PCNSE Practice Test 23 — 15 Questions

Question 1

A security administrator is configuring a security policy to allow the 'web-browsing' application but block the 'facebook' application. The administrator creates a rule that allows 'web-browsing' and a subsequent rule that denies 'facebook'. However, users report that they can still access Facebook. The administrator checks the traffic logs and sees that Facebook traffic is being identified as 'web-browsing'. Which action should the administrator take to correctly block Facebook?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL decryption for Facebook traffic to allow App-ID to identify it correctly.. The correct action is to enable SSL decryption for Facebook traffic. Without decryption, the firewall cannot inspect the encrypted payload and may only see generic 'web-browsing' or 'ssl'. By decrypting, the firewall can identify the application as 'facebook' and enforce the deny rule. The other options are either too broad, unreliable, or address a different feature.

Answer

Create a custom App-ID signature for Facebook based on its SSL certificate.

Answer

Add a URL filtering profile to block facebook.com.

Answer

Modify the security policy to deny 'ssl' instead of 'facebook'.

Question 2

A security administrator needs to ensure that the firewall sends an email notification to the security team whenever a critical threat is detected. The email server is reachable at 10.10.10.5, and the firewall's management interface is in the 10.10.10.0/24 subnet. Which configuration step is required to enable email notifications for critical threats?

Accepted Answer

Configure an Email server profile under Device > Server Profiles > Email and then attach it to a Log Forwarding profile used in the security policy.. The correct approach is to create an Email server profile that defines the SMTP server, and then reference that profile within a Log Forwarding profile. The Log Forwarding profile is then attached to the security policy that logs the critical threats. This ensures that when a threat is detected, an email is sent. Other options involve different server types that do not provide email functionality.

Answer

Configure a Syslog server profile under Device > Server Profiles > Syslog and set the severity level to critical.

Answer

Configure a Log Forwarding profile under Objects > Log Forwarding and enable email notifications directly in the profile.

Answer

Configure an SNMP trap destination under Device > Server Profiles > SNMP and enable traps for critical threats.

Question 3

An administrator is preparing a PA-3220 running PAN-OS 11.0 for a maintenance window and wants to capture the current operational state so it can be compared after the window. Which two actions should the administrator take to preserve this state for later comparison? (Choose two.)

Accepted Answer

Generate a Tech Support File from the device to capture logs, configuration, and system state in one archive.. Preserving state before maintenance involves capturing both configuration and diagnostics. A named configuration snapshot saves the committed configuration for later diff or rollback, while a Tech Support File archives configuration, logs, and system diagnostics in one artifact. Rebooting, deleting logs, and changing the management address all alter the device rather than preserve its state.

Answer

Delete the oldest log segments to free space so new logs are not lost during the window.

Answer

Change the management interface IP address so the device is reachable from a different subnet after the window.

Answer

Run the request system reboot command to flush volatile state so the snapshot is clean.

Question 4

A network engineer is deploying SSL Forward Proxy decryption on a Palo Alto Networks firewall. The engineer wants to ensure that the firewall can decrypt traffic to external sites while also being able to detect if a server presents an expired certificate. Which decryption profile setting should be enabled to block sessions when the server certificate is expired?

Accepted Answer

Block sessions with expired certificates under SSL Forward Proxy settings.. Within a decryption profile, the SSL Forward Proxy settings include an option to block sessions when the server certificate is expired. Enabling this ensures that the firewall checks the validity period of the server's certificate and drops the connection if it has expired. This is the correct setting to meet the requirement.

Answer

Block sessions with unknown certificate status under SSL Forward Proxy settings.

Answer

Block sessions with untrusted issuers under SSL Forward Proxy settings.

Answer

Block sessions with client authentication failures under SSL Forward Proxy settings.

Question 5

A network security engineer is configuring a route-based IPsec VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the tunnel interface is used for dynamic routing updates and that the VPN can fail over to a backup path if the primary path goes down. Which configuration is required to achieve this?

Accepted Answer

Configure a tunnel interface, assign it to a zone, and enable tunnel monitoring with a destination IP address.. A route-based VPN requires a tunnel interface to participate in dynamic routing. Tunnel monitoring detects when the primary path fails, allowing routing protocols to withdraw routes and use a backup path. This combination ensures both dynamic routing and failover, which are essential for the described requirements.

Answer

Use policy-based VPN with proxy IDs and configure multiple proxy IDs for redundancy.

Answer

Enable IKEv2 and configure a separate tunnel interface for each path, then use OSPF with equal-cost multipath.

