PCNSE Practice Test 21 — 15 Questions

Question 1

A network security engineer is troubleshooting a Palo Alto Networks firewall that is dropping traffic to a critical internal server. The engineer runs 'show session all filter destination 10.1.1.50' and sees sessions in the 'discard' state. The engineer wants to determine why these sessions are being discarded. Which action should the engineer take next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'show session id <session-id>' to view detailed session information including the discard reason.. The 'show session id' command provides detailed session information, including the discard reason, which is essential for troubleshooting why sessions are in the discard state. The other commands either provide aggregate data or require additional steps to correlate with the specific session, making them less efficient for this scenario.

Answer

Run 'show running resource-monitor' to check if the firewall is under resource stress.

Answer

Run 'show counter global filter severity drop' to identify the global counters that are incrementing.

Answer

Run 'debug dataplane packet-diag set filter match destination 10.1.1.50' to capture packets and analyze them.

Question 2

A network administrator is deploying a new Palo Alto Networks firewall and needs to configure the data-plane interfaces. The firewall will be placed between the internal network and the internet. The internal network uses private IP addresses and must be translated to a public IP address for outbound traffic. Which type of NAT should the administrator configure on the firewall?

Accepted Answer

Source NAT (SNAT). Source NAT (SNAT) translates the source IP address of outbound packets to a public IP address, enabling internal hosts with private addresses to communicate with external networks. This is the correct choice because the scenario requires outbound traffic from a private network to be translated to a public address. SNAT is the standard NAT type for internet access from private networks.

Answer

Destination NAT (DNAT)

Answer

U-Turn NAT

Answer

No NAT; use a security policy to allow outbound traffic

Question 3

A firewall administrator is troubleshooting why a user is unable to access a website. The administrator checks the traffic logs and sees that the session was allowed by the security policy, but the application is identified as 'ssl' instead of 'web-browsing'. The website uses HTTPS on port 443. What is the most likely reason for the application being identified as 'ssl'?

Accepted Answer

The firewall is not configured to decrypt SSL traffic, so it cannot identify the application as 'web-browsing'.. The application is identified as 'ssl' because the traffic is encrypted and the firewall cannot inspect the HTTP headers without SSL decryption. To identify 'web-browsing', the firewall must decrypt the traffic. This is expected behavior when decryption is not configured. The other options are less likely because the port is standard, the policy does not dictate application identification, and the database is not indicated as outdated.

Answer

The security policy rule is set to allow 'ssl' but not 'web-browsing', so the application is identified as 'ssl'.

Answer

The website uses a non-standard port for HTTPS, so the firewall cannot identify it as 'web-browsing'.

Answer

The firewall's application database is outdated and does not recognize 'web-browsing' over SSL.

Question 4

A network administrator is reviewing the firewall's logs and notices that many sessions are being denied by the security policy. The administrator wants to quickly identify the top source IP addresses that are being denied. Which feature in the PAN-OS web interface should the administrator use to accomplish this?

Accepted Answer

The Traffic log with a filter for denied sessions and then sorting by source IP.. The Traffic log records all sessions, including those denied by security policy. By applying a filter for denied actions and then using the log viewer's aggregation or sorting capabilities, the administrator can quickly identify the top source IP addresses. This is a standard operational task in PAN-OS. Other logs or tools do not provide the same direct access to denied session data.

Answer

The Application Command Center (ACC) with a filter for denied traffic.

Answer

The Threat log with a filter for denied traffic.

Answer

The Session Browser with a filter for denied sessions.

Question 5

An administrator is analyzing traffic logs on a Palo Alto Networks firewall and notices that a particular session shows an application of 'incomplete' and no bytes received. The session was allowed by the security policy. What is the most likely cause?

Accepted Answer

The firewall did not receive enough packets to identify the application.. An 'incomplete' application status in traffic logs indicates that the firewall could not identify the application because it did not receive enough packets or data to match a signature. This can occur with short-lived sessions, asymmetric routing, or when the session is terminated before the application is fully identified. The security policy allowed the session, but application identification failed.

Answer

The application is using a non-standard port and was not detected.

Answer

The security policy is blocking the application, causing incomplete identification.

Answer

The application was identified but the session timed out before data was exchanged.

Question 6

A network administrator is configuring a site-to-site IPsec VPN between a Palo Alto Networks firewall and a third-party vendor's VPN gateway. The administrator wants to ensure that the IKE phase 2 (IPsec) SA is established with perfect forward secrecy (PFS) using Diffie-Hellman group 14. Which configuration on the Palo Alto Networks firewall is required to meet this requirement?

