), and finally configure security policies.. The correct sequence for enabling and configuring GlobalProtect on a Palo Alto Networks firewall starts with configuring the portal, which handles authentication and client settings. Next, the gateway is configured to manage VPN connections. Then, the GlobalProtect agent (client configuration) is set up to push settings to endpoints. Finally, security policies are applied to allow GlobalProtect traffic. Following this order ensures dependencies are satisfied and reduces configuration errors.

Answer

First configure the GlobalProtect gateway, then configure the GlobalProtect portal, then configure the GlobalProtect agent, and finally configure security policies.

Answer

First configure the GlobalProtect agent, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure security policies.

Answer

First configure security policies, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure the GlobalProtect agent.

Question 9

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

Accepted Answer

Use App-ID's encrypted traffic detection capabilities. App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Answer

Deploy a network tap to capture traffic

Answer

Configure the firewall to trust all certificates

Answer

Implement SSL Forward Proxy decryption

Question 10

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. Option A is correct because session synchronization must be explicitly enabled in Device > High Availability > Setup on both peers; if the checkbox is cleared on either firewall, sessions will not replicate even though HA1/HA2 heartbeats are up. Option D is correct because the session synchronization settings (e.g., sync encryption, session timeout, and related parameters) must match on both peers; a mismatch such as encryption enabled on one side but not the other silently prevents session state from being exchanged. Options B, C, and E are not the most effective steps: HA1 utilization affects heartbeat/control traffic rather than session sync (which normally uses HA2), packet buffer protection is unrelated to session replication, and restarting the HA process is a disruptive action that does not address configuration causes of sync failure.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 11

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

Accepted Answer

The firewall is not seeing the full SSL handshake due to asymmetric routing.. When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Answer

SSL decryption must be enabled for the firewall to correctly identify SSL traffic.

Answer

The default interzone rule is blocking the SSL identification packets.

Answer

The security policy allows 'web-browsing' before 'ssl' in the rule order.

Question 12

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 13

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Accepted Answer

The VLAN ID is misconfigured as 20 instead of 10.. The exhibit shows the sub-interface is configured with VLAN ID 20, but the administrator intended VLAN 10. In Palo Alto Networks firewalls, sub-interfaces use 802.1Q VLAN tagging, and the VLAN ID must match the tag on incoming frames. Mismatched VLAN IDs cause the firewall to drop or ignore traffic because the sub-interface only processes frames with the configured tag.

Answer

The IP netmask is /24 but should be /16.

Answer

The zone is incorrectly named 'VLAN10'.

Answer

The virtual router is not correctly set.

Question 14

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

Accepted Answer

Create a custom application with a data pattern (signature).. Creating a custom application with a data pattern (signature) allows the firewall to identify the ERP traffic based on its unique payload characteristics, without overriding or disabling the default App-ID engine. This approach uses a custom App-ID signature that matches the proprietary protocol's data pattern, ensuring accurate identification while the default engine continues to process other traffic normally.

Answer

Configure a port-based application override for port 4444.

Answer

Enable SSL decryption for the ERP traffic.

Answer

Create an application override to allow the traffic without App-ID.

Question 15

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

Accepted Answer

The firewall and IdP system clocks are out of sync. The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock. If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Answer

The IdP does not support IdP-initiated SAML flow

Answer

The user mapping agent is not configured

Answer

The SAML identity provider certificate is expired