PCNSE Practice Test 20 — 15 Questions

Question 1

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication profile referencing the SAML IdP profile. SAML authentication for GlobalProtect requires an authentication profile that references a SAML identity provider (IdP) profile. The firewall uses this profile to redirect users to Microsoft Entra ID for SAML-based MFA, then validates the SAML assertion returned. Without this profile, the firewall cannot initiate or complete the SAML exchange.

Answer

LDAP server profile for user lookup

Answer

Server certificate for the portal

Answer

SSL decryption rule

Question 2

Which TWO of the following are valid considerations when designing an SSL Forward Proxy decryption deployment in a Palo Alto Networks firewall?

Accepted Answer

When deploying SSL Forward Proxy, the firewall must generate a certificate for each decrypted session to re-encrypt traffic to the client.. Option C is correct because SSL Forward Proxy works by having the firewall act as a man-in-the-middle: it intercepts the client's TLS session, presents a certificate it generates (signed by a Forward Trust certificate) for the requested server, and then establishes a separate TLS session to the actual server, so a certificate must be generated for each decrypted session to re-encrypt traffic to the client. Option E is correct because decryption in Palo Alto Networks firewalls is governed by a Decryption policy, which lets administrators selectively define which traffic (by source, destination, user, URL category, service, etc.) is decrypted, forwarded, or excluded from decryption. Option A is incorrect because decryption is not global; the Decryption policy enables granular, selective decryption and exclusions. Option B is incorrect because SSL Forward Proxy cannot decrypt sessions that use client certificate authentication (mutual TLS), since the firewall cannot present the client's private key. Option D is incorrect because SNI is not a requirement that forces decryption; traffic with SNI can pass through undecrypted, and the firewall does not drop it merely for using SNI.

Answer

Decryption is applied globally to all traffic; selective decryption is not possible.

Answer

The firewall can decrypt all TLS sessions regardless of client certificate authentication.

Answer

Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

Question 3

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Accepted Answer

Create separate virtual systems (VSYS) for each tenant on the same firewall.. Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Answer

Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

Answer

Use active/active HA mode to assign each tenant to a different firewall.

Answer

Configure multiple virtual routers (VRFs) within the same virtual system.

Question 4

Which TWO of the following are supported authentication methods for IPSec VPN tunnel setup between two Palo Alto Networks firewalls?

Accepted Answer

Certificate. Option A (Certificate) is correct because Palo Alto Networks firewalls support certificate-based authentication for IPSec VPN IKE peers, where each firewall presents an X.509 certificate and validates the peer's certificate against a trusted CA profile during IKE Phase 1. Option E (Pre-shared key) is correct because PSK authentication is a native, commonly used IKE Phase 1 authentication method for site-to-site IPSec tunnels between Palo Alto firewalls, configured under the IKE Gateway's authentication settings. Options B (RADIUS), C (SAML), and D (LDAP) are not valid IKE peer authentication methods for IPSec tunnel establishment; these are user authentication mechanisms used for GlobalProtect, administrative access, or User-ID, and they operate at the application/user layer rather than authenticating the IKE gateway peer itself.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 5

Two firewalls in an active/passive HA pair are not synchronizing. The administrator checks 'show high-availability state' and sees 'active' on both firewalls. What is the most likely cause?

Accepted Answer

The HA3 control link is misconfigured or down.. When both firewalls show 'active' in the HA state, it indicates a split-brain scenario where each firewall believes it is the active unit. The HA3 control link is responsible for heartbeat and state synchronization; if it is misconfigured or down, the firewalls cannot detect each other's presence, causing both to assume active status. This is the most common cause of dual-active HA failures.

Answer

Session owner is set to 'primary' on both firewalls.

Answer

Preemptive mode is enabled on both firewalls.

Answer

Both firewalls have different PAN-OS versions.

Question 6

An organization has a firewall in HA active-passive mode. After a failover, the new active firewall does not have the latest session table. What should be configured to ensure session synchronization?

Accepted Answer

HA session sync. HA session synchronization (session sync) is the feature that replicates active session state from the active firewall to the passive firewall in an active-passive HA pair. Without this configuration, after a failover the new active firewall has no knowledge of existing sessions, causing all active connections to be dropped and requiring clients to re-establish them. Enabling session sync ensures the passive firewall maintains a synchronized session table, allowing seamless traffic continuation after failover.

Answer

Packet capture on active

Answer

Session setup on both peers

Answer

Commit force sync

Question 7

Which TWO statements correctly describe the role of the data plane in PAN-OS architecture?

Accepted Answer

It performs content inspection.. Option A is correct because the data plane in PAN-OS is responsible for performing content inspection, including App-ID, Content-ID, and threat prevention, on traffic that has been allowed by policy. Option C is correct because the data plane handles all packet forwarding and security processing, executing the security policy decisions made by the control plane on a per-packet basis. Options B, D, and E are incorrect because routing protocols like OSPF run in the control plane, log files are stored on the management plane's logging subsystem, and the web interface and CLI are managed by the management plane.

Answer

It runs routing protocols like OSPF.

Answer

It stores log files.

Answer

It manages the web interface and CLI.

Question 8

An administrator reviews a traffic log entry: 'Source: 10.0.0.10, Destination: 8.8.8.8, Application: web-browsing, Action: allow, Bytes Sent: 500, Bytes Received: 1200'. What does this log entry indicate about the traffic?

