PCNSE Practice Test 14 — 15 Questions

Question 1

An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.. It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.

Answer

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Answer

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Answer

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Question 2

An administrator wants to enforce authentication for SSL decrypted traffic so that only authenticated users can access decrypted content. Which firewall feature should be configured?

Accepted Answer

Authentication Policy. Authentication Policy is the correct feature because it allows the firewall to enforce user authentication specifically for SSL decrypted traffic. By configuring an Authentication Policy, the firewall can require users to authenticate before accessing decrypted content, ensuring that only authenticated users can proceed. This is distinct from SSL decryption profiles, which handle the decryption itself but not user access control.

Answer

SSL Inbound Inspection

Answer

User-ID agent

Answer

SSL Forward Proxy

Question 3

A SOC analyst reports that a critical security policy rule denying traffic from the 'Untrust' zone to the 'DMZ' zone is not generating any traffic logs, even though the analyst sees a high volume of denied traffic in other tools. The administrator confirms that the rule is correctly configured to deny and that logging is enabled at the rule level. What is the most likely reason for the missing logs?

Accepted Answer

The security policy rule is not being matched because the traffic is being denied by a different rule or a default rule with logging disabled.. The most likely reason is that the traffic is being denied by a different rule, such as a default rule or an earlier rule in the policy, which does not have logging enabled. The administrator should verify which rule is actually matching the traffic by checking the session browser or traffic logs. This is a common oversight when a specific deny rule does not seem to be logging, despite being configured to do so.

Answer

The 'Untrust' zone is not configured to log traffic, and zone-level logging overrides rule-level logging.

Answer

The firewall's log storage is full, so new logs are being dropped.

Answer

The firewall is in a high-availability active-passive pair, and logs are only generated on the active device.

Question 4

An administrator needs to allow FTP traffic from the internal network to an external server. The firewall is configured with a security policy that has the application 'ftp' and service 'service-http'. What is the most likely cause of the traffic being denied?

Accepted Answer

The service object in the rule is set to service-http, which does not match FTP traffic.. The security policy's service object is set to 'service-http' (TCP port 80), but FTP traffic uses TCP port 21 for control and TCP port 20 for data. In Palo Alto Networks firewalls, the service object defines the destination port for the traffic; if it does not match the actual port used by the application, the firewall will deny the session even if the application is correctly identified. The mismatch between the service and the application's expected port causes the traffic to be blocked.

Answer

The source address is wrong.

Answer

The application is incorrectly set to ftp.

Answer

The rule is not enabled.

Question 5

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Accepted Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Specify destination zone (Outside) and destination addresses (any). Step 3: Select application (web-browsing) and set service to application-default. Step 4: Set action to allow. Step 5: Commit the configuration.. Configuring a security policy on Palo Alto Networks firewalls involves defining the traffic flow by specifying source and destination zones, then selecting the application and service, setting the action (allow or deny), and finally committing the changes. The correct order ensures logical consistency and proper policy enforcement. Common mistakes include swapping zones, setting action before application, or placing destination after application.

Answer

Step 1: Specify destination zone (Outside) and destination addresses (any). Step 2: Specify source zone (Inside) and source addresses (any). Step 3: Select application (web-browsing) and set service to application-default. Step 4: Set action to allow. Step 5: Commit the configuration.

Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Select application (web-browsing) and set service to application-default. Step 3: Specify destination zone (Outside) and destination addresses (any). Step 4: Set action to allow. Step 5: Commit the configuration.

Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Specify destination zone (Outside) and destination addresses (any). Step 3: Set action to allow. Step 4: Select application (web-browsing) and set service to application-default. Step 5: Commit the configuration.

Question 6

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

Accepted Answer

Create a new application and define the default port.. To create a custom application for a proprietary database protocol using TCP port 7890, the first step is to create a new application and define the default port. In App-ID, custom applications are defined by specifying the application name, the protocol (TCP/UDP), and the default port number, which allows the firewall to identify traffic for that application based on the port. This is the foundational step before any additional properties like timeouts or advanced settings can be configured.

Answer

Create a new application group.

Answer

Create a new custom application tag.

Answer

Create a new application filter.

Question 7

Based on the exhibit, what is the impact of the current HA state on the network?

Accepted Answer

Sessions will not be preserved during a failover. The exhibit shows that the HA pair's session synchronization is not synchronized (for example, the HA2 data link is down or session synchronization is disabled). In active/passive HA, session preservation requires session synchronization. Because sessions are not synchronized between the peers, a failover will drop existing sessions, so sessions will not be preserved.

