PCNSE Practice Test 15 — 15 Questions

Question 1

A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAML authentication with single sign-on.. SAML authentication with single sign-on (SSO) allows users to authenticate once per session via an external identity provider (IdP). The firewall validates the SAML assertion and maintains the session, so users are not prompted again until the session expires or is terminated. This meets the requirement of a single prompt per session without re-authentication.

Answer

LDAP authentication with a timeout.

Answer

Captive Portal with session cookie.

Answer

RADIUS authentication with one-time passwords.

Question 2

Which TWO of the following are true regarding Panorama's templates and device groups?

Accepted Answer

Templates are used to push network configurations such as interfaces, virtual routers, and zones.. Option B is correct because Panorama templates are specifically designed to push network-level configuration to managed firewalls, including interfaces, virtual routers, zones, and other network settings, which is their primary purpose. Option E is correct because Panorama includes a predefined 'Shared' device group at the top of the device group hierarchy, and policies defined there are inherited by all other device groups below it. Option A is incorrect because device groups can contain firewalls of different models, as long as they run compatible PAN-OS versions; model homogeneity is not required. Option C is incorrect because templates and device groups operate on different configuration scopes (network vs. policy/objects) and do not override each other in that manner. Option D is incorrect because Panorama can manage firewalls across different geographic locations, which is one of its key centralized-management benefits.

Answer

Device groups can only contain firewalls of the same model.

Answer

Templates override device group settings when both are applied.

Answer

Panorama cannot manage firewalls in different geographic locations.

Question 3

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

Accepted Answer

show session all filter source 10.1.1.100. The 'show session all filter source 10.1.1.100' command displays active sessions in the firewall's session table, including the source IP, destination IP, and the translated (NAT) IP addresses. This allows the administrator to verify whether the internal IP 10.1.1.100 is being NATed to a public IP when accessing the internet, as the session table shows both the pre-NAT and post-NAT source addresses.

Answer

show running nat-policy

Answer

show nat rule

Answer

show address 10.1.1.100

Question 4

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

Accepted Answer

The firewall's App-ID identified the traffic as a different application than the one specified in the rule. The 'application mismatch' log reason indicates that the firewall's App-ID engine identified the traffic as a different application than the one specified in the security rule. Even though the rule allows the application you intended, the actual traffic does not match that App-ID signature, so the session is denied. This is a common scenario when the application classification does not align with the rule's application object.

Answer

The application is not recognized by the firewall and is treated as unknown

Answer

The security rule is not configured to allow any application

Answer

The firewall's SSL decryption is misconfigured

Question 5

A user reports that after SSL decryption was enabled, certain web applications fail to load completely. What is the most likely reason?

Accepted Answer

The application uses certificate pinning which rejects the firewall's decryption certificate.. Certificate pinning is a security mechanism where an application embeds the exact certificate or public key of the server it expects to communicate with. When SSL decryption is enabled, the firewall replaces the original server certificate with its own decryption certificate. The application detects this mismatch and rejects the connection, causing it to fail to load completely. This is a common issue with applications that implement strict certificate pinning, such as banking apps or certain mobile applications.

Answer

The URL is not allowed in the decryption policy.

Answer

The user's browser proxy settings are incorrect.

Answer

The firewall's decryption is causing excessive latency.

Question 6

By default, what is the action on traffic between two different zones without any security rule?

Accepted Answer

deny. By default, Palo Alto Networks firewalls implement an implicit deny rule for inter-zone traffic. This means that if no security rule explicitly matches traffic between two different zones, the firewall drops the packet and logs it as a deny action. This default behavior ensures that all cross-zone traffic must be explicitly allowed by a security policy, enforcing a zero-trust model.

Answer

allow

Answer

depends on the application

Answer

prompt

Question 7

Which TWO components are part of the PAN-OS management plane?

Accepted Answer

Log collection and reporting. The PAN-OS management plane handles administrative and control functions rather than the actual data forwarding path. Option C, log collection and reporting, is correct because the management plane is responsible for gathering logs from the dataplane and generating reports, which administrators access via the management interface or external log collectors. Option D, the management interface, is correct because it is the dedicated out-of-band interface (typically MGT) used for administrative access such as SSH, HTTPS/WebUI, and API, and it belongs to the management plane. The other options do not belong: the SSL decryption engine (A) and App-ID engine (E) are dataplane security processing functions that inspect and classify traffic, and the packet buffer (B) is a dataplane memory resource used for queuing and forwarding packets, not a management-plane component.

