PCNSE Practice Test 24 — 15 Questions

Question 1

During a failover test, the active firewall in an active/passive HA pair goes down, but the passive firewall remains in passive state and does not take over. The passive firewall shows HA state 'passive' and the HA1 link status is 'down'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The HA1 link is down, preventing heartbeat communication.. The HA1 link is critical for heartbeats and control communication. When it is down, the passive firewall cannot determine the active firewall's status and will not initiate failover. The stem indicates HA1 link status is 'down', which directly explains why the passive firewall remains passive despite the active firewall going down.

Answer

The HA2 link is not configured for session synchronization.

Answer

The HA1 link is not configured with the same subnet on both firewalls.

Answer

The passive firewall is configured with a lower HA priority.

Question 2

An administrator needs every administrator login, configuration commit, and firewall restart to be recorded in a central location for an upcoming audit. The auditor requires that the records be queryable by username and timestamp, and that they be retained independently of the firewall's own log storage. Which action should the administrator take to meet these requirements?

Accepted Answer

Enable the Audit Log on the management plane and forward it to an external syslog server.. Administrative activity such as administrator logins, configuration commits, and reboots is recorded in the management-plane audit log, which includes the username and timestamp for each entry. To retain those records independently of the firewall's local storage, the audit log must be forwarded to an external syslog server, satisfying both the query and retention requirements.

Answer

Configure a Log Forwarding profile on the management interface to send system logs to an external server.

Answer

Configure a Syslog server profile under Device > Server Profiles > Syslog and attach it to the Management interface's log settings.

Answer

Create a custom report under Monitor > Manage Custom Reports that includes the configuration log and schedule it to be emailed daily.

Question 3

A network security engineer is troubleshooting an SSL decryption issue. Users report that after decryption was enabled, they cannot access certain HTTPS websites that use certificate pinning. The firewall is configured with SSL Forward Proxy decryption. Which action should the engineer take to allow access to these websites while still decrypting other traffic?

Accepted Answer

Add the websites to the SSL Decryption Exclusion list.. Certificate pinning causes applications to reject certificates not signed by the expected CA. When the firewall decrypts and re-signs, the pinned certificate is replaced, causing failures. Adding the affected websites to the SSL Decryption Exclusion list bypasses decryption for them, allowing the original certificate to be presented and satisfying pinning. This maintains decryption for other traffic.

Answer

Configure the firewall to use the forward untrust certificate for these websites.

Answer

Disable SSL decryption globally.

Answer

Enable 'Block sessions with untrusted issuers' in the decryption profile.

Question 4

A security administrator is configuring a Palo Alto Networks firewall and needs to ensure that traffic from the trust zone to the untrust zone is inspected for threats. The administrator wants to enable threat prevention profiles on the security policy. Which Palo Alto Networks feature is responsible for detecting and preventing threats such as viruses, spyware, and command-and-control traffic?

Accepted Answer

Content-ID. Content-ID is the Palo Alto Networks integrated threat prevention engine that provides antivirus, anti-spyware, vulnerability protection, and other threat detection capabilities. It inspects allowed traffic based on security profiles attached to security policies. In this scenario, enabling threat prevention profiles activates Content-ID to detect and prevent threats such as viruses, spyware, and command-and-control traffic. App-ID identifies applications, User-ID maps users, and SSL Decryption enables inspection of encrypted traffic, but none of these detect threats directly.

Answer

SSL Decryption

Answer

App-ID

Answer

User-ID

Question 5

A security engineer deployed SSL Forward Proxy decryption to inspect outbound HTTPS traffic. Several users report that when they access a partner's HTTPS portal, the browser shows a certificate warning and the site fails to load. The firewall's forward trust certificate is signed by the company's internal certificate authority. Which action should the engineer take to resolve the issue while maintaining decryption?

Accepted Answer

Import the internal certificate authority's root certificate into the users' browsers' trusted root store.. The browser warning occurs because the firewall re-signs the partner site's certificate with its forward trust certificate, which is issued by the company's internal CA. If the client does not trust that CA, validation fails. Importing the internal CA root into the users' browsers' trusted root store establishes trust, allowing decryption to continue without warnings. The other options either bypass decryption or misuse certificate types, failing to resolve the trust issue.

Answer

Add the partner site to the SSL Decryption Exclusion list.

Answer

Install the forward untrust certificate on the firewall and present it to the partner site.

Answer

Configure the firewall to use the forward trust certificate as the forward untrust certificate.