Answer

Configuration changes are not synchronized

Answer

The passive firewall will preempt the active when the active fails

Answer

The HA pair cannot perform a failover

Question 8

A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?

Accepted Answer

Create an authentication profile using RADIUS with MFA enabled and assign it to the admin accounts.. To enforce MFA for administrative access on a Palo Alto Networks firewall, you must create an authentication profile that uses RADIUS (or another MFA-capable server) and then assign that profile to the admin accounts. The authentication profile defines how the firewall authenticates administrators, and when it points to an MFA-enabled RADIUS server, the firewall will require the second factor. Assigning the profile to admin accounts ensures that all administrative logins go through MFA.

Answer

Create a security policy to allow RADIUS traffic from the firewall to the RADIUS server.

Answer

Enable MFA in the User-ID agent configuration.

Answer

Configure an authentication enforcement rule in the authentication policy.

Question 9

A network engineer is troubleshooting an authentication issue where users in a specific group are not being prompted for credentials, even though the authentication policy matches their traffic. The firewall logs show that the traffic is allowed by the security policy. What is the most likely cause?

Accepted Answer

The users are in a group that is excluded from authentication in the authentication profile.. When an authentication policy matches traffic but users in a specific group are not prompted for credentials, the most likely cause is that the group is excluded from authentication in the authentication profile. An authentication profile can include an allow list/exclusion list; users in an excluded group are not prompted for authentication even though the authentication policy matches. Authentication policies are evaluated before security policies, so a security policy allowing the traffic does not bypass authentication.

Answer

The captive portal is not enabled on the interface.

Answer

The user-ID agent is not configured to include that group.

Answer

The authentication policy is placed after the security rule that allows the traffic.

Question 10

In an Active/Passive HA pair, which statement is true regarding configuration synchronization?

Accepted Answer

Only committed changes on the active are synced to the passive.. In an Active/Passive HA pair, configuration synchronization occurs only after changes are committed on the active firewall. The passive peer then receives the committed configuration via the HA control link (using TCP port 2928 by default). This ensures that only validated, committed changes are propagated, preventing the passive from receiving uncommitted or partial configurations that could cause instability.

Answer

Configuration is not synced automatically; the administrator must export and import.

Answer

All configuration changes on the active peer are automatically synced to the passive.

Answer

The passive peer initiates the sync.

Question 11

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

Accepted Answer

Verify that the user group mapping is correct.. Even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Answer

Restart the User-ID agent service.

Answer

Check the firewall's management plane CPU usage.

Answer

Ensure the firewall has a license for User-ID.

Question 12

Refer to the exhibit. A user in the 10.0.0.0/8 network is unable to access a web server at 172.16.1.10 which is in the DMZ zone. The firewall's security policy is shown: source zone trust, destination zone untrust, application web-browsing, action allow. What is the most likely reason for the failure?

Accepted Answer

The policy specifies the 'untrust' zone instead of the 'dmz' zone.. The policy's destination zone is 'untrust', but the server is in the 'dmz' zone, so the traffic does not match this policy. Option A is incorrect because the source IP range 10.0.0.0/8 includes the user's IP, so it is not misconfigured. Option C is incorrect because the policy has an 'allow' action, so it is not missing a permit. Option D is incorrect because 'web-browsing' is the correct application for HTTP traffic.

Answer

The source IP range 10.0.0.0/8 is misconfigured.

Answer

The policy is missing a 'permit' action.

Answer

The application 'web-browsing' is not the correct application for the traffic.

Question 13

What does the session state 'SYN_SENT' indicate about this traffic flow?

Accepted Answer

The firewall has sent a SYN packet and is waiting for a response.. The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Answer

The session has been torn down by the server.

Answer

The traffic is being dropped due to asymmetric routing.

Answer

The application has been identified as incomplete.

Question 14

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. In an Active/Active HA pair, session distribution is controlled by a hash-based algorithm that determines which firewall handles a given flow. When asymmetric routing and drops occur during high session utilization, the default algorithm may not distribute traffic evenly, causing one firewall to become overloaded. Adjusting the session distribution algorithm (e.g., from IP hash to round-robin or a weighted distribution) can better match the traffic patterns and balance the load, reducing asymmetry and drops.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions

Question 15

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

Accepted Answer

Traffic log. The Traffic log records every session that matches a security rule, including the rule ID, source/destination IPs, ports, and action (allow/deny). To verify that a specific security rule is being hit, you must examine the Traffic log, as it shows which rule processed each session. Configuration, Threat, and System logs do not contain per-session rule match data.

Answer

Configuration log

Answer

Threat log

Answer

System log