PCNSE Practice Test 18 — 15 Questions

Question 1

A network administrator needs to monitor the firewall's interface status and receive alerts when an interface goes down. Which built-in feature should they configure?

Accepted Answer

SNMP traps for linkDown. SNMP traps are the standard method for receiving real-time alerts on interface status changes. Configuring SNMP traps for linkDown events allows the administrator to be notified immediately when an interface goes down. Other options like syslog, email alerts, or NetFlow do not provide the same immediate and specific alerting for interface status.

Answer

Syslog forwarding with severity level 'critical'

Answer

NetFlow export for interface statistics

Answer

Email alerts for system logs

Question 2

An administrator is troubleshooting a Palo Alto Networks firewall and needs to view the current sessions that are active on the firewall. The administrator wants to see details such as source and destination IP addresses, application, and security policy applied. Which CLI command should the administrator use?

Accepted Answer

show session all. The 'show session all' command is the correct CLI command to display all active sessions on a Palo Alto Networks firewall, including source and destination IP addresses, application, and the security policy applied. It provides the detailed session information the administrator needs to troubleshoot or monitor current traffic.

Answer

show running session all

Answer

show session info

Answer

show session table

Question 3

An administrator notices that the firewall's dataplane CPU is consistently high and wants to determine which application is generating the most traffic without waiting for scheduled reports. Which action provides the most immediate visibility into top applications by session and byte count?

Accepted Answer

Use the Application Command Center (ACC) on the dashboard, which aggregates traffic by application, source, and destination.. The Application Command Center aggregates log data into dashboard widgets that show top applications, users, and threats, updating as logs are generated. It provides immediate operational visibility without waiting for a scheduled report and summarizes far more usefully than raw session or packet data. Scheduled reports and packet captures are slower or more manual and do not deliver the ranked application view required.

Answer

Enable packet capture on the untrust zone and inspect the captured packets to identify the dominant application.

Answer

Configure a new scheduled report for application usage and wait for the next daily run to review the results.

Answer

Run the show session all command and manually sort the output by byte count to identify the busiest applications.

Question 4

A company has deployed two Palo Alto Networks firewalls in an active/passive HA configuration. During a failover test, the engineer notices that the passive firewall did not take over when the active firewall's data plane interface went down. The engineer reviews the HA configuration and sees that the HA1 link is up and the HA2 link is up. What is the most likely reason for the failover not occurring?

Accepted Answer

Link monitoring is not enabled on the data plane interface.. Failover in an active/passive HA pair is triggered by link monitoring and path monitoring. If link monitoring is not enabled on the data plane interface that went down, the firewall does not detect the failure and therefore does not initiate a failover. The HA1 and HA2 links being up only ensure control and data synchronization, not failure detection.

Answer

The HA2 link is not configured for session synchronization.

Answer

The HA1 link is not configured with a backup path.

Answer

The passive firewall is in a suspended state.

Question 5

Which THREE of the following are mandatory components for GlobalProtect client connectivity?

Accepted Answer

Authentication profile.. Option A (Authentication profile) is correct because the GlobalProtect portal and/or gateway must reference an authentication profile to authenticate users before granting access, making it a mandatory component for client connectivity. Option D (Gateway configuration) is correct because the GlobalProtect gateway is the actual security enforcement point that terminates the client tunnel and provides access to protected resources; without it, clients cannot establish connectivity. Option E (Portal configuration) is correct because the portal is the initial connection point that delivers client configuration and gateway information to the GlobalProtect agent, and it is required for the client to discover and connect to gateways. Option B (Client certificate) is not mandatory because certificate-based authentication is only one possible method; username/password or other authentication methods can be used instead. Option C (DNS suffix) is not mandatory because it is an optional configuration setting used for split-DNS or internal name resolution, not a requirement for establishing GlobalProtect connectivity.

Answer

Client certificate.

Answer

DNS suffix.

Question 6

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Accepted Answer

The firewall can buffer up to 1024 KB of packet data for App-ID analysis.. The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Answer

App-ID can only handle 1024 KB of packet data per session.

Answer

The firewall logs the first 1024 KB of every session for App-ID.

Answer

The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

Question 7

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 8

Refer to the exhibit. Based on the log entry, what action was taken on this traffic?

Accepted Answer

The traffic was dropped.. The log entry shows the action field as 'drop', which indicates the firewall denied the traffic. In Palo Alto Networks firewalls, a 'drop' action means the packet was silently discarded without sending a TCP reset or ICMP unreachable message. Therefore, option C is correct.

Answer

The traffic was allowed with a reset.

Answer

The action could not be determined.

Answer

The traffic was allowed and logged.

Question 9

Refer to the exhibit. An administrator has configured this decryption policy but users in the 10.1.1.0/24 subnet receive certificate warnings when accessing HTTPS sites. What is the most likely cause?

Accepted Answer

The decryption certificate is not trusted by clients. Certificate warnings occur when the decryption certificate used by the firewall is not trusted by the client machines. In a forward proxy decryption scenario, the firewall generates a new certificate on-the-fly for each HTTPS session, and if that certificate is not installed in the client's trusted root store, the browser will display a security warning. This is the most common cause of certificate warnings in decryption deployments.