Answer

SSL decryption engine

Answer

Packet buffer

Answer

App-ID engine

Question 8

A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?

Accepted Answer

Configure a certificate profile in the gateway's authentication settings. A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.

Answer

Define a tunnel interface with an IP address that matches the certificate subject

Answer

Set the gateway's IP pool to require certificate authentication

Answer

Configure client authentication in the portal with a certificate profile

Question 9

A firewall is part of a Panorama-managed environment. The administrator needs to ensure that only specific administrators can commit changes to devices. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure role-based access on Panorama.. Option B is correct because Panorama's role-based access control (RBAC) is the mechanism that defines what each administrator account is allowed to do, including whether they can push commits to managed devices; without configuring roles on Panorama, no granular restriction of commit rights is possible. Option C is correct because an admin role can be scoped with a commit scope limited to specific device groups (and templates), so administrators assigned that role can only commit changes to those device groups rather than to all managed firewalls. Option A is not required because MFA strengthens authentication but does not restrict which devices an admin can commit to. Option D is incorrect because template stacks are configuration containers for pushing settings to firewalls, not a permission-control feature. Option E is incorrect because firewalls in a Panorama-managed environment do not have a per-device 'require approval for commits' setting that governs administrator commit permissions.

Answer

Enable Multi-Factor Authentication for all admins.

Answer

Use template stacks to restrict commit permissions.

Answer

Set the firewall to require approval for commits.

Question 10

An administrator is troubleshooting high CPU usage on a PA-5250 firewall. The CPU usage spikes every 5 minutes. Which CLI command should be used to identify the process causing the spike?

Accepted Answer

show running resource-monitor. The 'show running resource-monitor' command displays real-time CPU and memory usage per process on Palo Alto Networks firewalls. Since the CPU spikes every 5 minutes, this command can identify which specific process (e.g., management-plane daemon, dataplane task) is consuming the most CPU during those intervals, enabling targeted troubleshooting.

Answer

show session all

Answer

show dataplane

Answer

show system resources

Question 11

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

Accepted Answer

The proxy IDs (interesting traffic) are not configured correctly.. When the IPSec tunnel is up but no traffic passes, the most common cause is misconfigured proxy IDs (also called interesting traffic selectors). Proxy IDs define which source/destination subnets are permitted through the tunnel; if they don't match on both peers, the tunnel may establish (IKE and IPsec SAs are created) but the firewall will not encrypt or forward traffic because it does not match the defined selectors. Since the firewall policy allows any-any, the issue is not a policy block, pointing directly to proxy ID mismatch.

Answer

The IKE phase 1 proposal is mismatched.

Answer

The IPSec crypto profile uses AES-256 and the peer uses 3DES.

Answer

The tunnel interface MTU is set too low.

Question 12

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

Accepted Answer

Add the URL to an allow list in the URL filtering profile. The traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Answer

Disable URL filtering on the existing security rule

Answer

Check the user-ID mapping to ensure the user is authenticated

Answer

Create a new security rule allowing the user's IP to any

Question 13

Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?

Accepted Answer

The identity provider's metadata must be imported into the firewall.. For SAML-based single sign-on (SSO) with a Palo Alto Networks firewall acting as the service provider (SP), the firewall must trust the identity provider (IdP). This trust is established by importing the IdP's SAML metadata (which includes the IdP's entity ID, single sign-on URL, and signing certificate) into the firewall. Without this metadata, the firewall cannot validate SAML assertions from the IdP, making authentication impossible.

Answer

A certificate from a public CA for the SAML identity provider.

Answer

The firewall must be configured as a SAML identity provider.

Answer

User-ID must be configured to poll the SAML identity provider.

Question 14

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 15

A firewall administrator needs to troubleshoot a connectivity issue where users in the 10.0.1.0/24 subnet cannot reach the internet. The administrator suspects a missing policy. Which tool within the firewall's web interface can be used to test which security policy will be matched for a given traffic flow?

Accepted Answer

Policy Optimizer > Test Policy Match. The 'Test Policy Match' tool under Policy Optimizer allows an administrator to simulate a specific traffic flow (source/destination IP, port, protocol) and see which security policy rule it matches. This directly addresses the need to verify whether a missing or misconfigured policy is blocking internet access for the 10.0.1.0/24 subnet.

Answer

Network > Virtual Routers

Answer

Monitor > Logs > Traffic

Answer

Device > Setup > Management