PCNSE Practice Test 17 — 15 Questions

Question 1

A network engineer is configuring HA on a pair of PA-5220 firewalls. The company requires that the HA1 control link be secured and that the firewalls authenticate each other. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable HA1 encryption by setting a pre-shared key in the HA configuration.. HA1 control link encryption and authentication are achieved by configuring a pre-shared key. This ensures that only the paired firewalls can exchange HA control messages and that the messages are encrypted. The pre-shared key must match on both peers. This is the standard method to secure HA1 and is a best practice when the HA1 link traverses untrusted networks.

Answer

Use the management interface for HA1 traffic and enable SSL/TLS encryption on the management plane.

Answer

Configure the HA1 link to use IPsec by creating a tunnel between the management interfaces.

Answer

Enable HA1 encryption by selecting the 'Encrypt HA1' checkbox and generating a self-signed certificate.

Question 2

An administrator is configuring HA on a pair of PA-5220 firewalls. They want to ensure that the HA1 link is redundant and can survive a single link failure. Which configuration should they use?

Accepted Answer

Configure HA1 on a dedicated interface and enable HA1 backup.. HA1 backup allows a secondary HA1 link to be configured on a different interface. If the primary HA1 link fails, the backup link is used, ensuring control link redundancy. This is the recommended configuration for HA1 redundancy.

Answer

Configure HA1 on an aggregate interface (AE) with multiple physical links.

Answer

Configure HA1 on a loopback interface and enable BFD.

Answer

Configure HA1 on a VLAN interface and enable LACP.

Question 3

A network engineer is troubleshooting why a Palo Alto Networks firewall is not generating any traffic logs for sessions that match a security policy rule set to allow. The engineer confirms that the rule is hit and traffic passes successfully. Which of the following is the most likely reason for the absence of logs?

Accepted Answer

The security policy rule does not have the 'Log at Session End' option enabled.. The absence of traffic logs for allowed sessions is typically due to the security policy rule not having the 'Log at Session End' option enabled. Even if the rule is hit and traffic passes, without this setting, the firewall will not generate a traffic log. Other potential causes like log storage issues or offloading would have broader effects or different symptoms. Therefore, checking the rule's logging configuration is the first step.

Answer

The log forwarding profile is misconfigured, preventing logs from being written to local storage.

Answer

The traffic is being offloaded to hardware and thus bypasses logging.

Answer

The firewall's log storage is full and is dropping new logs.

Question 4

A network engineer is troubleshooting an SSL decryption issue on a PA-5220 firewall. Users are unable to access a specific HTTPS website after SSL decryption was enabled. The engineer checks the Decryption policy and confirms that the rule for outbound HTTPS decryption is correctly configured and matched. The firewall's decryption profile is set to block sessions with untrusted issuers. The website uses a certificate signed by a public CA that is trusted by the firewall. What is the most likely cause of the access issue?

Accepted Answer

The website uses certificate pinning, causing the client to reject the firewall's forged certificate.. Certificate pinning causes clients to expect a specific certificate or public key for a website. When SSL Forward Proxy decryption is enabled, the firewall presents a forged certificate, which the client rejects due to pinning. This results in access failures. Exempting such sites from decryption is a typical solution. Other causes like expired certificates or licensing are not applicable here.

Answer

The firewall's decryption profile is blocking the session because the website's certificate is expired.

Answer

The firewall's SSL decryption license has expired, causing it to block decrypted sessions.

Answer

The website requires TLS 1.3, which is not supported by the firewall's decryption profile.

Question 5

A security administrator is configuring a firewall to inspect traffic between two internal zones. The administrator wants to ensure that the firewall performs application identification and content inspection on all allowed traffic. Which configuration is required to achieve this?

Accepted Answer

Create a security policy that allows the traffic and attach a Security Profile Group to the policy.. To perform application identification and content inspection on allowed traffic, a security policy must allow the traffic and have a Security Profile Group attached. The Security Profile Group contains the necessary profiles for antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking. Without these profiles, the firewall only identifies the application but does not inspect the content for threats.

Answer

Configure a Decryption policy to forward traffic to a content inspection engine.

Answer

Create a security policy with the action 'allow' and enable 'Log at Session End'.

Answer

Enable SSL decryption on the firewall for all traffic between the zones.

Question 6

A network security engineer is troubleshooting why a newly installed Palo Alto Networks firewall is not inspecting traffic between two internal subnets. The engineer confirms that the traffic is routed through the firewall, security policies are configured to allow and inspect the traffic, and no drop counters are incrementing. However, the firewall's session table shows sessions in an 'ACTIVE' state but with no application identified. Which component of the Palo Alto Networks Next-Generation Firewall is responsible for identifying the application in this scenario?