Question 6

A network administrator wants to generate a report that shows the top applications used over the past week. The firewall is managed by Panorama. Which Panorama feature should the administrator use to create and schedule this report?

Accepted Answer

Use the Manage Custom Reports feature under Monitor > Manage Custom Reports to create a report and schedule it.. Panorama's Manage Custom Reports feature is designed for creating, scheduling, and distributing reports. It allows selecting data sources such as traffic logs and defining the report content, including top applications. The report can be scheduled to run at intervals and emailed to recipients. Other options involve real-time monitoring or external systems, which do not provide the scheduled reporting capability within Panorama.

Answer

Use the PDF Report feature under Monitor > PDF Reports to create a report.

Answer

Use the Log Forwarding profile to send logs to an external syslog server and then generate reports on that server.

Answer

Use the Application Command Center (ACC) to view top applications and export the data.

Question 7

A network administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic is separated from data traffic. Which interface type should be used for out-of-band management?

Accepted Answer

A dedicated management interface (MGT) with its own IP address and default gateway.. The dedicated management interface (MGT) is specifically designed for out-of-band management, providing a separate routing table and isolation from data traffic. This ensures that management access is not affected by data plane issues and enhances security by keeping management traffic separate. Other interface types are part of the data plane and do not offer the same level of separation.

Answer

A VLAN interface on a data port configured with a management profile.

Answer

A tunnel interface configured for management access.

Answer

A loopback interface configured in the management zone.

Question 8

A company has a Palo Alto Networks firewall with two virtual systems (vsys) configured. The administrator wants to ensure that traffic between vsys1 and vsys2 is inspected by the firewall. What must be configured to allow this inter-vsys traffic?

Accepted Answer

A shared Security policy rule in the shared policy or a rule in each vsys, plus routing between the vsys.. To allow inter-vsys traffic, the administrator must configure Security policy rules that permit the traffic, either as a shared rule or individual rules in each vsys, and ensure that routing is in place to direct traffic between the vsys. Each vsys has its own virtual router, so routes must exist to forward traffic from one vsys to the other, often through a shared interface or an inter-vsys link. Without both policy and routing, the traffic will be blocked or dropped.

Answer

A NAT policy rule translating the source IP addresses between vsys.

Answer

A Security policy rule in each vsys allowing traffic to the other vsys.

Answer

A Policy-Based Forwarding (PBF) rule to redirect traffic between vsys.

Question 9

An engineer is troubleshooting an HA pair where the passive firewall is not receiving session updates. The HA1 link is up and the firewalls are in active/passive mode. The engineer runs 'show high-availability state' and sees 'State: passive' and 'Peer State: active'. Which additional command should the engineer run to verify that session synchronization is enabled and functioning?

Accepted Answer

show high-availability state-synchronization. To verify session synchronization, the engineer should use the command that specifically reports on synchronization state and statistics. 'show high-availability state-synchronization' provides details such as whether synchronization is enabled, the number of synchronized sessions, and any errors. This is the most direct way to confirm if session updates are being sent and received correctly.

Answer

show high-availability interface ha2

Answer

show session all

Answer

show high-availability state

Question 10

A security administrator is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for a specific user group. The administrator creates a decryption policy with source user group 'Finance', destination any, and action 'ssl-forward-proxy'. However, after committing, users in the Finance group report that they can still access HTTPS sites without any certificate warnings, and the firewall logs show no decryption. The administrator verifies that the decryption policy is placed correctly and that the forward trust certificate is installed and trusted by the clients. What is the most likely reason decryption is not occurring?

Accepted Answer

The user group 'Finance' is not properly mapped to IP addresses via User-ID, so the policy does not match.. Decryption policies that use user groups require User-ID to map users to IP addresses. If User-ID is not configured or the group mapping is missing, the policy will not match, and traffic will not be decrypted. The absence of certificate warnings and decryption logs supports this. Other options are less likely because the service is typically 'any', the certificate is verified as installed, and the action is correct for outbound decryption.

Answer

The decryption policy action should be 'ssl-inbound-inspection' instead of 'ssl-forward-proxy'.

Answer

The decryption policy is missing a service definition for HTTPS.

Answer

The forward trust certificate is not installed on the firewall.

Question 11

A security engineer is setting up a route-based IPsec VPN between a Palo Alto Networks firewall and a third-party peer. The engineer has configured the IKE gateway, IPsec crypto profile, and tunnel interface. The tunnel is established, but traffic is not passing. The engineer checks the routing table and sees that routes for the remote subnet are pointing to the tunnel interface. What is the next logical step to troubleshoot the issue?