Accepted Answer

In the IPsec Crypto profile, set the DH Group to group14.. Perfect Forward Secrecy for IKE phase 2 is configured in the IPsec Crypto profile. The DH Group field in this profile specifies the Diffie-Hellman group used for PFS during phase 2. Setting it to group14 ensures that the IPsec SA uses PFS with group14. The IKE Crypto profile controls phase 1, while the IPsec Crypto profile controls phase 2.

Answer

In the IKE Gateway configuration, enable 'Perfect Forward Secrecy' and select group14.

Answer

In the IKE Crypto profile, set the DH Group to group14.

Answer

In the IPsec Tunnel configuration, enable 'Perfect Forward Secrecy' and select group14.

Question 7

A security engineer is designing a Palo Alto Networks firewall deployment for a multi-tenant environment. The engineer needs to ensure that each tenant's traffic is isolated and that security policies can be applied per tenant. The engineer plans to use Virtual Systems (vsys) to achieve this. Which two statements about Virtual Systems (vsys) are true? (Choose two.)

Accepted Answer

Virtual Systems can be assigned dedicated physical interfaces or share interfaces using VLANs.. Virtual Systems (vsys) provide logical isolation on a single firewall, each with its own policies, zones, and interfaces. They can be assigned dedicated physical interfaces or share interfaces via VLANs. They can also have separate virtual routers for independent routing. Licensing is based on the total number of vsys enabled, not per instance. These characteristics make vsys suitable for multi-tenant deployments.

Answer

Virtual Systems share the same management interface and IP address.

Answer

Virtual Systems require a separate license for each vsys instance.

Answer

Virtual Systems share the same global routing table and cannot have separate virtual routers.

Question 8

A security engineer is configuring SSL decryption on a Palo Alto Networks firewall. The engineer wants to ensure that the firewall can decrypt outbound HTTPS traffic and present a valid certificate to internal users. Which certificate must be installed on the firewall to sign the certificates presented to internal users during SSL Forward Proxy decryption?

Accepted Answer

Forward trust certificate. The forward trust certificate is specifically designed for SSL Forward Proxy decryption. It is a CA certificate that the firewall uses to sign the certificates presented to internal users. Clients must trust this certificate to avoid errors. The forward untrust certificate is used for untrusted server certificates, and the SSL inbound certificate is for inbound inspection.

Answer

SSL inbound certificate

Answer

Forward untrust certificate

Answer

Root CA certificate

Question 9

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The firewall is deployed in a forward proxy mode. The engineer wants to ensure that the firewall can decrypt traffic without generating certificate errors on client browsers. Which configuration is required to achieve this?

Accepted Answer

Install the forward trust certificate on the firewall and distribute it to all client devices as a trusted root CA certificate.. In SSL forward proxy decryption, the firewall acts as a man-in-the-middle, decrypting traffic, inspecting it, and re-encrypting it. To prevent certificate warnings, the firewall uses a forward trust certificate to sign the certificates it presents to clients. For clients to trust these certificates, the forward trust certificate must be installed as a trusted root CA on each client device. This is a fundamental requirement for transparent SSL decryption without user disruption.

Answer

Install the forward trust certificate on the firewall and distribute the forward untrust certificate to all client devices.

Answer

Install the forward untrust certificate on the firewall and distribute the forward trust certificate to all client devices.

Answer

Install the forward trust certificate on the firewall and configure the clients to use the firewall as a proxy server for all SSL connections.

Question 10

A Palo Alto Networks firewall administrator is troubleshooting why a session was terminated with the flag 'tcp-rst-from-client'. The administrator wants to identify possible causes for this termination flag. Which two factors can cause a session to be terminated with 'tcp-rst-from-client'? (Choose two.)

Accepted Answer

The client application was closed abruptly, causing the operating system to send a RST.. The 'tcp-rst-from-client' flag indicates that the client sent a TCP RST packet. Common causes include the client application being closed abruptly, leading the OS to send a RST, or the client receiving a SYN-ACK for a connection it did not initiate, which triggers a RST. Other options like out-of-order packets or zero window do not cause RSTs. Security policy blocks would result in a different flag. Therefore, the correct factors are abrupt application closure and unexpected SYN-ACK.

Answer

The firewall's security policy blocked the traffic, causing the client to send a RST.

Answer

The client's TCP window size was reduced to zero, triggering a RST from the client.

Answer

The client received a packet that was out of order and sent a RST in response.

