PCNSE Practice Test 22 — 15 Questions

Question 1

A network security engineer is validating a newly deployed firewall. The security policy is configured to allow web traffic from the Trust zone to the Untrust zone. After a user reports that a website is unreachable, the engineer runs the CLI command 'show session all filter source 10.1.1.50' and sees no active sessions. Which CLI command should the engineer use next to determine why the session was not established?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

test security-policy-match application ssl from Trust to Untrust source 10.1.1.50 destination 203.0.113.10 destination-port 443 protocol 6. The most direct way to determine why a session was not established is to simulate the policy lookup for the exact traffic flow. The 'test security-policy-match' command evaluates the five-tuple against the current ruleset and returns the matching rule or the reason for denial, such as implicit deny or no matching rule. This quickly identifies policy misconfigurations without generating live traffic, making it the correct choice for troubleshooting a missing session.

Answer

show counter global filter delta yes

Answer

show running security-policy

Answer

show session info

Question 2

A firewall's traffic logs are being forwarded to a Panorama appliance for centralized retention. An administrator notices that logs from one specific firewall are missing from Panorama even though the same firewall's logs appear locally. The firewall is managed by Panorama and shows as connected. Which cause is most likely?

Accepted Answer

The log forwarding configuration on the firewall is missing a Panorama server profile or the correct log forwarding profile attachment.. Centralized log collection requires the firewall to reference a Panorama server profile in its log forwarding configuration and to attach the appropriate Log Forwarding profile to the rules that generate the logs. When either piece is missing, traffic is still logged locally but never transmitted to Panorama, exactly matching a single firewall whose logs are absent centrally.

Answer

The firewall's local log quota is full and is overwriting entries before Panorama can retrieve them.

Answer

The firewall's management interface certificate has expired, so the Panorama connection silently drops log traffic.

Answer

Panorama is in Panorma mode instead of management-only mode, so it cannot receive logs.

Question 3

An administrator is configuring GlobalProtect with certificate authentication. The portal is configured to use a certificate profile that validates client certificates against a trusted CA. Users report that authentication fails with the error 'Certificate validation failed'. The administrator has verified that the client certificates are issued by the correct CA and are not expired. What is the most likely cause of the failure?

Accepted Answer

The certificate profile is not configured to allow the certificate's extended key usage (EKU) for client authentication.. Certificate validation in GlobalProtect checks multiple attributes, including EKU. If the certificate profile does not allow the EKU present in the client certificate, validation fails even if the certificate is from a trusted CA and not expired. The error message 'Certificate validation failed' is a strong indicator of such a mismatch.

Answer

The certificate revocation list (CRL) is not configured in the certificate profile.

Answer

The client certificate is not installed in the user's personal certificate store.

Answer

The GlobalProtect portal is not configured with the correct SSL/TLS service profile.

Question 4

An engineer is troubleshooting an active/passive HA pair where the passive firewall is not receiving session synchronization updates from the active firewall. The HA2 link is up, and the HA1 link is healthy. The engineer checks the HA configuration and sees that the HA2 interface is configured with an IP address, and session synchronization is enabled. What is the most likely cause of the synchronization failure?

Accepted Answer

The HA2 interface is configured in a different subnet on each firewall.. The HA2 interfaces must be in the same subnet for session synchronization to occur. If they are in different subnets, the firewalls cannot establish a direct connection for synchronization, even if the link is physically up. This is a common configuration error that leads to synchronization failure.

Answer

Session synchronization is disabled on the active firewall.

Answer

The HA2 interface is not assigned to a security zone.

Answer

The HA2 interface is configured as a Layer 2 interface instead of Layer 3.

Question 5

A company is deploying GlobalProtect for remote users. The security team wants to ensure that only users who authenticate successfully can access internal resources. They have configured the portal and gateway with an authentication profile that uses LDAP. However, users report that after authenticating, they can connect but cannot access any internal resources. What is the most likely cause?

Accepted Answer

The security policy allowing traffic from the GlobalProtect zone to the internal zone is missing or misconfigured.. In GlobalProtect, after a user connects, their traffic is subject to security policies. The GlobalProtect zone is typically used for incoming VPN traffic. A security policy must allow traffic from the GlobalProtect zone to the internal zone or resources. Without this policy, the user can authenticate and establish a tunnel but cannot access internal resources.

Answer

The GlobalProtect portal is not configured to push the correct routes to the clients.

Answer

The GlobalProtect gateway is not configured with a certificate for SSL/TLS.

