PCNSE Practice Test 2 — 10 Questions

Question 1

A network security engineer is configuring a Palo Alto Networks firewall to perform URL filtering. The company requires that all HTTP and HTTPS traffic from the trust zone to the untrust zone be inspected, and that access to known malware sites be blocked. The firewall is running PAN-OS 10.1. The engineer has already created a URL filtering profile with the appropriate categories set to block. Which additional configuration is required to ensure that HTTPS traffic is filtered based on the full URL?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL decryption for the trust zone and apply a decryption policy for HTTPS traffic.. To filter HTTPS based on the full URL, the firewall must decrypt the traffic to inspect the HTTP Host header and path. SSL decryption, configured via a decryption policy, allows the firewall to act as a forward proxy. Without decryption, URL filtering for HTTPS is limited to server name indication or certificate information, which may not cover the full URL. Therefore, enabling SSL decryption is the necessary step.

Answer

Configure a security policy rule with application 'ssl' and attach the URL filtering profile.

Answer

Enable 'HTTP Header Logging' in the URL filtering profile and commit.

Answer

Create a custom URL category with the malware sites and apply it to a security policy rule.

Question 2

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Accepted Answer

Navigate to Network > Zones, then click Add, then enter the zone name and select the zone type, then click OK.. The correct sequence to configure a new zone on a Palo Alto Networks firewall is: first, navigate to Network > Zones; second, click Add to create a new zone object; third, enter the zone name and select the zone type (e.g., Layer3); finally, click OK to save the configuration. This order ensures that the zone is properly created and configured before committing changes.

Answer

Click Add, then navigate to Network > Zones, then enter the zone name and select the zone type, then click OK.

Answer

Navigate to Network > Zones, then enter the zone name and select the zone type, then click Add, then click OK.

Answer

Navigate to Network > Zones, then click Add, then click OK, then enter the zone name and select the zone type.

Question 3

An administrator wants to receive SNMP traps from the firewall for critical events such as failed login attempts and high CPU usage. Which configuration step is required?

Accepted Answer

Configure an SNMP trap destination under Device > Setup > SNMP Trap.. To receive SNMP traps from a Palo Alto Networks firewall, you must configure the trap destination under Device > Setup > SNMP Trap. This step defines where the firewall sends SNMP notifications (traps) for events like failed login attempts and high CPU usage. Without a configured trap destination, the firewall will not transmit any SNMP traps, even if other SNMP settings are enabled.

Answer

Enable SNMP monitoring on the interface.

Answer

Set up a log forwarding profile with SNMP action.

Answer

Create an SNMP read-only community string.

Question 4

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 5

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Accepted Answer

Kerberos. Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Answer

LDAP

Answer

Local Database

Answer

RADIUS

Question 6

An engineer wants to block the use of file-sharing application BitTorrent, but allow file transfers over SFTP which also uses port 22. What is the most effective way to achieve this using App-ID?

Accepted Answer

Create a security rule that denies application 'bittorrent' and allows application 'sftp'.. D is correct because App-ID identifies applications by their unique signatures, not just ports. By creating a security rule that denies 'bittorrent' and allows 'sftp', the firewall can block BitTorrent traffic even if it uses non-standard ports, while permitting SFTP on port 22 based on its distinct application signature.

Answer

Create an application filter that matches sftp.

Answer

Use QoS to limit BitTorrent traffic.

Answer

Use an application override to classify all port 22 traffic as sftp.

Question 7

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 8

Order the steps to configure a static route on a Palo Alto Networks firewall.

Accepted Answer

Navigate to the virtual router, add a static route, configure destination and next-hop, then commit.. The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Answer

Navigate to the virtual router, configure destination and next-hop, add the static route, then commit.

Answer

Navigate to the virtual router, add a static route, commit, then configure destination and next-hop.

Answer

Add a static route, navigate to the virtual router, configure destination and next-hop, then commit.

Question 9

A network administrator is troubleshooting an IPsec site-to-site VPN that fails to establish. IKE phase 1 completes successfully, but phase 2 fails with a 'no proposal chosen' message. Both sides have identical IKE and IPsec crypto profiles, and the pre-shared key is correct. What is the most likely cause of the failure?

Accepted Answer

The proxy IDs (local/remote subnets) do not match between peers. In IPsec site-to-site VPNs, IKE phase 1 establishes the secure management channel using parameters like encryption, authentication, and Diffie-Hellman groups. Phase 2 negotiates the IPsec security associations (SAs) for actual data traffic, and the 'no proposal chosen' error indicates a mismatch in the phase 2 parameters. Since both sides have identical crypto profiles and the pre-shared key is correct, the most likely cause is that the proxy IDs (local and remote subnets) do not match between peers. Proxy IDs define the traffic selectors that each peer expects to protect; if they are misaligned, the IPsec SA negotiation fails even if all other settings are identical.

Answer

The tunnel is configured as route-based instead of policy-based

Answer

The IKE gateway's local interface is down

Answer

Dead peer detection is not enabled on the IKE gateway

Question 10

A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?

Accepted Answer

Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.. The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.

Answer

Enable IKE on the management interface.

Answer

Enable User-ID on the management interface.

Answer

Configure a service route to redirect management traffic to a dataplane interface.