Accepted Answer

App-ID. App-ID is the Palo Alto Networks technology that identifies applications traversing the firewall. It uses signatures, protocol decoding, and behavioral heuristics to classify traffic accurately. In the scenario, sessions are active but no application is identified, indicating that App-ID has not yet completed its analysis. This could happen if the session is incomplete, if traffic is asymmetric, or if the application is unknown. Once App-ID identifies the application, the firewall can apply the appropriate security policy. The other options are related technologies but do not perform application identification.

Answer

User-ID

Answer

Content-ID

Answer

SSL Decryption

Question 7

A network security engineer is deploying a PA-5220 firewall in a data center. The firewall must inspect traffic between two internal segments (trust and dmz) and also provide security for outbound internet access. The engineer wants to ensure that when a packet arrives, the firewall properly identifies the application and enforces security policies. Which component is responsible for identifying the application regardless of port, protocol, or encryption?

Accepted Answer

App-ID. App-ID is the core technology that identifies applications by analyzing traffic characteristics, not just ports. It is essential for enforcing application-based security policies. Content-ID, User-ID, and SSL Decryption are supporting technologies that operate after or alongside App-ID but do not perform application identification themselves. Therefore, App-ID is the correct component for application identification.

Answer

Content-ID

Answer

SSL Decryption

Answer

User-ID

Question 8

A security administrator is troubleshooting why a user cannot access an internal server at 192.168.1.50 from the trust zone. The firewall is a PA-5220 running PAN-OS 10.2. The administrator checks the traffic log and sees that the session is allowed by a security policy rule. However, the user still cannot connect. The administrator runs 'show session all filter source 10.1.1.10 destination 192.168.1.50' and sees the session state as 'ACTIVE' but with 'tcp-rst-from-server' flag. What is the most likely cause?

Accepted Answer

The server is sending a TCP reset because it is not listening on the requested port.. The 'tcp-rst-from-server' flag in the session details indicates that the server sent a TCP reset packet. This usually means the server is not listening on the requested port or the service is unavailable. The firewall allowed the session, but the server refused the connection. The user cannot connect because the server actively rejected the SYN. Troubleshooting should focus on the server's service status and port configuration.

Answer

The firewall is performing SSL decryption and the certificate is invalid.

Answer

The firewall is dropping the packets due to a security profile.

Answer

The session is being aged out due to timeout.

Question 9

A network security engineer is troubleshooting why a user's session to a SaaS application is being decrypted by SSL Forward Proxy but then immediately reset. The engineer checks the session details and sees the session end reason as 'tcp-rst-from-server'. Packet capture on the firewall shows that the server is sending a TCP RST after the client sends a TLS Client Hello. The firewall's decryption profile is configured to block sessions with untrusted issuers. What is the most likely cause of the reset?

Accepted Answer

The server is rejecting the connection because the SNI in the Client Hello does not match the server's expected hostname, or the server requires mutual TLS authentication.. The correct answer is that the server is rejecting the connection due to SNI mismatch or mutual TLS requirements. When SSL Forward Proxy decrypts, it acts as a man-in-the-middle, and the server may see a different SNI or lack a client certificate, causing it to reset the connection. This is consistent with the observed 'tcp-rst-from-server' and the server sending a RST after receiving the Client Hello.

Answer

The firewall's forward trust certificate is not trusted by the client, causing the client to reset the connection.

Answer

The server is using a self-signed certificate that is not trusted by the firewall's forward trust certificate.

Answer

The server is configured to require TLS 1.3, but the firewall's decryption profile is set to only allow TLS 1.2, causing the server to reset the connection.

Question 10

A network security engineer is deploying a Palo Alto Networks firewall in a high-availability (HA) active/passive configuration. The engineer wants to ensure that the passive firewall takes over seamlessly if the active firewall fails. Which of the following is a requirement for HA active/passive configuration?

Accepted Answer

Both firewalls must have identical hardware models and software versions.. For HA active/passive, both firewalls must be identical in hardware model and PAN-OS software version to ensure compatibility and seamless failover. The passive firewall synchronizes configuration from the active firewall, so security policies are the same. Each firewall needs a unique management IP for separate management. Priority values are used for election but are not required to be higher on the active firewall. The passive firewall does not have a separate blocking policy.

