PCNSE Practice Test 15 — 15 Questions

Question 1

After upgrading a firewall pair from PAN-OS 9.1 to 10.0, a route-based IPsec VPN to a partner is no longer establishing. The tunnel is configured with a tunnel interface (tunnel.1) with IP 10.0.0.1/30 and the remote tunnel interface is 10.0.0.2/30. IKE phase 1 completes successfully, but phase 2 fails with 'no proposal chosen' on both sides. Both firewalls have identical IPsec crypto profiles (ESP-AES-256, SHA-256, DH-5, 1-hour lifetime). What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The proxy ID configuration was removed during the upgrade. During a PAN-OS upgrade, proxy ID configurations for route-based IPsec VPNs can be lost or reset to default values. Since the tunnel uses a numbered tunnel interface (10.0.0.1/30), the firewall automatically generates proxy IDs based on the tunnel interface IP and remote tunnel interface IP. If the proxy IDs are missing or mismatched after the upgrade, Phase 2 fails with 'no proposal chosen' even though the crypto profiles match. The fix is to verify and reconfigure the proxy IDs under the IPsec tunnel configuration.

Answer

The tunnel interface IP address conflicts with another interface

Answer

The new PAN-OS version requires a stronger DH group for IPsec

Answer

A security policy block IKE is blocking the tunnel

Question 2

An administrator has applied the above configuration on a firewall. What will happen to traffic destined to TCP port 2525?

Accepted Answer

All traffic on TCP port 2525 will be classified as the application 'smtp'.. The firewall's application override configuration explicitly maps TCP port 2525 to the application 'smtp'. When an application override is applied, the firewall bypasses App-ID and classifies all traffic matching the specified port and protocol as the defined application, regardless of the actual payload. This means any traffic on TCP port 2525 will be treated as SMTP traffic for policy enforcement and inspection purposes.

Answer

The firewall will perform deeper inspection to identify the application.

Answer

The traffic will be blocked because the application is unknown.

Answer

The traffic will be treated as generic TCP and passed without inspection.

Question 3

Which TWO authentication methods are supported for captive portal on a Palo Alto Networks firewall?

Accepted Answer

SAML. SAML enables browser-based SSO using an external IdP. RADIUS is widely used for network authentication and integrates with existing RADIUS servers. Local Database allows authentication against local user entries on the firewall. All three methods are supported for captive portal; the question requires any two.

Answer

TACACS+

Answer

Kerberos

Question 4

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

Accepted Answer

The authentication rule is placed after the security policy that allows the traffic.. The authentication rule is evaluated after the security policy in the rulebase (unless placed in a pre-rulebase). Since the security policy allows the HTTPS traffic without requiring authentication, users are not prompted. For authentication to be enforced, the authentication rule must be placed before the security policy or in a pre-rulebase, which corresponds to option A.

Answer

The application 'ssl' is not correctly identified.

Answer

The authentication rule is placed before the security policy in the rulebase.

Answer

The authentication profile 'AuthProfile' is not configured.

Question 5

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Accepted Answer

Verify the routing table on both firewalls.. Even if the VPN tunnel is up (Phase 1 and Phase 2 SAs established), traffic may still fail if the firewall does not have a route to the destination network via the tunnel interface. Without a correct route in the routing table, the firewall will drop the packet or send it out the wrong interface. Verifying the routing table ensures that the tunnel interface is the next hop for the remote subnet.

Answer

Increase the IPSec SA lifetime.

Answer

Ensure the tunnel interface is placed in a virtual router.

Question 6

Given the security policy above, what will happen to an HTTP request from a user to a public website?

Accepted Answer

It will be allowed because rule 1 matches and action is allow.. Rule 1 matches the HTTP request because it typically includes the application 'web-browsing' (or a broader application category) and the action is set to 'allow'. Since security policy evaluation in Palo Alto Networks firewalls is first-match, the traffic is permitted by rule 1 before reaching rule 2. The threat profile does not block the request unless it detects malicious content, which is not indicated in the question.

Answer

It will be allowed but then blocked by the threat profile.

Answer

It will be denied because web-browsing is not identified.

Answer

It will be denied because rule 2 blocks all.

Question 7

Which best practice should be followed for certificate management when deploying SSL Forward Proxy decryption in a large enterprise?

