PCNSE Practice Test 15 — 15 Questions

Question 1

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

Accepted Answer

Create a custom application with a data pattern (signature).. Option C is correct because creating a custom application with a data pattern (e.g., a signature) allows the firewall to identify the proprietary protocol without altering the default engine. Option A is wrong because enabling SSL decryption is not relevant for a proprietary protocol that is not SSL. Option B is wrong because an application override bypasses App-ID entirely. Option D is wrong because using a port override does not improve identification; it only bypasses App-ID.

Answer

Configure a port-based application override for port 4444.

Answer

Enable SSL decryption for the ERP traffic.

Answer

Create an application override to allow the traffic without App-ID.

Question 2

An organization uses a SaaS application that runs on a dynamic set of IP addresses. The application traffic is currently identified as ssl and not as the specific application. How can the administrator improve application identification for this SaaS application?

Accepted Answer

Create a custom application with hostname conditions.. Option C is correct: Creating a custom application with hostname conditions (e.g., using SNI) allows the firewall to identify the SaaS application even when IPs change. Option A is wrong because port override bypasses App-ID. Option B is wrong because URL filtering does not affect App-ID. Option D is wrong because disabling App-ID is counterproductive.

Answer

Disable App-ID for that traffic to reduce overhead.

Answer

Use a port-based application override.

Answer

Configure a URL filtering category for the application.

Question 3

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. Options A, B, and D are correct: An incorrectly configured Application Override policy could misdirect traffic, outdated application signatures may not recognize the custom app, and a non-standard port could cause the custom app to be misidentified as web-browsing. Option C is wrong because SSL decryption is not directly related to misidentification as web-browsing. Option E is wrong because tap mode is not relevant in inline mode.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 4

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. Options A and B are correct: Setting the application to the desired app ensures the rule matches that app, and setting the service to application-default ensures the rule only matches when the app uses its standard port, preventing other apps on the same port from matching. Option C is not specific to application matching. Options D and E are not required for matching.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 5

Refer to the exhibit. An administrator notices that HTTPS traffic to a specific website is being denied. What is the most likely cause?

Accepted Answer

The HTTPS traffic is being identified as web-browsing instead of ssl, so it does not match rule 2 and is denied by rule 3.. Option A is correct: The firewall may identify HTTPS traffic as web-browsing due to a lack of SSL decryption or other factors. Rule 1 allows web-browsing but with service application-default, which expects port 80, not 443. Therefore, HTTPS traffic does not match rule 1, nor rule 2 (since it's identified as web-browsing), and falls to rule 3, which denies. Option B is wrong because rule 2 allows ssl on port 443, but the traffic is not identified as ssl. Option C is wrong because rule 2 does not require other services. Option D is wrong because rule 4 is for trust-to-trust, not trust-to-untrust.

Answer

Rule 2 does not have a service set to application-default, so it cannot match the traffic.

Answer

The traffic is from trust to trust, matching rule 4, but still denied.

Answer

The traffic requires a specific service other than application-default.

Question 6

A managed security service provider (MSSP) manages firewalls for multiple customers. One customer reports that their ERP application traffic is being dropped intermittently. The firewall logs show that the traffic is sometimes identified as 'erp-app' and allowed, and other times identified as 'unknown-tcp' and denied. The ERP application uses a proprietary protocol over TCP port 5555. The firewall has a custom application definition for 'erp-app' that uses a data pattern. The administrator verifies that the data pattern is correct. What should the administrator do to ensure consistent identification?

Accepted Answer

Modify the custom application to include a port condition (default port 5555).. Option D is correct: Adding a port condition to the custom application definition (e.g., setting the default port to 5555) provides a fallback identification mechanism when the data pattern is not detected in a session. This ensures that traffic on port 5555 is consistently identified as 'erp-app'. Option A is wrong because increasing session timeout does not affect identification. Option B is wrong because the protocol is proprietary, not SSL. Option C is wrong because vulnerability protection is for threat prevention, not identification.

Answer

Increase the session timeout for the application.

Answer

Create a vulnerability protection profile to inspect the traffic.

