PCNSE Practice Test 2 — 10 Questions

Question 1

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the security policy rulebase order and matching. The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Answer

Verify the user-ID agent is mapping the IP correctly

Answer

Check the service configuration for the destination port

Answer

Check the NAT configuration for the user's subnet

Question 2

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 3

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 4

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Accepted Answer

Enable Automatic Tunnel. Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients. Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Answer

GlobalProtect client package assigned to macOS

Answer

Gateway IP Pool configured

Answer

PanGPS (Pan GlobalProtect Service) enabled

Question 5

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Question 6

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 7

A multinational corporation uses GlobalProtect with multiple gateways distributed globally for load balancing. The portal has 'Enable Location Awareness' enabled and region mapping is configured to map APAC users to the APAC gateway, US users to the US gateway, etc. Recently, users in the APAC region are being redirected to the US gateway, causing high latency. The AD admin confirms that users are in the correct APAC subnets. What is the most likely misconfiguration?

Accepted Answer

The location awareness database is outdated for APAC IP subnets. The portal uses a location awareness database to map client IP addresses to geographic regions. If this database is outdated for APAC IP subnets, the portal may fail to recognize APAC users correctly and redirect them to the US gateway, causing high latency. The AD admin confirms the users are in correct APAC subnets, ruling out a client-side subnet issue, so the most likely cause is a stale or incorrect location database on the portal.

Answer

The APAC gateway's region mapping is configured with incorrect IP subnets

Answer

The APAC gateway's IP pool is exhausted

Answer

The portal's 'Primary Gateway' is set to the US gateway

Question 8

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

Accepted Answer

The application override rule does not have the correct port.. An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Answer

The traffic is being identified as ssl instead.

Answer

The security policy does not allow the traffic.

Answer

The custom application my-custom-app is not committed.

Question 9

A company has a pair of Palo Alto Networks firewalls in active/passive HA. The active firewall manages all traffic. Recently, the network team reconfigured the virtual router by adding a new static route to a remote subnet via a next-hop IP on the same interface. After committing, they noticed that the passive firewall's management IP became unreachable. The active firewall continues to pass traffic normally. What is the most likely cause?

Accepted Answer

The passive firewall has lost its management route. In an active/passive HA pair, the passive firewall synchronizes its configuration from the active firewall, including virtual router settings. However, management IP reachability depends on the management network's routing table, which is separate from the dataplane virtual router. Adding a static route to the virtual router does not automatically add a corresponding management route. The passive firewall's management IP became unreachable because it lost its default gateway or specific management route, likely due to a misconfiguration or failure to synchronize the management plane's routing information, which is not part of the HA config sync.

Answer

The HA link is down

Answer

The static route is causing a routing loop

Answer

The virtual router configuration is not synchronized to the passive peer

Question 10

A cloud-based application is accessed via URL filtering and uses SAML authentication. After a user changes their password in the identity provider (Okta), they are unable to authenticate to the application. The firewall is configured with an authentication policy that uses SAML. Other users who have not changed passwords can authenticate successfully. What is the most likely issue?

Accepted Answer

The User-ID mapping on the firewall is outdated and still contains the user's old credentials.. When a user changes their password in Okta, the SAML assertion generated for authentication includes a new session tied to the updated credentials. However, the firewall's User-ID mapping may still cache the user's previous authentication state (including old session tokens or credentials). This stale mapping causes the firewall to reject the new SAML assertion because it does not match the cached user identity, preventing successful authentication. Other users without password changes have consistent mappings, so they authenticate normally.

Answer

The SAML token for the user has expired.

Answer

The firewall's SAML certificate is invalid.

Answer

The application does not support password changes.