Question 11

A security engineer is configuring a security policy to allow only the specific business application 'salesforce' while blocking all other applications that use HTTPS. The firewall is not performing SSL decryption. What will be the result of the security policy?

Accepted Answer

The policy may not work as intended because salesforce traffic will be identified as ssl or web-browsing without decryption.. Without SSL decryption, App-ID cannot see inside the encrypted HTTPS session to identify the specific application. The traffic will be classified as 'ssl' or 'web-browsing', so a policy that allows 'salesforce' will not match. This means the policy will not work as intended, and the engineer must either enable decryption or adjust the policy to account for the limited visibility.

Answer

The policy will allow all HTTPS traffic because salesforce is not identifiable.

Answer

The policy will correctly allow salesforce and block other HTTPS applications.

Answer

The policy will block all HTTPS traffic because salesforce cannot be identified.

Question 12

A network engineer is configuring a route-based IPsec VPN between a Palo Alto Networks firewall and a third-party VPN peer. The engineer wants to ensure that the firewall can establish the tunnel even if the peer initiates the connection. Which configuration is required on the Palo Alto Networks firewall?

Accepted Answer

Configure the IKE gateway with a static peer IP address and ensure that the pre-shared key and proposals match the peer.. In Palo Alto Networks, an IKE gateway configured with a static peer IP address and matching pre-shared key and proposals will accept IKE requests from that peer. The firewall does not require a special mode to respond to peer-initiated connections; it can act as both initiator and responder. The key is that the gateway configuration must match the peer's settings.

Answer

Configure the IKE gateway with a static peer IP address and enable 'Passive' mode.

Answer

Configure the IPsec tunnel with 'Auto Key' and enable 'Responder Only' mode.

Answer

Configure the IKE gateway with a dynamic peer IP address and enable 'Aggressive' mode.

Question 13

A security administrator is reviewing traffic logs and notices that a known application is being identified as 'web-browsing' instead of its correct App-ID. The application uses HTTP and is not encrypted. The administrator confirms that the application is not a custom application. What is the most likely cause of this misidentification?

Accepted Answer

The application uses standard HTTP and does not have a unique signature, so the firewall defaults to 'web-browsing'.. App-ID identifies applications based on unique traffic patterns. If an application uses standard HTTP and lacks a distinct signature, the firewall may classify it as 'web-browsing' because it matches that generic App-ID. This is the most likely cause in the absence of custom configurations. Other options involve less probable scenarios like outdated databases or overrides.

Answer

The firewall's App-ID database is outdated and does not have the signature for the application.

Answer

The application's traffic is being tunneled over HTTP and the firewall cannot distinguish it from web-browsing.

Answer

The firewall is configured with an Application Override for HTTP that forces all HTTP traffic to be identified as web-browsing.

Question 14

A security administrator notices that after enabling SSL decryption, some users cannot access a website that uses a self-signed certificate. The firewall is configured with SSL Forward Proxy decryption. What is the most likely cause of the access issue?

Accepted Answer

The firewall's forward trust certificate is not trusted by the client, causing a certificate warning that prevents access.. The most likely cause is that the client does not trust the firewall's forward trust certificate. When SSL Forward Proxy decryption is enabled, the firewall re-signs the website's certificate with its forward trust certificate. If the client does not trust the CA that issued the forward trust certificate, it will display a warning and may block access. This is a common oversight when deploying decryption.

Answer

The website's certificate is not trusted by the firewall, so the firewall blocks the connection.

Answer

The website requires TLS 1.3, which the firewall cannot decrypt.

Answer

The decryption policy rule is misconfigured to not decrypt the website.

Question 15

A security administrator is investigating why a session was terminated with the flag 'tcp-rst-from-server' in the traffic logs. The administrator has confirmed that the server is reachable and responding to pings. Which of the following is the most likely cause for this session termination?

Accepted Answer

The server's TCP stack sent a RST packet because the application was not listening on the requested port.. A session terminated with 'tcp-rst-from-server' indicates that the server sent a TCP RST packet. This commonly occurs when the server receives a connection attempt for a port where no service is listening. While the server may respond to ICMP pings, that does not guarantee the application is available. Other causes like security policy blocks or zero window would produce different flags. Therefore, the correct answer is that the application is not listening on the port.

Answer

The server's TCP window size was set to zero, causing the firewall to send a RST.

Answer

The firewall's security policy blocked the traffic, causing the server to send a RST.

Answer

The server's operating system crashed and rebooted, sending a RST upon recovery.