Accepted Answer

Verify that the security policy allows traffic from the tunnel zone to the internal zone.. When a route-based VPN tunnel is up and routes are correct, the next troubleshooting step is to check security policies. Traffic entering the tunnel interface is subject to security policy rules based on the tunnel zone. If no rule permits the traffic, it will be dropped. Other options like rechecking tunnel status or crypto profiles are unnecessary because the tunnel is already established.

Answer

Confirm that the proxy IDs are correctly configured on both peers.

Answer

Verify that the IPsec crypto profile uses the same encryption algorithm as the peer.

Answer

Check the IKE Phase 1 and Phase 2 status to ensure the tunnel is fully established.

Question 12

A security administrator is configuring App-ID to distinguish between a sanctioned SaaS application and an unsanctioned one that both use HTTPS on TCP port 443. The administrator wants the firewall to identify the sanctioned application by inspecting the TLS handshake and certificate details. Which firewall feature should be enabled to achieve this?

Accepted Answer

SSL Forward Proxy decryption. To differentiate applications that both use HTTPS on port 443, the firewall must decrypt the traffic and inspect the TLS handshake and certificate. SSL Forward Proxy decryption enables this by acting as a man-in-the-middle for outbound connections, allowing App-ID to identify the application based on its unique characteristics. This is the correct approach for identifying sanctioned SaaS applications.

Answer

SSL Inbound Inspection

Answer

App-ID with TLS 1.3 only

Answer

DNS Sinkhole

Question 13

A security administrator needs to configure the firewall to send an email alert whenever a critical threat is detected. The administrator wants to ensure that the email includes the threat details and is sent immediately. Which configuration step is required to achieve this?

Accepted Answer

Create a Log Forwarding profile that includes an email server profile and attach it to the security policy that detects the threat.. To send email alerts for critical threats, the administrator must configure a Log Forwarding profile that includes an Email server profile and apply it to the security policy. This ensures that when a threat is detected, the corresponding threat log is forwarded via email immediately, including all relevant details.

Answer

Enable SNMP traps on the firewall and configure the management server to receive them.

Answer

Configure a Syslog server profile and assign it to the security policy to receive threat logs.

Answer

Configure an Email profile in Device > Server Profiles > Email and assign it to the security policy that detects the threat.

Question 14

A firewall administrator is configuring a new security zone for a DMZ. The requirement is that the DMZ zone should not be able to initiate connections to the internal trusted zone, but the trusted zone should be able to initiate connections to the DMZ. Which configuration achieves this with the least administrative effort?

Accepted Answer

Create a security policy from trust to DMZ allowing the required applications, and rely on the implicit deny for DMZ to trust.. The default security posture of a Palo Alto Networks firewall is to deny all interzone traffic except intrazone traffic. By creating only the necessary allow rule from trust to DMZ, the administrator ensures that the trusted zone can initiate connections to the DMZ, while the DMZ cannot initiate connections to the trust zone because of the implicit deny. This minimizes configuration and reduces the risk of misconfiguration.

Answer

Assign the DMZ interface to the same zone as the trust interface, and use security policies to control traffic between them.

Answer

Create two security policies: one from trust to DMZ allowing all applications, and one from DMZ to trust denying all applications.

Answer

Configure the DMZ zone with a zone protection profile that blocks all traffic from the DMZ to the trust zone.

Question 15

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that a specific server (10.10.10.5) can communicate with any destination on the internet, but only when the server initiates the connection. The server must be able to receive return traffic. The administrator creates a security rule allowing traffic from the trust zone to the untrust zone with source 10.10.10.5 and application 'any'. However, the server cannot reach the internet. The administrator verifies that the default route is correct and that the server can ping the firewall's interface. What is the most likely reason the server cannot reach the internet?

Accepted Answer

The security rule is missing a source NAT (SNAT) rule, so the server's private IP address is not translated and return traffic cannot find its way back.. For a server with a private IP address to access the internet, the firewall must perform source NAT to translate the private IP to a routable public IP. Without a NAT rule, return traffic cannot be routed back to the server. The security rule permits the traffic, but NAT is a separate configuration. The other options are less likely because application 'any' does not require a service, application override is not needed for basic connectivity, and the destination zone is typically part of the rule.

Answer

The security rule is missing a service definition; the application 'any' does not automatically include all services.

Answer

The security rule is missing an application override because the server's traffic is not being identified correctly.

Answer

The security rule is missing a destination zone; the firewall requires a destination zone to be specified for outbound traffic.