Answer

The rule should be at the top of the rulebase

Answer

The destination address should be specific

Answer

The application should be web-browsing

Question 10

A network engineer is configuring HA on a pair of PA-5220 firewalls. The HA1 link is configured over a dedicated interface, and HA1 backup is configured over the management interface. The engineer wants to ensure that HA1 control traffic is encrypted and authenticated. Which action should be taken?

Accepted Answer

Enable HA1 encryption and authentication in the HA settings.. HA1 encryption and authentication is a built-in feature that secures control traffic between HA peers. It uses a pre-shared key to encrypt and authenticate HA1 packets, protecting against eavesdropping and tampering. This is the recommended method when HA1 traverses untrusted networks, such as when using the management interface as HA1 backup. Other options like IPsec or SSH are not applicable to HA1.

Answer

Enable SSL/TLS on the HA1 interface.

Answer

Use SSH to tunnel HA1 traffic.

Answer

Configure IPsec on the HA1 interface.

Question 11

Which THREE of the following are core components of the GlobalProtect solution? (Choose exactly three.)

Accepted Answer

GlobalProtect Gateway. The three core components of the GlobalProtect solution are the GlobalProtect Portal (E), the GlobalProtect Gateway (B), and the GlobalProtect Client (C). The GlobalProtect Portal (E) is the web-based interface that authenticates end users, distributes the GlobalProtect agent/app and its configuration, and provides the list of available gateways. The GlobalProtect Gateway (B) is the security appliance (firewall or Prisma Access) that terminates the tunnels and enforces security policy, providing access to internal resources. The GlobalProtect Client (C) is the agent software installed on endpoints (Windows, macOS, Linux, iOS, Android) that connects to the portal and gateway to establish the VPN connection. The GlobalProtect License Server (A) is not a core component; licensing is managed through the firewall or Panorama, not a separate license server. The GlobalProtect Mobile App (D) is not a distinct core component — mobile support is delivered via the GlobalProtect Client (the app is simply the client for mobile platforms), so it is not counted separately.

Answer

GlobalProtect License Server

Answer

GlobalProtect Mobile App

Question 12

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 13

An engineer is configuring App-ID for a network that uses both standard and custom applications. Which of the following are best practices for using App-ID effectively? (Choose three.)

Accepted Answer

Use application filters to create dynamic application groups based on characteristics.. Option B is correct because application filters let you build dynamic application groups that automatically match applications by characteristics such as category, subcategory, technology, risk, or behavioral attributes, so the group stays current as new App-IDs are added without manual edits. Option C is correct because application groups bundle related applications (for example, business apps or sanctioned SaaS) into a single object referenced in security policy, which simplifies rule management and reduces policy sprawl while still enforcing App-ID per application. Option E is correct because App-ID identification depends on the Application and Threats content database; regularly updating it ensures signatures for new and evolving applications, including custom and evasive apps, are available so the firewall can correctly identify and control traffic. Option A is not a best practice because relying solely on default signatures ignores custom applications and the need for custom App-ID signatures, application filters, and groups to handle organization-specific traffic. Option D is not a best practice because App-ID should not be disabled on well-known ports; attackers and applications commonly use ports like 80 and 443 for non-standard traffic, and App-ID is designed to inspect and identify applications regardless of port, so disabling it would weaken security.

Answer

Rely solely on default application signatures for all traffic identification.

Answer

Disable App-ID for traffic on well-known ports to reduce processing overhead.

Question 14

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Accepted Answer

Use applications instead of ports in security policies.. Option C is correct because App-ID's core value is identifying applications regardless of port, protocol, or evasive technique, so security policies should reference applications (or application filters/groups) rather than ports to enforce accurate, consistent control. Option D is correct because App-ID alone only identifies and allows/denies traffic; pairing it with security profiles such as Vulnerability Protection, Antivirus, Anti-Spyware, and URL Filtering provides the threat inspection needed to actually block exploits and malware within allowed applications. Option A is wrong because disabling App-ID for unmatched traffic (e.g., via unknown-tcp/unknown-udp handling) weakens visibility and control rather than being a best practice, and performance is not improved in a way that justifies losing security. Option B is wrong because port-only policies defeat the purpose of App-ID and are easily bypassed by applications using non-standard ports or port hopping. Option E is wrong because restricting to only well-known applications is not a general best practice; App-ID should be used to identify and control all applications, including sanctioned SaaS and custom/internal apps, based on risk and business need.

Answer

Disable App-ID for traffic that does not match any known application to improve performance.

Answer

Configure all security policies based on port only for consistency.

Answer

Limit application usage to only well-known applications to reduce attack surface.

Question 15

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Accepted Answer

Verify the security policy order. Option C is correct because firewall policy is evaluated top-down, so a broader or more specific rule placed above the intended rule can shadow it and silently drop or block the traffic; verifying rule order confirms whether the matching permit rule is actually being reached. Option D is correct because the session table (e.g., 'show session all filter source x.x.x.x destination y.y.y.y' on Palo Alto, or 'conntrack -L'/'show conn' on other platforms) reveals whether a session was created, its state, and whether it was denied, which directly indicates where traffic is failing. Option A is not a troubleshooting method since rebooting only clears state temporarily and provides no diagnostic evidence of the root cause. Option B is not valid because changing the interface IP address alters the configuration rather than diagnosing the existing forwarding or policy problem. Option E is not valid because updating threat prevention signatures addresses content inspection, not the basic forwarding or policy issue being investigated.

Answer

Reboot the firewall

Answer

Change the interface IP address

Answer

Update the threat prevention signature