Accepted Answer

The traffic was allowed and identified as web-browsing.. The log entry shows 'Action: allow', which explicitly indicates the firewall permitted the traffic. The 'Application: web-browsing' field confirms that the Palo Alto Networks firewall correctly identified the traffic as HTTP/HTTPS (web-browsing) using App-ID, not just by port. The presence of both 'Bytes Sent' and 'Bytes Received' with non-zero values confirms bidirectional communication, so the traffic was allowed and properly classified.

Answer

The traffic was blocked by a security policy.

Answer

The traffic was only one-way; only received bytes were logged.

Answer

The application was incorrectly identified.

Question 9

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 10

An administrator adds a new security rule to allow outbound 'web-browsing' and 'ssl' traffic. After committing, users report that some HTTPS sites are still blocked. Traffic logs show that the traffic matches the new rule but is denied. What is the most likely cause?

Accepted Answer

The service 'application-default' does not match the port used by the site.. When a security rule uses the 'application-default' service, the firewall only allows traffic that matches the default port for the specified application. For 'web-browsing' (HTTP), the default port is TCP 80, and for 'ssl' (HTTPS), the default port is TCP 443. If an HTTPS site uses a non-standard port (e.g., TCP 8443), the traffic matches the rule based on the application but is denied because the service 'application-default' does not recognize that port as valid for the application.

Answer

A decryption policy is required for HTTPS traffic.

Answer

The application filter does not include 'ssl'.

Answer

The rule is placed too low in the rulebase.

Question 11

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

Accepted Answer

Asymmetric routing. Asymmetric routing causes the firewall to see only one direction of a TCP session, leading to session timeouts despite active session entries. When traffic from the client to the database server traverses one firewall and return traffic takes a different path, the firewall cannot properly track the TCP state, resulting in dropped packets and intermittent connectivity.

Answer

DNS resolution failure

Answer

Security policy configured with service 'any'

Answer

Incomplete TCP three-way handshake

Question 12

A company wants to enforce multi-factor authentication (MFA) for employees accessing a specific internal application through the firewall. Which two configurations are required on the Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Define an authentication profile that includes an MFA method. Option A is correct because an authentication profile on the Palo Alto Networks firewall defines the authentication methods, including MFA (such as RADIUS with OTP, or a SAML/MFA provider), and is the object that the firewall uses to challenge users for credentials and a second factor. Option C is correct because an authentication policy rule is what actually enforces authentication for matching traffic; it references the authentication profile and can be scoped to the specific internal application (via destination/URL category or application), so without this rule no MFA challenge is triggered. Option B is not required because a SAML identity provider is only one possible MFA mechanism and is not mandatory for enforcing MFA; the firewall can use other methods such as RADIUS with OTP. Option D is not required because GlobalProtect is a remote-access VPN/client solution, not a prerequisite for authenticating users to an internal application through the firewall. Option E is not required because SSL decryption is used for inspecting encrypted traffic, not for enforcing MFA authentication.

Answer

Configure a SAML identity provider

Answer

Install the GlobalProtect client on user endpoints

Answer

Enable SSL decryption on the firewall

Question 13

A network security engineer is designing a multi-vsys Palo Alto Networks firewall deployment to provide both advanced security and virtual routing separation for three different departments. Each department requires its own routing table and separate security policy enforcement. The engineer must decide which component is responsible for enforcing security policies and providing threat inspection across all virtual systems. Which component of the Palo Alto Networks Next-Generation Firewall performs this function?

Accepted Answer

The dataplane. The dataplane is the core processing engine that enforces security policies, performs application identification, and inspects traffic for threats. In a multi-vsys configuration, each virtual system has dedicated dataplane resources, ensuring that security policies are applied independently. The management plane, control plane, and User-ID agent support administration, routing, and user mapping but do not enforce security policies or inspect traffic.

Answer

The management plane

Answer

The control plane

Answer

The user-ID agent

Question 14

A security administrator is configuring a new Palo Alto Networks firewall and needs to enable App-ID to identify applications traversing the network. The administrator wants to ensure that App-ID can correctly identify applications even when they use non-standard ports or encryption. Which feature must be enabled to allow App-ID to inspect encrypted traffic?

Accepted Answer

SSL decryption. SSL decryption is required to inspect encrypted traffic, allowing App-ID to identify applications accurately. Without decryption, App-ID relies on heuristics and metadata, which may misidentify applications. User-ID, Content-ID, and application override serve different purposes and do not decrypt traffic. Enabling SSL decryption ensures that App-ID can see inside encrypted sessions and enforce policies based on the true application.

Answer

User-ID

Answer

Content-ID

Answer

Application override

Question 15

An administrator is reviewing the firewall's session table and notices many sessions in a 'discard' state. What is the most likely cause of this session state?

Accepted Answer

The session was denied by a security policy or a threat was detected and the session was reset.. Sessions in 'discard' state indicate that the firewall has decided to drop the session, usually due to a security policy deny action or a threat detection with a reset or drop action. This state persists until the session times out. Understanding session states helps administrators quickly identify policy violations or security events.

Answer

The firewall is experiencing high CPU utilization.

Answer

The session is waiting for application identification to complete.

Answer

The firewall is performing SSL decryption and the session is temporarily paused.