Answer

Enable IKEv1 with aggressive mode and configure multiple pre-shared keys for each path.

Question 6

An engineer is troubleshooting an HA pair where the passive firewall is not synchronizing sessions. The HA1 link is up and the HA state is 'passive'. The engineer notices that the HA2 link is up, but session synchronization is still not working. Which action should the engineer take next?

Accepted Answer

Verify that the 'Session Synchronization' option is enabled in the HA configuration.. Session synchronization requires the 'Session Synchronization' option to be enabled. Even if the HA2 link is up, if this setting is disabled, no sessions will be synchronized. The engineer should verify this setting first. This is a common oversight when configuring HA. Once enabled, the active firewall will begin replicating sessions to the passive peer.

Answer

Configure the HA2 link to use the management interface to simplify cabling.

Answer

Ensure that the HA1 link is encrypted with a pre-shared key.

Answer

Check that the HA2 link is configured with the same IP addresses on both firewalls.

Question 7

A network security engineer is configuring a new site-to-site IPsec VPN between two Palo Alto Networks firewalls. The design requires that the IKE Phase 1 negotiation must be cryptographically protected and that the peer's identity is verified using a pre-shared key. The engineer configures an IKE Crypto profile with AES-256-CBC, SHA-256, and DH Group 14. After committing, the tunnel fails to establish. Which component is most likely missing or misconfigured to cause this failure?

Accepted Answer

The IKE Gateway configuration does not have the pre-shared key configured.. For a site-to-site VPN using pre-shared key authentication, the IKE Gateway must include the pre-shared key. Without it, IKE Phase 1 cannot authenticate the peer, and the tunnel will not establish. The IKE Crypto profile only defines encryption and hashing algorithms; it does not handle authentication. Therefore, the missing pre-shared key is the most likely cause of the failure.

Answer

The tunnel interface is not configured with an IP address.

Answer

The IKE Gateway is configured with the wrong local interface.

Answer

The IPsec Crypto profile is missing an encryption algorithm.

Question 8

A security engineer is configuring HA on a pair of Palo Alto Networks firewalls. The engineer wants to ensure that the HA1 control link is highly available. Which configuration should the engineer use for the HA1 link?

Accepted Answer

Use an HA1 backup link in addition to the primary HA1 link.. The HA1 control link is critical for HA communication. To ensure high availability, a backup HA1 link should be configured. This allows the firewalls to maintain HA state synchronization even if the primary HA1 link fails. Other options may provide a working link but do not offer redundancy for the link itself.

Answer

Use a dedicated physical interface connected to a switch with redundant paths.

Answer

Use an IP-bridged HA1 link over a dedicated physical interface.

Answer

Use a dedicated physical interface with a direct cable between the firewalls.

Question 9

A network security administrator is configuring a new Palo Alto Networks firewall and wants to ensure that traffic between two internal subnets is inspected by the firewall. The subnets are on different interfaces. What must be configured to allow the firewall to inspect this traffic?

Accepted Answer

A Security policy rule allowing traffic from the source zone to the destination zone.. To allow and inspect traffic between two internal subnets on different interfaces, the administrator must create a Security policy rule that permits traffic from the source zone to the destination zone. This rule enables the firewall to perform security inspections such as application identification, threat prevention, and content filtering. Other policies like NAT, PBF, or decryption are not required for basic traffic flow and do not replace the need for a Security policy rule.

Answer

A Policy-Based Forwarding (PBF) rule to redirect the traffic to the firewall.

Answer

A NAT policy rule translating the source IP addresses.

Answer

A decryption policy rule to decrypt the traffic.

Question 10

An administrator needs to ensure that the firewall sends an alert to an external server whenever a critical threat is detected, and also wants to receive a daily summary of blocked traffic. Which two log forwarding destinations should be configured to satisfy both requirements?

Accepted Answer

Configure an email profile for the critical threat alerts and a scheduled report for the daily summary.. Critical threat alerts are event-driven and are best delivered through an email profile referenced by a log forwarding profile, which fires when a matching log is generated. A recurring summary of blocked traffic is a scheduled reporting task, produced by a report configured to run daily. Syslog streams raw events and does not produce summaries, and SNMP traps target device-level events rather than log content.

Answer

Configure an SNMP trap server profile for the daily summary and an email profile for the critical threat alerts.

Answer

Configure a syslog server profile for the critical threat alerts and a scheduled report for the daily summary.

Answer

Configure a syslog server profile for the daily summary and an email profile for the critical threat alerts.

