PCNSE Practice Test 21 — 15 Questions

Question 1

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

Accepted Answer

The authentication sequence changed after upgrade.. Option C is correct because the upgrade may have altered the authentication sequence, causing the LDAP profile to not be used in the correct order.

Answer

The LDAP server certificate has expired.

Answer

The RADIUS server is not reachable.

Answer

The GP portal certificate is not trusted by the client.

Question 2

A security administrator is trying to isolate a performance issue on a PA-3220. Which two commands provide real-time information about the dataplane performance? (Choose two.)

Accepted Answer

show system resources dataplane. The correct answers are A and B because both 'show running resource-monitor' and 'show system resources dataplane' provide real-time dataplane CPU and memory usage.

Answer

show counter global

Answer

show session info

Answer

show job all

Question 3

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

Accepted Answer

Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.. When security policy rules are not optimized, excessive traffic may be processed by App-ID, causing a backlog of sessions waiting for application identification. The firewall's dataplane can become overwhelmed if too many sessions require deep packet inspection before a decision is made, leading to high CPU utilization and a large number of pending App-ID sessions.

Answer

An application override policy is being used extensively.

Answer

SSL decryption is disabled for most traffic.

Answer

The application database is outdated and missing signatures.

Question 4

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Accepted Answer

Kerberos. Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Answer

LDAP

Answer

Local Database

Answer

RADIUS

Question 5

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

Accepted Answer

Floating static routes were not configured on the passive firewall.. In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Answer

Static routes were not synchronized.

Answer

OSPF routes were not synchronized.

Answer

BGP routes were not synchronized.

Question 6

Which TWO conditions can cause an HA pair to enter an 'active/active' state? (Choose two.)

Accepted Answer

Loss of HA keepalive on both sides. A is correct because when both firewalls lose the HA keepalive (sent over HA1 link), each firewall assumes the peer is dead and transitions to active state to ensure traffic continuity. This is a fail-safe mechanism: without keepalive, each unit independently becomes active, resulting in an active/active condition that can cause duplicate IP addresses and traffic loops.

Answer

License expiration on one firewall

Answer

Session synchronization failure

Answer

Configuration mismatch between peers

Question 7

A company wants to enforce MFA for VPN users but allow users to authenticate without MFA when connecting from the corporate office. Which authentication policy configuration achieves this?

Accepted Answer

Create an authentication policy with source zone 'Corporate' set to 'allow' and authentication method 'no MFA'. Option C is correct because it creates an authentication policy that explicitly allows users from the 'Corporate' source zone to authenticate without MFA by setting the authentication method to 'no MFA'. This meets the requirement of enforcing MFA for VPN users (typically from untrusted zones) while exempting corporate office users. The authentication policy evaluates the source zone and applies the specified authentication method, overriding the global authentication profile for matching traffic.

Answer

Disable MFA in the global Authentication Profile

Answer

Create an authentication policy with source zone 'Corporate' set to 'require MFA'

Answer

Create an authentication policy with source zone 'Corporate' set to 'no-auth' and action 'allow'

Question 8

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

Accepted Answer

The 'allow-list' is restricting authentication to only user1 and user2. Option A is correct because the authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Answer

The Kerberos server profile 'KDC-Profile' is misconfigured

Answer

The expiration time of 60 minutes is too short

Answer

The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

Question 9

Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?

Accepted Answer

Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.. Option B is correct because Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.

Answer

SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

Answer

An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

Question 10

An organization has deployed GlobalProtect with certificate authentication. Users on macOS report that after updating their client, they cannot connect and see error 'Certificate validation failed: The certificate hash does not match.' What is the most likely cause?

Accepted Answer

The certificate pinning configuration on the gateway has a hash mismatch. Option A is correct because the error 'Certificate validation failed: The certificate hash does not match' specifically indicates a certificate pinning mismatch. GlobalProtect certificate pinning allows the gateway to enforce that the client's certificate matches a specific hash (SHA-256 fingerprint). When the client updates, its certificate may change (e.g., due to a new key pair or renewal), causing the hash stored in the gateway's pinning configuration to no longer match, resulting in this exact error.

Answer

The root CA certificate is not trusted on the client

Answer

The CRL is not reachable

Answer

The GlobalProtect gateway certificate is expired

Question 11

An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?

Accepted Answer

Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.. Option B is correct because it follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.

Answer

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Answer

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Answer

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Question 12

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

Accepted Answer

The firewall and IdP system clocks are out of sync. The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock. If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Answer

The IdP does not support IdP-initiated SAML flow

Answer

The user mapping agent is not configured

Answer

The SAML identity provider certificate is expired

Question 13

A network administrator needs to authenticate users accessing the internet through the firewall using Active Directory credentials. Which authentication method should be used to transparently authenticate users without requiring a browser-based captive portal?

Accepted Answer

Kerberos. Kerberos is the correct choice because it enables transparent, single sign-on (SSO) authentication in a Windows Active Directory domain. When a user logs into their domain-joined workstation, Kerberos obtains a Ticket-Granting Ticket (TGT) from the Key Distribution Center (KDC). The firewall can then use Kerberos authentication to verify the user's identity without requiring any browser-based captive portal, as the TGT or service ticket is presented automatically by the client.

Answer

LDAP

Answer

NTLM

Answer

SAML

Question 14

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. During a failover test, the passive firewall becomes active, but traffic stops passing through the new active firewall. The management interface on the new active firewall is reachable. What is the most likely cause?

Accepted Answer

The session setup rate exceeded the new active firewall's capacity.. Option D is correct because when a passive firewall becomes active, it must process all new session setups from scratch. If the session setup rate exceeds the new active firewall's capacity (e.g., due to licensing limits on session count or throughput), traffic will be dropped even though the management interface remains reachable. The management plane is separate from the data plane, so management access can still work while forwarding fails.

Answer

The ARP table was not synchronized during failover.

Answer

The HA2 link is down, causing session table mismatch.

Answer

The new active firewall does not have a valid license.

Question 15

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

Accepted Answer

Active/Active. In an active/passive HA pair, only one firewall should be active at a time. When both firewalls show as 'active', this is known as a split-brain condition. It occurs when the HA heartbeat link fails and each firewall assumes the other is down, causing both to transition to the active state and process traffic independently.

Answer

Link failure

Answer

Passive/Passive

Answer

Split brain