PCNSE Practice Test 19 — 15 Questions

Question 1

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When the portal and gateway are on the same firewall, the portal configuration must specify the correct IP address or FQDN for the gateway. If the gateway IP address in the portal configuration is incorrect, the client will successfully authenticate to the portal but then fail to establish a tunnel to the gateway because it cannot reach the gateway at the specified address. This is the most common cause of this symptom.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch

Question 2

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Accepted Answer

Define a custom application with the appropriate protocol, port, and optionally a signature.. When a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Answer

Create a security policy rule with an application override to match the port.

Answer

Enable SSL decryption on the traffic to inspect encrypted payloads.

Answer

Add the port to the default application's 'port' field in the application object.

Question 3

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. An application group in Palo Alto Networks PAN-OS allows multiple applications to be referenced as a single object in security policies, reducing policy count while maintaining application-level visibility and control. This is the recommended best practice because it preserves the granular security benefits of App-ID without creating redundant rules. Unlike custom applications, application groups do not require reverse-engineering or signature creation, and they remain dynamically updated with the application content database.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 4

Refer to the exhibit. What does the serial number '0123456789' indicate?

Accepted Answer

The unique hardware identifier for licensing and support. The serial number '0123456789' is a unique hardware identifier assigned to each Palo Alto Networks firewall during manufacturing. It is used for licensing, support entitlement, and device identification in the Palo Alto Networks support portal, not for network-level addressing or software versioning.

Answer

The MAC address of the management interface

Answer

The model number of the firewall

Answer

The firmware version installed

Question 5

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

Accepted Answer

Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.. App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Answer

Enable unknown application identification in the security rule.

Answer

Use the default application override for port 4444 to allow traffic.

Answer

Change the security rule to use 'application-default' as the service to rely on port-based identification.

Question 6

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Accepted Answer

show vpn ike-sa. Option B, 'show vpn ike-sa', is correct because it displays the status of IKE Phase 1 security associations, which are the foundation of an IPSec tunnel and must be established before Phase 2 can come up. Option D, 'show vpn ipsec-sa', is correct because it shows the IPSec Phase 2 security associations, directly confirming whether the tunnel itself is active and passing traffic. Together these two commands let an administrator verify both phases of an IPSec VPN on a Palo Alto Networks firewall. Option A, 'show system info', only reports general device information such as model, software version, and uptime, not tunnel state. Option C, 'show routing route', displays the routing table and cannot show IKE or IPSec SA status. Option E, 'show interface all', shows interface statistics and link state, which is unrelated to IPSec tunnel status.

Answer

show system info

Answer

show routing route

Answer

show interface all

Question 7

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

Accepted Answer

The authentication sequence settings in the Captive Portal configuration. When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail. Checking this first isolates the issue efficiently before investigating other components.

Answer

The certificate used for the Captive Portal page

Answer

The session timeout for authenticated users

Answer

The User-ID agent mapping

Question 8

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

Accepted Answer

The application override rule does not have the correct port.. An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Answer

The traffic is being identified as ssl instead.

Answer

The security policy does not allow the traffic.

Answer

The custom application my-custom-app is not committed.

Question 9

A company needs to deploy a firewall in transparent inline mode to filter traffic between two switches without requiring any IP address changes on existing devices. Which interface type should be configured?

Accepted Answer

Virtual Wire. Virtual Wire (VWire) is the correct interface type because it allows the firewall to operate in transparent inline mode without requiring any IP address changes on existing devices. In VWire mode, the firewall acts as a Layer 2 bump in the wire, forwarding traffic between two interfaces based on MAC addresses without participating in routing or requiring IP configuration on the firewall interfaces themselves.

Answer

Tap

Answer

Layer3

Answer

Layer2

Question 10

A team uses the Panorama API to generate custom reports. They need to retrieve a list of all rules that have logging at session end enabled. Which API endpoint should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules. Security rules and their log settings live in the rulebase under /config/devices/entry/vsys/entry/rulebase/security/rules, so a config-type GET against that XPath returns every security rule including the log-end attribute. Filtering the returned XML for log-end='yes' yields the list of rules with session-end logging enabled. This is the correct API path for reading rule configuration, not logs or reports.

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=get&xpath=/config/shared/log-settings

Answer

GET /api/?type=report&reporttype=predefined

Question 11

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

Accepted Answer

Panorama without Log Collectors. Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Answer

Panorama with Dedicated Log Collectors

Answer

Panorama with Log Collectors

Answer

Panorama in High Availability mode

Question 12

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

Accepted Answer

Configure log export and auto-deletion in Log Settings. The firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Answer

Add an external disk to the firewall

Answer

Disable logging for non-critical traffic

Answer

Manually delete logs from the CLI

Question 13

An administrator wants to generate a report that shows the top applications by bandwidth usage over the last week. Which report type should be used to accomplish this?

Accepted Answer

Application Report. The Application Report is designed to provide visibility into application usage, including bandwidth consumption, top applications, and application-level trends over a specified time period. This report type leverages the App-ID engine to classify traffic by application, regardless of port or protocol, making it the correct choice for identifying top applications by bandwidth usage.

Answer

URL Filtering Report

Answer

Traffic Report

Answer

Threat Report

Question 14

A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?

Accepted Answer

Configure a PCAP filter in the firewall's packet capture feature. The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.

Answer

Set up a port mirror on the upstream switch

Answer

Create an application override policy

Answer

Use tcpdump on the management interface

Question 15

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

Accepted Answer

Enable SSL decryption for the traffic.. The 'incomplete' application label indicates that the firewall could not fully identify the application because the traffic was encrypted. Enabling SSL decryption allows the firewall to inspect the decrypted payload, which is necessary for App-ID to accurately classify the application. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is often insufficient for SSL connections.

Answer

Disable application identification for SSL traffic.

Answer

Enable HTTP/2 protocol decoding.

Answer

Allow sessions with application 'incomplete' in policy.