Accepted Answer

Use an internal certificate authority (CA) and distribute the CA certificate to all clients via Group Policy.. Using an internal CA and distributing its certificate via Group Policy ensures that all clients trust the decryption certificate used by the firewall to re-encrypt traffic. This avoids certificate warnings and allows seamless SSL Forward Proxy decryption. It also enables centralized management and revocation, which is critical for large enterprise deployments.

Answer

Use a self-signed certificate and manually install it on each client.

Answer

Use a wildcard certificate from a public CA to simplify deployment.

Answer

Use a certificate from a public CA that is already trusted by clients.

Question 8

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

Accepted Answer

Configure log export and auto-deletion in Log Settings. The firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Answer

Add an external disk to the firewall

Answer

Disable logging for non-critical traffic

Answer

Manually delete logs from the CLI

Question 9

A company has configured a security policy that allows HTTP traffic from the internal network 10.0.0.0/8 to the internet. However, users from subnet 10.2.0.0/24 are unable to access external websites. The firewall logs show that traffic from 10.2.0.100 to 203.0.113.1 on port 80 is being denied. Which action should the administrator take to resolve the issue?

Accepted Answer

Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.. In a stateful firewall like Palo Alto Networks, security rules are evaluated in order from top to bottom, and the first matching rule is applied. If a deny rule exists above any allow rule for the 10.2.0.0/24 subnet, traffic from that subnet will be denied. Adding a new allow rule for 10.2.0.0/24 and placing it above the existing deny rule ensures that HTTP traffic from that subnet is permitted before reaching the deny rule.

Answer

Modify the existing allow rule to include the entire 10.2.0.0/24 subnet in the source.

Answer

Change the destination zone of the allow rule to 'any'.

Answer

Delete the deny rule that is blocking the traffic.

Question 10

Based on the exhibit, what is the most likely action for the firewall to take on this session?

Accepted Answer

Bypass decryption and allow the session to proceed.. The firewall is configured for SSL Forward Proxy decryption, but the server certificate is self-signed or otherwise untrusted (e.g., expired, mismatched CN). In such cases, the firewall cannot re-sign the certificate to establish a trusted decrypted session. The configured action for untrusted server certificates is 'bypass decryption,' which allows the session to proceed without decryption, logging the bypass. Option D is correct because the firewall will not block or drop the session by default when bypass is configured.

Answer

Re-issue a new certificate to the client.

Answer

Block the session because the server certificate is invalid.

Answer

Drop the session and log a security alert.

Question 11

A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?

Accepted Answer

The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.. When SAML authentication succeeds but the user is repeatedly redirected to the IdP login page, the most likely cause is that the GlobalProtect gateway's SAML cookie expiration timeout is set too short. This timeout controls how long the gateway retains the SAML authentication assertion; once it expires, the gateway treats the session as unauthenticated and forces a new SAML authentication flow, even though the IdP session may still be valid. The symptom of repeated redirects after successful login points to the gateway-side timeout, not the IdP-side timeout.

Answer

The authentication policy is misconfigured.

Answer

The IdP session timeout is set too short.

Answer

The IdP certificate has expired.

Question 12

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct. This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile

Question 13

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 14

An organization uses captive portal authentication. Users report that after closing the browser, they are still authenticated and can access resources without re-authenticating. How can the administrator enforce re-authentication after browser closure?

Accepted Answer

Clear the 'allow session cookie' option in the captive portal profile.. Captive portal uses a session cookie to maintain authentication. Clearing the 'allow session cookie' option forces the user to authenticate for each new browser session. Option A is correct.

Answer

Configure the authentication enforcement to require authentication for each session.

Answer

Set the session timeout to 0 in the captive portal profile.

Answer

Disable the 'session cookie' setting in the captive portal profile and change the authentication profile to use RADIUS.

Question 15

Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)

Accepted Answer

Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.. The decryption log provides direct visibility into SSL/TLS handshake failures. Errors like 'ssl_decrypt_unsupported_cipher' indicate the firewall cannot negotiate a cipher it supports, while 'ssl_decrypt_cert_verify_failed' points to certificate validation issues, such as an untrusted or expired server certificate. These logs are the primary diagnostic tool for pinpointing why decryption fails for specific HTTPS sites.

Answer

Update the URL filtering database to ensure the site is categorized correctly.

Answer

Disable decryption globally to see if the sites become accessible.