PCNSE Practice Exam 2 — 20 Questions

Question 1

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 2

A network security engineer is troubleshooting an application that is inconsistently identified as 'unknown-tcp' in the traffic logs. The application uses TCP port 8080 and initiates with a proprietary binary handshake. The engineer confirms that no custom App-ID has been created. Which action should the engineer take to ensure the firewall reliably identifies this application?

Accepted Answer

Create a custom App-ID with a signature that matches the proprietary binary handshake and assign it to the application.. The firewall cannot identify a proprietary application if no signature exists. Creating a custom App-ID with a signature that matches the unique binary handshake enables the firewall to classify the traffic correctly based on application-layer attributes, not just port. This ensures consistent policy enforcement and visibility. Other options either bypass identification or misapply features like SSL decryption.

Answer

Configure an Application Override policy for port 8080 to force the firewall to treat the traffic as the desired application.

Answer

Enable SSL decryption for all traffic on port 8080 to allow the firewall to inspect the payload.

Answer

Add a security policy rule that allows TCP port 8080 and relies on the firewall's default App-ID for that port.

Question 3

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

Accepted Answer

Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.. Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Answer

Reboot both firewalls simultaneously to reset the HA state.

Answer

Disable link speed and duplex settings on the HA interfaces to force a failover.

Answer

Set the HA mode to 'active/active' to allow both firewalls to process traffic.

Question 4

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

Accepted Answer

Upgrade the passive firewall, failover to it, then upgrade the original active. In an active/passive HA pair, the passive firewall is upgraded first while the active firewall continues to handle traffic. After the passive firewall is upgraded and rebooted, an administrative failover is performed to make it the new active firewall, minimizing traffic loss. The original active firewall is then upgraded, ensuring there is always a firewall processing traffic during the upgrade process.

Answer

Upgrade the active firewall first, then failover to the passive

Answer

Suspend HA, upgrade both, then re-enable HA

Answer

Upgrade both firewalls simultaneously after disconnecting HA links

Question 5

Refer to the exhibit. Based on the log, what triggered the failover?

Accepted Answer

A path monitoring group determined that the upstream ISP is unreachable. The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.

Answer

Loss of HA1 heartbeat from the peer

Answer

A link failure on ethernet1/1

Answer

An administrator manually triggered a failover

Question 6

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 7

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 8

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 9

Based on the exhibit, what is the most likely cause for the majority of bypassed sessions?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the clients or servers.. The majority of bypassed sessions are most likely caused by a cipher mismatch between the firewall's SSL/TLS service profile and the clients or servers. When the firewall decrypts traffic, it must negotiate a cipher suite that both the client and server support; if the service profile does not include the cipher suites used by the endpoints, the firewall cannot complete the SSL/TLS handshake and bypasses the session. This is a common misconfiguration in Palo Alto Networks firewalls where the SSL/TLS service profile's cipher list is too restrictive.

Answer

The firewall is overloaded and cannot handle more decryption sessions.

Answer

The decryption certificate is not trusted by clients.

Answer

There is a network connectivity issue between firewall and servers.

Question 10

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Accepted Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then wait for the alarm LED to turn off and back on, then release the button.. The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Answer

Press and hold the reset button using a paperclip, then locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then release the button.

Answer

Locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then press and hold it using a paperclip, then release the button.

Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then release the button, then wait for the alarm LED to turn off and back on.

Question 11

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 12

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 13

A security team is implementing SSL Decryption. They want to ensure that traffic to health-related websites is not decrypted due to privacy concerns. Which method should they use to exclude this traffic?

Accepted Answer

Add the domain names to a custom URL category and create a no-decryption rule matching that category.. Palo Alto Networks firewalls allow you to create custom URL categories containing specific domain names (e.g., health-related sites) and then reference that category in a decryption policy rule set to 'no-decrypt'. This ensures traffic matching those domains is excluded from SSL decryption, addressing privacy concerns without affecting other traffic.

Answer

Use a source IP address exclusion list in the decryption policy.

Answer

Disable decryption for all sites that use certificate pinning.

Answer

Configure a decryption profile to exclude traffic based on App-ID.

Question 14

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

Accepted Answer

Reorder the security rules so the custom allow rule is above the deny rule.. Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.

Answer

Modify the custom App-ID signature to match more precisely.

Answer

Create an application override for the custom application.

Answer

Add a virtual wire interface to ensure traffic reaches the firewall.

Question 15

Arrange the steps to configure a new administrator account with role-based access.

Accepted Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Select the role. Step 4: Commit.. To configure a new administrator with role-based access on a Palo Alto firewall, you must first create the administrator account by navigating to Device > Administrators and clicking Add. Then enter the username and password. Next, assign a role (e.g., Superuser, Read‑Only, or a custom role) to define the access level. Finally, commit the changes to apply the configuration. This sequence ensures the account is fully defined before committing.

Answer

Step 1: Enter username and password. Step 2: Navigate to Device > Administrators and click Add. Step 3: Select the role. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Select the role. Step 3: Enter username and password. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Commit. Step 4: Select the role.

Question 16

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

Accepted Answer

The application override is not configured.. When a custom application is created with a signature, the firewall uses App-ID to identify the traffic based on the signature. However, if the traffic is still being misidentified as 'web-browsing', it means the firewall is matching the default HTTP/HTTPS application before the custom signature can be evaluated. An application override is required to explicitly tell the firewall to skip App-ID processing for that traffic and instead use the custom application 'my-app'. Without the override, the firewall's default App-ID logic continues to classify the traffic based on its standard signatures.

Answer

The custom application is not activated in the security policy rule.

Answer

The vulnerability protection profile is dropping the traffic.

Answer

The decryption policy is blocking the traffic.

Question 17

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct. This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile

Question 18

Refer to the exhibit. The firewall's disk usage is at 85% overall, and the /opt/panlogs partition is at 92%. The administrator wants to free up space without losing important log data. Which action should be taken first?

Accepted Answer

Configure log auto-deletion in the Log Settings to purge logs older than a specified period. Configuring log auto-deletion in the Log Settings allows the administrator to automatically purge older logs based on a specified retention period, freeing up disk space on the /opt/panlogs partition without manually deleting important log data. This is the safest and most controlled method, as it respects the firewall's log management policies and ensures compliance with data retention requirements.

Answer

Add an external storage device to the firewall

Answer

Delete configuration files from /opt/pancfg

Answer

Delete the /opt/panlogs directory and recreate it

Question 19

A company uses Panorama to manage multiple firewalls. An administrator pushes a template that includes a new Security Profiles group, but the firewalls do not receive the profile group. What is the most likely cause?

Accepted Answer

The firewalls are not assigned to the template that contains the profile group.. Panorama pushes templates to firewalls based on template assignment. If a firewall is not assigned to the template that contains the Security Profiles group, the firewall will never receive that configuration, regardless of the push operation. Template assignment is a prerequisite for any template-based configuration to be applied to a managed firewall.

Answer

The profile group references a profile that does not exist in the template.

Answer

The push was performed to device groups instead of templates.

Answer

The commit was not selected to include the new profiles.

Question 20

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. 'show running resource-monitor' displays real-time CPU and memory utilization per dataplane or control plane process, which directly helps identify resource exhaustion causing latency. This command provides granular per-process metrics, unlike the aggregated 'show system resources', making it essential for pinpointing bottlenecks in high-latency scenarios.

Answer

show session info

Answer

show log traffic