Answer

The LDAP authentication profile is not properly mapped to the GlobalProtect gateway.

Question 6

A network administrator needs to verify that the firewall is receiving dynamic updates for applications and threats. Which command should they use from the CLI to check the current update status and schedule?

Accepted Answer

show system dynamic-updates. The CLI command 'show system dynamic-updates' provides a summary of the currently installed dynamic update versions and the configured update schedule. This allows administrators to quickly verify that the firewall is up to date with the latest applications and threats content.

Answer

show jobs all

Answer

show system update-server

Answer

show system info

Question 7

An engineer is troubleshooting an active/passive HA pair where the passive firewall is not receiving session synchronization updates. The engineer runs 'show high-availability state' on both firewalls and sees that the HA2 link is down. Which action should the engineer take first to resolve the issue?

Accepted Answer

Check the physical cabling and switch port configuration for the HA2 link.. When an HA2 link is down, the first step is to check the physical connectivity, including cables, switch ports, and interface status. This is because the most common causes of a down link are physical issues. Once the physical layer is verified, other configuration aspects can be checked.

Answer

Restart the HA services on both firewalls.

Answer

Verify that the HA2 interface is configured with the correct IP address and is in the same subnet as the peer.

Answer

Ensure that the HA2 link is configured for encryption.

Question 8

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to view the current sessions in real-time to identify which application is consuming the most bandwidth. Which command should the administrator use?

Accepted Answer

show session all. To view current sessions and identify bandwidth-consuming applications, the 'show session all' command is the most direct method. It lists all active sessions with details including application and byte counts. Other commands like 'show running resource-monitor' or 'show system statistics' provide aggregate data but not per-session detail. 'show interface all' shows interface-level statistics, not application breakdown. Thus, 'show session all' is the correct choice.

Answer

show running resource-monitor

Answer

show system statistics

Answer

show interface all

Question 9

A network security engineer is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The firewall must present a certificate to internal users for any external site they visit, signed by the company's internal certificate authority. The company's CA certificate is already imported into the firewall. Which additional configuration is required on the firewall to ensure that the Forward Trust certificate is used for signing website certificates?

Accepted Answer

Create a certificate signing request (CSR) for the Forward Trust certificate, have it signed by the internal CA, and import the signed certificate.. For SSL Forward Proxy decryption, the firewall must have a Forward Trust certificate that is trusted by internal clients. This certificate is typically a subordinate certificate signed by the organization's internal CA. The firewall generates a CSR, the CA signs it, and the resulting certificate is imported and configured as the Forward Trust certificate. This allows the firewall to dynamically generate certificates for external sites that clients will trust.

Answer

Generate a new self-signed certificate on the firewall and assign it as the Forward Trust certificate.

Answer

Assign the internal CA certificate directly as the Forward Trust certificate without generating a CSR.

Answer

Import the internal CA's private key and certificate into the firewall and designate it as the Forward Trust certificate.

Question 10

A network security administrator is investigating a suspicious session on a PA-3220 firewall. The administrator needs to determine the exact security policy rule that permitted the session to be established. Which action should the administrator take to accomplish this goal?

Accepted Answer

Use the Session Browser in the web interface and view the 'Policy' column for the specific session.. To identify the exact security policy rule that allowed a specific session, the administrator can use the Session Browser in the web interface, which shows the policy name for each active session. This real-time view is more direct than checking logs or using simulation commands, especially if the session is ongoing or logging is incomplete.

Answer

Use the 'show session all' CLI command and look for the policy name in the output.

Answer

Check the Traffic log and filter by the session's source and destination IP addresses.

Answer

Use the 'test security-policy-match' CLI command with the source and destination IP addresses and ports.

Question 11

A security administrator is configuring a Palo Alto Networks firewall to perform DNS sinkholing to detect and block malware callbacks. The firewall is deployed with a default route to the internet. The administrator wants to ensure that when an internal host attempts to resolve a known malicious domain, the firewall returns a sinkhole IP address (10.10.10.10) and logs the event. Which configuration is required to achieve this?

Accepted Answer

Create an Anti-Spyware profile with DNS sinkhole enabled and set the sinkhole IPv4 address to 10.10.10.10, then apply it to a security policy rule.. DNS sinkholing is implemented through an Anti-Spyware profile. The profile's DNS sinkhole settings allow the firewall to respond to DNS queries for malicious domains with a specified sinkhole IP address. This enables detection and logging of malware callbacks. Other methods like URL filtering, DNS proxy, or NAT do not provide the same selective inspection and response based on threat signatures.

