PCNSE Practice Test 19 — 15 Questions

Question 1

A firewall has a security policy that includes a rule with a 'Schedule' object. During the scheduled time, traffic should be allowed, but it is being blocked. The schedule is configured correctly. What could be the issue?

Accepted Answer

The schedule object uses the wrong time zone. If the firewall's system time is incorrect, the schedule may not be active during the intended period. This is a common oversight.

Answer

The schedule object is not referenced in the rule

Answer

The user's traffic is using a different application

Answer

The rule is placed incorrectly in the security policy

Question 2

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

Accepted Answer

A security policy rule with a geolocation-based deny is blocking the traffic. After tunnel establishment, traffic is subject to security policies. A misconfigured rule (e.g., geolocation-based deny) could block the traffic. Also, split tunneling settings could be misconfigured. The most common cause is a security policy blocking the traffic after tunnel is up.

Answer

Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

Answer

The GlobalProtect gateway is not configured with the correct client settings

Answer

The DNS proxy setting is misconfigured

Question 3

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Accepted Answer

Verify the security policy order. Checking session table and verifying security policy rules are both direct troubleshooting steps.

Answer

Reboot the firewall

Answer

Change the interface IP address

Answer

Update the threat prevention signature

Question 4

A remote user is unable to connect to the GlobalProtect gateway. The user's client shows 'Connecting' but never establishes a tunnel. The firewall shows no drops in the GlobalProtect logs. Which of the following should be checked first?

Accepted Answer

Ensure the gateway's certificate is trusted by the client machine.. Option D is correct because the Gateway certificate is crucial for SSL/TLS handshake; if the client does not trust it, the connection fails silently. Option A is wrong because the portal is not involved in the gateway tunnel establishment. Option B is wrong because the client can still connect if it is not on the internal network (remote access). Option C is wrong because gateway configuration should be checked after authentication issues.

Answer

Verify that the GlobalProtect portal is reachable from the internet.

Answer

Check if the user's authentication credentials are correct.

Answer

Confirm that the user's client is on the same subnet as the gateway.

Question 5

A firewall is experiencing high CPU utilization. The engineer suspects a denial-of-service attack. Which command should be used to identify the source of the attack?

Accepted Answer

show session all | match <source IP>. The 'show session all' command can show many sessions from a single source, indicating an attack. Filtering by source IP helps identify the attacker.

Answer

show counter global | match drop

Answer

request high-availability state

Answer

debug flow basic

Question 6

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Accepted Answer

TCP sequence number mismatch due to packet reordering. Asymmetric routing and TCP sequence number mismatch are common causes of session drops after the handshake.

Answer

Firewall interface speed mismatch

Answer

Security policy change after session creation

Answer

DNS resolution failure

Question 7

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Accepted Answer

Matching IKE version and encryption algorithms. IPSec requires matching IKE phase 1 parameters, pre-shared key, and proxy IDs (phase 2 selectors).

Answer

Same firewall model

Answer

Same certificate authority

Question 8

A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?

Accepted Answer

Use the CLI command 'show running resource-monitor' to view CPU usage per module.. Option B is correct because 'show running resource-monitor' provides CPU, memory, and session utilization data that can pinpoint which component is using CPU. Option A is wrong because session count alone does not indicate high CPU. Option C is wrong because packet buffer usage is usually memory-related. Option D is wrong because security policy rule hit count does not directly show CPU impact.

Answer

Review the security policy rule hit counts to see if a specific rule is hit frequently.

Answer

Check the number of active sessions using 'show session info'.

Answer

Inspect the packet buffer usage with 'show counter packet-buffer'.

Question 9

After upgrading a PA-5250, the firewall is not passing traffic. The administrator checks the dataplane CPU utilization and sees it is at 100%. Which command should be run to identify the cause?

Accepted Answer

show system resources dataplane. The correct answer is B because 'show system resources dataplane' provides detailed dataplane CPU and memory usage.

Answer

show session all

Answer

show counter global

Answer

show running resource-monitor

Question 10

A large enterprise uses a PA-5250 as a perimeter firewall with multiple virtual systems (vsys). One vsys is for the DMZ, and it is logging high amounts of dropped traffic. The administrator notices that the firewall's dataplane CPU is consistently above 80%. The logs show many 'application-id timeout' drops. The DMZ hosts are running custom applications on non-standard ports. What is the first step to mitigate the issue?

Accepted Answer

Use a custom application signature for the custom applications.. Option C is correct because creating custom application signatures reduces the need for heuristic analysis of unknown traffic, lowering CPU load.

Answer

Disable application identification for the DMZ zone.

Answer

Reduce the number of security rules in the DMZ.

Answer

Increase the application identification timeout for the custom applications.

Question 11

Refer to the exhibit. The session is in FIN_WAIT state. What does this indicate about the TCP connection?

Accepted Answer

The firewall has closed the connection and is waiting for the client or server to finish. FIN_WAIT state indicates that the firewall has sent a FIN and is waiting for the other side to acknowledge or send its own FIN. This is part of normal TCP teardown.

Answer

The connection is actively transferring data

Answer

The connection has timed out and is being removed

Answer

The firewall is waiting for a SYN-ACK from the destination

Question 12

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

Accepted Answer

show session all filter source 10.1.1.100. Option C is correct because 'show session all filter source 10.1.1.100' will display all sessions originating from that IP, including NAT translations. Option A shows NAT rules but not active translations. Option B shows the running configuration of NAT rules. Option D shows addresses but not active translations.

Answer

show running nat-policy

Answer

show nat rule

Answer

show address 10.1.1.100

Question 13

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

Accepted Answer

A URL Filtering profile is applied to the rule and is blocking the website's URL category.. Option C is correct because if the URL Filtering profile is set to block the requested URL, the session will be dropped even if the application is allowed. Option A is wrong because SSL decryption would not cause a drop for web-browsing unless the certificate is untrusted. Option B is wrong because a lack of logging does not affect session forwarding. Option D is wrong because a DoS protection profile typically drops excessive sessions, not individual user access.

Answer

The security policy rule does not have logging enabled at session end.

Answer

SSL decryption is enabled but the website certificate is untrusted.

Answer

A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

Question 14

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Accepted Answer

Use the Panorama API to retrieve logs.. Options A and D are correct. Panorama can export logs via syslog by configuring a log forwarding profile to send to a syslog server, and via the Panorama API. Option B is wrong because SNMP traps are for alerts, not bulk log export. Option C is wrong because Panorama does not have a built-in CSV export via the web interface for bulk logs; that is done via API or syslog. Option E is wrong because NetFlow is not supported for log export.

Answer

Configure a NetFlow exporter on Panorama.

Answer

Export logs as CSV directly from the Panorama web interface.

Answer

Use SNMP traps to send log data.

Question 15

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

Accepted Answer

Verify that the firewall's PAN-OS version is supported by the Panorama version.. Option A is correct because template validation errors often indicate that the version of the template or device group configuration is incompatible with the firewall's PAN-OS version. Options B, C, and D are less likely to be the root cause of a template validation error.

Answer

Ensure that the administrator account has superuser privileges.

Answer

Check that the firewall is connected to the internet for cloud services.

Answer

Review the system logs on the firewall for disk space errors.