PCNSE Practice Test 17 — 15 Questions

Question 1

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Accepted Answer

The static route in VR1 does not point to an interface or next hop that is reachable via VR2.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Answer

The firewall does not support multiple virtual routers.

Answer

The virtual routers are not connected to each other.

Answer

NAT is not configured on VR2.

Question 2

A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?

Accepted Answer

The HA2 link is down or misconfigured.. In active/passive HA, the HA2 link is used for session synchronization and state propagation. If the HA2 link is down or misconfigured, the active firewall cannot synchronize session state to the passive unit, causing it to report 'non-functional' even though the passive unit sees itself as 'passive'. The HA1 link handles heartbeats and configuration sync, which may still be operational, but without a functional HA2 link, the HA pair cannot maintain proper state synchronization, leading to the active firewall's non-functional state.

Answer

The HA1 link is down or misconfigured.

Answer

The HA2 link is being used for management traffic.

Answer

The preemptive setting is enabled on both firewalls.

Question 3

An administrator is configuring authentication for a captive portal. Which two configuration steps are necessary? (Choose two.)

Accepted Answer

Create an authentication policy matching the captive portal traffic.. Correct steps: A (create authentication policy to redirect to captive portal) and C (configure captive portal profile with authentication server). Options B and D are not strictly necessary for captive portal to function.

Answer

Enable user-ID on the interface where users connect.

Answer

Configure a security policy to allow the captive portal traffic before authentication.

Answer

Import the captive portal certificate.

Question 4

An organization needs to enforce authentication for application-based policies. Users are in multiple AD groups. Which authentication enforcement method best scales and minimizes administrative overhead?

Accepted Answer

Authentication Policy with user group mapping. Option E is correct because Authentication Policy with user group mapping allows group-based authentication enforcement without modifying security policies. Option A is incorrect because SSO with Kerberos requires Kerberos realm configuration and may not scale well. Option B is incorrect because Captive Portal with RADIUS requires per-user configuration. Option C is incorrect because GlobalProtect with client certificate requires client deployment overhead. Option D is incorrect because SSL decryption does not enforce authentication.

Answer

Single Sign-On with Kerberos

Answer

Captive Portal with RADIUS

Answer

SSL Decryption with User-ID

Answer

GlobalProtect with client certificate

Question 5

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

Accepted Answer

The firewall is not seeing the full SSL handshake due to asymmetric routing.. When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Answer

SSL decryption must be enabled for the firewall to correctly identify SSL traffic.

Answer

The default interzone rule is blocking the SSL identification packets.

Answer

The security policy allows 'web-browsing' before 'ssl' in the rule order.

Question 6

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

Accepted Answer

The authentication rule is placed after the security policy that allows the traffic.. The authentication rule and security rule both match the same traffic. Since the security rule is evaluated before authentication rules (unless the authentication rule is in a pre-rulebase), the traffic is allowed without authentication. Option C is correct.

Answer

The application 'ssl' is not correctly identified.

Answer

The authentication rule is placed before the security policy in the rulebase.

Answer

The authentication profile 'AuthProfile' is not configured.

Question 7

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

Accepted Answer

Configure an Authentication Policy to enforce user authentication for their traffic. Option D is correct because configuring Authentication Policy to force explicit authentication for those users will create IP-to-user mappings when they authenticate. Option A is incorrect because increasing timeout does not solve the mapping issue. Option B is incorrect because User-ID agent with WMI may not keep up with rapid changes. Option C is incorrect because GlobalProtect with pre-logon is for machine authentication.

Answer

Increase the IP-to-user mapping timeout

Answer

Use GlobalProtect with pre-logon token

Answer

Deploy a User-ID agent with WMI probing

Question 8

After a PAN-OS upgrade from 9.1 to 10.2, users report that captive portal authentication fails consistently. The authentication profile uses LDAP and the LDAP server is reachable from the firewall. The captive portal page loads, but after entering credentials, users are redirected back to the login page. What is the most likely cause?