Answer

Create a NAT rule that redirects DNS queries for malicious domains to 10.10.10.10.

Answer

Enable DNS sinkholing in the firewall's DNS proxy settings and specify the sinkhole IP address.

Answer

Configure a custom URL category with the malicious domains and set the action to 'sinkhole' in a URL filtering profile.

Question 12

A network administrator is setting up a new Palo Alto Networks firewall. The administrator needs to configure the firewall so that it can resolve domain names for its own management traffic, such as for updates and logging. Which type of interface should be configured with a default gateway to allow the firewall to reach external services?

Accepted Answer

Management interface. The management interface is dedicated for out-of-band management and for the firewall to communicate with external services like DNS, NTP, and update servers. To allow the firewall to resolve domain names for its own management traffic, the management interface must have a default gateway configured. Dataplane interfaces, whether Layer 3, Layer 2, or virtual wire, are for user traffic and do not handle management traffic by default.

Answer

Layer 2 dataplane interface

Answer

Layer 3 dataplane interface

Answer

Virtual wire interface

Question 13

A network engineer is troubleshooting why a Palo Alto Networks firewall is not decrypting SSH traffic even though an SSL Forward Proxy decryption policy is configured for the internal zone. The engineer confirms that the SSH traffic matches the decryption policy and that the forward trust and untrust certificates are installed and valid. What is the most likely reason the SSH traffic is not being decrypted?

Accepted Answer

SSL Forward Proxy decryption does not support SSH; SSH decryption requires SSH Proxy.. SSH is not an SSL/TLS protocol, so SSL Forward Proxy cannot decrypt it. Palo Alto Networks firewalls use SSH Proxy to decrypt and inspect SSH traffic, which requires a separate decryption policy and configuration. Since only SSL Forward Proxy is configured, the SSH traffic remains encrypted even if the policy matches. The correct solution is to configure SSH Proxy decryption for the SSH traffic.

Answer

The decryption policy is not matching because the SSH application is not recognized due to encryption.

Answer

The decryption policy is not applied because the SSH traffic is using a non-standard port.

Answer

The forward trust certificate is not trusted by the SSH client, so the firewall bypasses decryption.

Question 14

An administrator is deploying a PA-5220 firewall in a data center. The security team requires that all management access to the firewall's web interface and SSH be restricted to a dedicated out-of-band management network. The management interface (MGT) is currently configured with IP address 10.0.0.1/24 and default gateway 10.0.0.254. Which configuration step is required to allow only hosts on the 10.0.0.0/24 network to access the management interface?

Accepted Answer

Configure an Interface Management profile with permitted IP addresses 10.0.0.0/24 and assign it to the MGT interface.. Management access on Palo Alto Networks firewalls is controlled by Interface Management profiles, which specify allowed services and permitted source IP addresses. Assigning such a profile to the MGT interface ensures only hosts in 10.0.0.0/24 can reach the web interface and SSH. Security policies and static routes do not govern management plane traffic, and the global permitted IP list is less granular.

Answer

Enable the 'Permitted IP Addresses' setting under Device > Setup > Management and enter 10.0.0.0/24.

Answer

Add a static route for 10.0.0.0/24 pointing to the MGT interface and enable strict routing.

Answer

Create a security policy rule from the management zone to the management zone allowing only the 10.0.0.0/24 subnet.

Question 15

A network security administrator is deploying a new PA-3220 firewall in a data center. The security team requires that all traffic traversing the firewall be inspected for threats, but they want to minimize latency for trusted internal traffic that is already known to be benign. The administrator decides to create a security policy rule that allows traffic from the 'Trust' zone to the 'DMZ' zone without any security profiles attached. Which statement accurately describes the behavior of this rule?

Accepted Answer

The traffic will be allowed, and because no security profiles are attached, the firewall will not perform any threat inspection on this traffic.. Security profiles are the components that enable threat inspection on allowed traffic. When a security policy rule permits traffic but has no security profiles attached, the firewall performs application identification and other basic functions but does not scan for threats such as viruses, spyware, or vulnerabilities. This behavior allows administrators to tailor inspection based on trust levels and performance requirements. In this scenario, the administrator intentionally omits profiles to reduce latency for trusted internal traffic, and the firewall will honor that configuration.

Answer

The traffic will be allowed, but the firewall will still perform application identification and threat inspection if a profile is later added to the rule.

Answer

The traffic will be blocked by default because security profiles are mandatory for all allow rules.

Answer

The traffic will be allowed, but the firewall will automatically apply the default security profiles from the 'default' security profile group.