Answer

The active firewall must have a higher priority value than the passive firewall.

Answer

Both firewalls must be configured with the same management IP address.

Answer

The passive firewall must have a separate security policy that blocks all traffic.

Question 11

A security administrator is designing a zero trust architecture using Palo Alto Networks Next-Generation Firewalls. They need to ensure that all traffic between the internal network and the internet is inspected, and that users are identified regardless of location. Which two components are required to achieve user identification for both on-premises and remote users? (Choose two.)

Accepted Answer

User-ID Agent to monitor directory servers and map IP addresses to usernames for on-premises users.. To identify users both on-premises and remotely, the administrator needs GlobalProtect for remote users and a User-ID Agent for on-premises users. GlobalProtect authenticates remote users and provides IP-to-username mapping, while the User-ID Agent monitors directory servers to map IP addresses to usernames for internal users. Together, they enable consistent user-based policy enforcement across locations.

Answer

Captive Portal to authenticate users who are not covered by other User-ID methods.

Answer

Syslog forwarding to send user mapping logs to an external server.

Answer

XML API to query the firewall for user mapping information.

Question 12

A firewall administrator is troubleshooting an issue where a PA-3260 is experiencing high dataplane CPU utilization. The administrator runs 'show running resource-monitor' and sees that the CPU is consistently above 90%. Which command should the administrator use to identify the top applications contributing to the high CPU usage?

Accepted Answer

show running resource-monitor application. The command 'show running resource-monitor application' provides per-application resource utilization, including CPU. This allows the administrator to see which applications are consuming the most dataplane CPU. Other commands like 'show system resources' give overall usage, and 'show session all filter application' lists sessions but not CPU impact. The ingress-backlogs command is for queue monitoring, not CPU attribution.

Answer

show system resources

Answer

show session all filter application

Answer

show running resource-monitor ingress-backlogs

Question 13

An engineer is deploying a new Palo Alto Networks firewall running PAN-OS 10.1 as a standalone device. The security team requires that the firewall forward syslog messages to an external server. After configuring the Syslog server profile and applying it to a Log Forwarding profile, the engineer notices that no logs are being received on the syslog server. The firewall's management interface can reach the syslog server on UDP port 514. Which action should the engineer take to resolve this issue?

Accepted Answer

Enable logging on the security policy rules that should generate the logs.. Log forwarding requires that the relevant security policy rules have logging enabled. Without logging, no traffic logs are generated, so nothing is sent to the syslog server even if the Syslog server profile and Log Forwarding profile are properly configured. Enabling logging on the security rules that handle the traffic of interest ensures that logs are created and then forwarded according to the Log Forwarding profile.

Answer

Add the syslog server's IP address to the firewall's management interface permitted IP list.

Answer

Configure a security policy rule that allows the management interface to send traffic to the syslog server.

Answer

Configure a NAT policy to translate the firewall's management IP to an external IP address.

Question 14

A network security engineer is investigating why a firewall's dataplane CPU is consistently at 95%. After reviewing the session table, they notice a large number of sessions in a 'discard' state. Which action should the engineer take first to resolve the high CPU utilization?

Accepted Answer

Check the security policy for a rule that denies traffic without sending a response.. Sessions in a discard state are often caused by a security policy rule that silently drops traffic without sending a response. This can lead to a large number of sessions lingering in the session table, consuming dataplane CPU. Reviewing and adjusting the security policy to send resets or ICMP unreachable messages can help clear these sessions more quickly and reduce CPU utilization.

Answer

Reduce the TCP handshake timeout value.

Answer

Increase the session timeout for TCP sessions.

Answer

Enable hardware offload for session setup.

Question 15

An administrator manages a PA-5220 pair running PAN-OS 11.1. During a change window, the active firewall's management plane becomes unreachable and the device fails over to the passive peer. The administrator wants to review the events that occurred on the failed device before the failover. Which action should the administrator take to obtain this information?

Accepted Answer

Connect to the failed device console and review the HA and system logs stored locally in the management plane log files.. Management plane logs are retained locally on each firewall and record system, HA, and configuration events. When the management interface is unreachable but the device still powers on, console access lets the administrator read those logs directly. Panorama config audit, HA state output, and session tables all describe current or configuration state rather than the historical event sequence needed here.

Answer

On the passive peer, run the show high-availability state command and export the output to a file for review.

Answer

Use the Panorama-managed Config Audit feature to compare the running configuration against the last committed version on the failed device.

Answer

On the active peer, run the show session all filter source command to identify sessions that terminated during the failover.