Question 11

A network security engineer is troubleshooting why a Palo Alto Networks firewall is not enforcing a security policy that should block traffic from the untrust zone to the trust zone. The policy is configured correctly, and the firewall is receiving traffic. The engineer suspects that the traffic is being allowed by a different policy due to policy evaluation order. Which factor determines the order in which security policies are evaluated?

Accepted Answer

The order of rules in the security policy rulebase, from top to bottom.. Security policies are evaluated sequentially from the top of the rulebase to the bottom. The first matching rule is enforced, so rule order is critical. Placing a block rule below an allow rule that matches the same traffic will result in the traffic being allowed. Therefore, the engineer must reorder rules to ensure the block rule is evaluated first.

Answer

The rule with the most specific match is evaluated first, regardless of position.

Answer

Rules are evaluated based on the zone pair, with intra-zone rules first.

Answer

Rules with a deny action are always evaluated before allow rules.

Question 12

An administrator is preparing to upgrade a PA-5220 firewall from PAN-OS 10.2 to a later maintenance release. Before the upgrade, the administrator wants to minimize the chance of a failed upgrade and ensure a rollback path exists. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Verify that the current configuration passes validation and resolve any commit warnings before starting.. Validating the configuration and clearing commit warnings ensures the new PAN-OS version can commit the existing configuration, and exporting both a configuration snapshot and a device state backup creates an external restore point. Together these steps reduce upgrade risk and guarantee a usable rollback path if the new version misbehaves.

Answer

Change the management interface to a different IP address so the upgrade does not conflict with the old configuration.

Answer

Delete the previous PAN-OS image from the firewall to free space for the new version.

Answer

Disable all Security policy rules temporarily so that traffic is not inspected during the upgrade.

Question 13

An administrator is troubleshooting why a Security policy rule that allows traffic from the 'trust' zone to the 'untrust' zone is not matching for certain sessions. The administrator notices that the sessions are being denied by an interzone rule. What is the most likely cause?

Accepted Answer

The interzone rule is placed above the allow rule in the rulebase.. The most likely cause is that the interzone deny rule is positioned above the allow rule in the Security policy rulebase. Because PAN-OS evaluates rules from top to bottom and stops at the first match, a deny rule higher in the list will take precedence over a later allow rule. To resolve the issue, the administrator should move the allow rule above the interzone deny rule or adjust the interzone rule to be more specific so it does not match the intended traffic.

Answer

The allow rule is configured with the application 'any' instead of a specific application.

Answer

The allow rule is configured with a source user instead of a source IP address.

Answer

The allow rule is configured with a destination zone of 'untrust' but the traffic is destined to the firewall itself.

Question 14

An administrator is configuring a Palo Alto Networks firewall to enforce security policies based on user identity. The environment uses Active Directory, and the administrator plans to deploy User-ID. Which TWO actions are required to enable User-ID to map IP addresses to usernames? (Choose two.)

Accepted Answer

Ensure the firewall can communicate with the domain controllers over the required ports for User-ID (e.g., RPC, WMI).. To enable User-ID mapping, the firewall must have a User-ID agent (integrated or external) configured to connect to domain controllers and the necessary network access to those controllers. These two actions allow the firewall to learn user-to-IP mappings from Active Directory security logs. Other steps like zone configuration or LDAP are for enforcement or group mapping, not for enabling the basic mapping function.

Answer

Configure the firewall to use LDAP to query the domain controller for user group memberships.

Answer

Create a security policy that includes user or group objects in the Source User field.

Answer

Enable User-ID on the zone(s) where users reside by applying a User-ID enabled zone configuration.

Question 15

A security engineer is configuring a Palo Alto Networks firewall to send alerts to an external SNMP manager. The engineer wants to ensure that the firewall sends SNMP traps for specific events, such as a link state change and a configuration change. Which two actions must the engineer perform to achieve this? (Choose two.)

Accepted Answer

Configure an SNMP server profile with the manager's IP address and community string.. To send SNMP traps for specific events, the engineer must first configure an SNMP server profile with the manager's details, and then enable the desired traps in the SNMP setup. These two steps ensure the firewall knows where to send traps and which events to report. Security policy rules and log forwarding profiles are not involved in system-level SNMP trap generation, and SNMP operates on the management plane, not the dataplane.

Answer

Configure a log forwarding profile to send SNMP traps.

Answer

Create a security policy rule to allow SNMP traffic from the firewall to the manager.

Answer

Enable SNMP on the dataplane interfaces to allow trap generation.