Answer

Enable SSL decryption on the firewall.

Question 7

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Accepted Answer

The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.. The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.

Answer

The destination network 10.3.3.0/24 is not in the routing table.

Answer

The source network 10.2.2.0/24 is not in the routing table.

Answer

The default route 0.0.0.0/0 is missing.

Question 8

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets

Question 9

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Accepted Answer

Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object. Option C is correct because the DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.

Answer

Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server

Answer

Change the security policy to use the IP address instead of the FQDN

Answer

Configure a static route for the FQDN's IP address pointing to the MPLS interface

Question 10

An administrator configures an authentication policy to require authentication for the 'ssl' application. After committing, the firewall does not prompt users for credentials when they access HTTPS sites. Which step is most likely missing?

Accepted Answer

The authentication policy must be placed before the security rule that allows the web-browsing traffic.. Authentication policies are evaluated before security policies. If the authentication policy is placed after the security rule that allows the traffic, users bypass authentication. Option B correctly identifies that the authentication policy must be placed before the security rule.

Answer

The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.

Answer

The 'ssl' application must have a custom signature defined.

Answer

The user-ID agent is not set to capture HTTPS traffic.

Question 11

A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)

Accepted Answer

Use SAML SSO for cloud applications.. Best practices include SAML SSO for cloud apps (A), MFA for VPN (C), and user-ID via domain controller probing (E). Options B and D are not recommended.

Answer

Use the same authentication profile for all traffic.

Answer

Deploy captive portal only for on-premises users.

Question 12

To reduce the number of authentication prompts for users accessing multiple applications through the firewall, which configuration is recommended?

Accepted Answer

Enable session cookies in the authentication policy. Option A is correct because enabling session cookies allows users to skip re-authentication for a set duration. Option B is incorrect because certificate-based authentication requires certificates on all devices. Option C is incorrect because increasing authentication timeout still requires initial authentication per session. Option D is incorrect because disabling authentication for certain apps defeats the purpose.

Answer

Increase the authentication timeout value

Answer

Use certificate-based authentication

Answer

Disable authentication for commonly used applications

Question 13

A company is migrating to cloud-based SaaS applications and wants to enforce SAML-based authentication with single logout. They have a Palo Alto firewall running the latest PAN-OS. What is the recommended configuration to enable SAML authentication for these applications?

Accepted Answer

Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.. Option C is correct because SAML authentication policy on the firewall is used to enforce SAML authentication for web-based applications, and enabling the authentication policy allows the firewall to redirect users to the SAML IdP for authentication. Option A is partially correct but missing the policy component. Option B is for VPN access, not direct app authentication. Option D is not relevant as User-ID agent does not handle SAML sessions.

Answer

Create an authentication profile with SAML identity provider and assign it to the application.

Answer

Configure GlobalProtect with SAML authentication to access the SaaS applications.

Answer

Use the User-ID agent to synchronize SAML sessions between the identity provider and the firewall.

Question 14

A company has configured multi-factor authentication (MFA) via an authentication sequence using LDAP and RADIUS. Users authenticate successfully with LDAP but the MFA prompt from RADIUS does not appear. What is the most likely cause?

Accepted Answer

The authentication sequence must be configured to 'require all' or 'continue on success' to enforce each factor.. The authentication sequence processes factors in order. If 'continue on failure' is set, the sequence stops on the first successful factor, skipping subsequent ones. Option C correctly identifies that the sequence should be set to 'continue on success' or 'require all' to enforce all factors.

Answer

The RADIUS server profile has the wrong shared secret.

Answer

The authentication policy only covers HTTP applications.

Answer

The authentication sequence is set to 'continue on failure' and the LDAP authentication succeeds.

Question 15

When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

Accepted Answer

less mp-log authd.log. 'show authentication rule matching traffic from the user's IP' (B) checks if the authentication rule triggers for the traffic, and 'less mp-log authd.log' (C) shows detailed authentication server interaction. Options A, D, E are less direct.

Answer

show running security-policy

Answer

show user user-id count

Answer

show system resources