Accepted Answer

The captive portal authentication profile is not applied to the ingress interface after the upgrade.. Option D is correct because captive portal authentication requires the authentication profile to be applied to the ingress interface; after an upgrade, the interface configuration might be lost or not applied correctly. Option A is unlikely since LDAP schema changes are rare. Option B is not a common issue. Option C would cause a certificate warning, not a loop.

Answer

The authentication sequence order in the profile is incorrect.

Answer

The captive portal certificate is mismatched with the LDAP server certificate.

Answer

The LDAP server schema has changed after the upgrade.

Question 9

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

Accepted Answer

Authentication profile referencing the SAML IdP profile. Option C is correct because an Authentication Profile referencing the SAML IdP profile is mandatory for the portal to use SAML. Option A is incorrect because SSL decryption is not required for SAML. Option B is incorrect while a certificate is needed for the portal, it is not specific to SAML. Option D is incorrect because LDAP server profile is for LDAP, not SAML.

Answer

LDAP server profile for user lookup

Answer

Server certificate for the portal

Answer

SSL decryption rule

Question 10

Which TWO authentication methods are supported for captive portal on a Palo Alto Networks firewall?

Accepted Answer

SAML. SAML and RADIUS are supported for captive portal authentication. Kerberos is not a direct method for captive portal; TACACS+ is not supported; Local database is supported but not listed as an option here? Actually local database is supported but we only need two correct: SAML and RADIUS.

Answer

TACACS+

Answer

Local Database

Answer

Kerberos

Question 11

A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?

Accepted Answer

Authentication Policy requiring authentication for all traffic. Option B is correct because Authentication Policy enforces authentication before allowing traffic, regardless of IP address. Option A is incorrect because GlobalProtect client certificates may not prevent IP spoofing. Option C is incorrect because Captive Portal requires interaction, but users may still bypass if they don't go through it. Option D is incorrect because Security Policy with user attribute relies on User-ID, which can be spoofed if not enforced.

Answer

GlobalProtect client certificate authentication

Answer

Security policy using source-user attribute

Answer

Captive Portal with cookie-based authentication

Question 12

Which THREE components are required to deploy the Palo Alto Networks User-ID agent in a typical Windows environment to map users to IP addresses?

Accepted Answer

Active Directory domain to query user information. The User-ID agent requires the agent software, a directory service (like Active Directory) for user lookup, and a mapping database to store IP-to-user mappings. An LDAP server is already implied by AD, and the firewall management server is not required for the agent itself.

Answer

Firewall management server (Panorama)

Answer

LDAP server (non-AD) for authentication

Question 13

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Options A and C are correct. User group membership allows group-based enforcement, and application type allows context-aware enforcement. Option B (time of day) is possible but not a primary factor; option D (source IP) is often used but not a primary design factor; option E (destination port) is less relevant for authentication.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 14

Which THREE components are part of the GlobalProtect infrastructure? (Choose three.)

Accepted Answer

GlobalProtect Gateway. Options A, B, and D are correct. The Portal distributes configuration, Gateways provide secure access, and Clients connect to them. Option C (Firewall management interface) is not part of GlobalProtect infrastructure; it's used for managing the firewall. Option E (Authentication server) is a backend component but not part of GlobalProtect infrastructure itself.

Answer

Firewall management interface

Answer

Authentication server

Question 15

Which TWO are prerequisites for using Authentication Policy? (Choose two.)

Accepted Answer

User-ID is configured. Options A and D are correct. User-ID must be configured to identify users, and an authentication profile must be defined to specify the authentication method. Option B (SSL decryption) is not required. Option C (security policy with user attribute) is not a prerequisite, though often used. Option E (transparent mode) is false.

Answer

The firewall is in transparent mode

Answer

SSL decryption is enabled

Answer

A security policy rule exists with user attributes