PCNSE Practice Test 18 — 15 Questions

Question 1

A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?

Accepted Answer

Create an authentication profile using RADIUS with MFA enabled and assign it to the admin accounts.. Option A is correct because an authentication profile specifies the authentication method (RADIUS with MFA) and must be assigned to admin accounts. Options B, C, and D are not required for admin authentication.

Answer

Create a security policy to allow RADIUS traffic from the firewall to the RADIUS server.

Answer

Enable MFA in the User-ID agent configuration.

Answer

Configure an authentication enforcement rule in the authentication policy.

Question 2

Refer to the exhibit. A user is trying to authenticate via SAML and receives this error. What is the most likely cause?

Accepted Answer

The firewall's SP entity ID does not match the audience configured in the IdP.. Option B is correct because the 'Invalid audience' error indicates that the audience in the SAML response (provided by the IdP) does not match the expected SP entity ID configured on the firewall. Option A is incorrect because certificate expiry would cause a different error. Option C is incorrect because account lockout would result in an authentication failure with a different reason. Option D is incorrect because timeout would show a different error.

Answer

The IdP certificate has expired.

Answer

The user's account is locked.

Answer

The SAML request timeout is set too short.

Question 3

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

Accepted Answer

The user is prompted to authenticate via the configured authentication profile.. Option A is correct because the action 'allow-authentication' prompts the user to authenticate using the specified authentication profile. Option B is incorrect because the traffic is not allowed before authentication. Option C is incorrect because the policy does not block; it triggers authentication. Option D is incorrect because the action is not redirect; it's authentication prompt via the configured method.

Answer

The traffic is blocked because the source-user is 'unknown'.

Answer

The traffic is allowed without authentication because the source-user is 'unknown'.

Answer

The user is redirected to the captive portal.

Question 4

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

Accepted Answer

SAML identity provider profile. Option C is correct because a SAML authentication profile must reference a SAML identity provider profile that contains the IdP metadata. Option A is incorrect because LDAP server profile is for LDAP authentication. Option B is incorrect because Kerberos realm is for Kerberos. Option D is incorrect because RADIUS server is for RADIUS.

Answer

LDAP server profile

Answer

RADIUS server

Answer

Kerberos realm

Question 5

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Accepted Answer

A rule with a 'deny' action appears earlier in the security policy.. The most likely reason the inter-zone rule is not matched is that a preceding rule with a 'deny' action is matching the traffic first. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom, and the first matching rule determines the action. If an earlier rule denies the traffic, the later allow rule will never be evaluated, even if it would otherwise match.

Answer

The source address 10.0.0.0/8 is not included in the source zone.

Answer

The destination address is set to 'any', which is not valid.

Answer

The traffic is intra-zone, not inter-zone.

Question 6

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Accepted Answer

The firewall can buffer up to 1024 KB of packet data for App-ID analysis.. The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Answer

App-ID can only handle 1024 KB of packet data per session.

Answer

The firewall logs the first 1024 KB of every session for App-ID.

Answer

The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

Question 7

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Accepted Answer

Using the 'set application' command in the CLI.. Option C is correct because the 'set application' CLI command allows you to define a custom App-ID by specifying characteristics such as protocol, port, and signature. This is a direct method to create a custom application object on a Palo Alto Networks firewall, as documented in the administrator's guide.

Answer

Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.

Answer

Using the 'Application Command Center' to automatically generate custom App-IDs.

Answer

Importing an App-ID definition file from a CSV.

Question 8

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Accepted Answer

Source zone. A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Answer

User-ID

Answer

Application ID

Question 9

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

Accepted Answer

Asymmetric routing. Asymmetric routing can cause sessions to be created on one firewall while traffic returns via a different path, leading to session lookup failures and drops. This is a common cause of intermittent connectivity with active sessions.

Answer

DNS resolution failure

Answer

Security policy configured with service 'any'

Answer

Incomplete TCP three-way handshake

Question 10

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

Accepted Answer

The security policy rule's logging setting. If the security rule does not have logging enabled, no traffic logs are generated even if sessions are active. This is a common misconfiguration.

Answer

The interface management profile

Answer

The log retention settings

Answer

The system log severity level

Question 11

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

Accepted Answer

Traffic log. Traffic logs record all sessions that match security rules, including the rule ID that matched.

Answer

Configuration log

Answer

Threat log

Answer

System log

Question 12

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

Accepted Answer

The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.. Option B is correct because by default, interzone rules log at session end only for allowed traffic; denied traffic may not generate logs if logging is not explicitly enabled. Option A is wrong because disabling logging per rule is a common oversight. Option C is wrong because system logs are not related to security policy logs. Option D is wrong because the rule can still deny without logging.

Answer

The firewall's system log rate is exceeded and logs are dropped.

Answer

The rule has logging disabled for the 'deny' action.

Answer

The rule is not being matched because a previous rule allows the traffic.

Question 13

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). HA requires identical PAN-OS versions. A minor version mismatch, even a patch level difference, can cause the passive firewall to fail to synchronize.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 14

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

Accepted Answer

The source and destination zones are misconfigured. If no rule matches, it's often because the zones are incorrectly configured. The source or destination zone may not match the rule's zone definitions.

Answer

The rule is disabled

Answer

The user's IP is in a block list

Answer

The firewall is in transparent mode

Question 15

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. If the interface receiving the traffic has no management profile or is not configured to allow the necessary services (e.g., HTTP/HTTPS), the traffic may be dropped at the interface level. However, for pass-through traffic, the zone and interface assignment are critical. The most common first step is to verify the source and destination zones in the policy.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile