PCNSE Practice Test 22 — 15 Questions

Question 1

Based on the exhibit, what caused the last failover?

Accepted Answer

The HA1 keepalive from the peer was lost.. The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Answer

The HA2 link went down.

Answer

A preemption event occurred.

Answer

The peer firewall was rebooted.

Question 2

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

Accepted Answer

Enable session sync on HA2.. Option D is correct because enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Answer

Configure HA3 for stateful inspection.

Answer

Increase HA1 keepalive timer.

Answer

Enable config sync on HA1.

Question 3

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Accepted Answer

Create separate virtual systems (VSYS) for each tenant on the same firewall.. Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Answer

Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

Answer

Use active/active HA mode to assign each tenant to a different firewall.

Answer

Configure multiple virtual routers (VRFs) within the same virtual system.

Question 4

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 5

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

Accepted Answer

Security policy rule groups. Security policy rule groups allow administrators to organize related firewall rules into logical units, which can then be applied to specific users or devices via policy-based forwarding or rule placement. This feature simplifies management by grouping rules that share a common purpose, such as those for a particular department or application, and enables targeted application without manual rule reordering. It directly addresses the requirement for logical grouping and selective application to users or devices.

Answer

Security profiles

Answer

Security zones

Answer

Application groups

Question 6

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

Accepted Answer

Increased packet drops due to buffer exhaustion.. When dataplane packet buffer usage exceeds 90% during a traffic spike, the firewall's packet buffers are nearly exhausted, leading to a condition where incoming packets cannot be stored temporarily for processing. This directly causes packet drops because the dataplane has no available buffers to enqueue new packets, even though CPU utilization remains low. Option D correctly identifies this as the primary impact, as buffer exhaustion results in tail-drop behavior for new packets.

Answer

Reduced new session setup rate.

Answer

Reduced committed information rate (CIR) on QoS policies.

Answer

Increased latency for management access.

Question 7

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Accepted Answer

Define a custom application object with the correct protocol signature and protocol type.. Option D is correct because the firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer

Disable SSL inspection on the security policy for this traffic.

Answer

Create an application override policy for this traffic to mark it as the custom application.

Answer

Enable SSL decryption on the traffic to inspect the payload.

Question 8

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Accepted Answer

The firewall will perform a reverse path forwarding (RPF) check on the source IP.. Option B is correct because when a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Answer

The firewall will automatically redistribute the route to VR-B if needed.

Answer

The packet will be dropped because the destination is not in the same VR as the ingress interface.

Answer

The firewall will use the zone of the egress interface to determine the security policy.

Question 9

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Session Table. The Session Table is a core dataplane component because it stores stateful session information for all active traffic flows. The dataplane uses this table to perform fast-path forwarding, applying security policies and NAT translations without involving the management plane. Without the session table, the firewall would be unable to maintain stateful inspection, which is fundamental to its operation.

Answer

Management Plane

Answer

Threat Prevention Engine

Answer

Log Database

Question 10

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Accepted Answer

Define a custom application with the appropriate protocol, port, and optionally a signature.. Option B is correct because when a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Answer

Create a security policy rule with an application override to match the port.

Answer

Enable SSL decryption on the traffic to inspect encrypted payloads.

Answer

Add the port to the default application's 'port' field in the application object.

Question 11

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Accepted Answer

10.0.0.0/24 via 10.0.0.2 ethernet1/2. The firewall performs a longest-prefix match on the routing table. The destination IP 10.0.0.100 matches the 10.0.0.0/24 route (prefix length 24) more specifically than the 10.0.0.0/8 route (prefix length 8) or the default route. Since the packet arrived on ethernet1/2 and the matching route points to the same interface, the route via 10.0.0.2 ethernet1/2 is selected.

Answer

10.0.1.0/24 via 10.0.0.3 ethernet1/3

Answer

10.0.0.0/8 via 10.0.0.1 ethernet1/1

Answer

0.0.0.0/0 via 10.0.0.1 ethernet1/1

Question 12

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 13

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration

Question 14

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. Option D is correct because the security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 15

Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?

Accepted Answer

The GlobalProtect client is configured to always use the gateway.. When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.

Answer

The gateway is not configured with a client IP pool.

Answer

The portal's authentication profile is incorrect.

Answer

The portal is not configured with internal host detection.

PCNSE Practice Test 22 — 15 Questions

Exhibit

PCNSE Practice Test 22 — 15 Questions

Exhibit