PCNSE Practice Test 2 — 25 Questions

Question 1

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 2

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 3

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 4

Based on the exhibit, what is the most likely cause for the majority of bypassed sessions?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the clients or servers.. The majority of bypassed sessions are most likely caused by a cipher mismatch between the firewall's SSL/TLS service profile and the clients or servers. When the firewall decrypts traffic, it must negotiate a cipher suite that both the client and server support; if the service profile does not include the cipher suites used by the endpoints, the firewall cannot complete the SSL/TLS handshake and bypasses the session. This is a common misconfiguration in Palo Alto Networks firewalls where the SSL/TLS service profile's cipher list is too restrictive.

Answer

The firewall is overloaded and cannot handle more decryption sessions.

Answer

The decryption certificate is not trusted by clients.

Answer

There is a network connectivity issue between firewall and servers.

Question 5

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Accepted Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then wait for the alarm LED to turn off and back on, then release the button.. The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Answer

Press and hold the reset button using a paperclip, then locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then release the button.

Answer

Locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then press and hold it using a paperclip, then release the button.

Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then release the button, then wait for the alarm LED to turn off and back on.

Question 6

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 7

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 8

A security team is implementing SSL Decryption. They want to ensure that traffic to health-related websites is not decrypted due to privacy concerns. Which method should they use to exclude this traffic?

Accepted Answer

Add the domain names to a custom URL category and create a no-decryption rule matching that category.. Palo Alto Networks firewalls allow you to create custom URL categories containing specific domain names (e.g., health-related sites) and then reference that category in a decryption policy rule set to 'no-decrypt'. This ensures traffic matching those domains is excluded from SSL decryption, addressing privacy concerns without affecting other traffic.

Answer

Use a source IP address exclusion list in the decryption policy.

Answer

Disable decryption for all sites that use certificate pinning.

Answer

Configure a decryption profile to exclude traffic based on App-ID.

Question 9

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

Accepted Answer

Reorder the security rules so the custom allow rule is above the deny rule.. Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.

Answer

Modify the custom App-ID signature to match more precisely.

Answer

Create an application override for the custom application.

Answer

Add a virtual wire interface to ensure traffic reaches the firewall.

Question 10

Arrange the steps to configure a new administrator account with role-based access.

Accepted Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Select the role. Step 4: Commit.. To configure a new administrator with role-based access on a Palo Alto firewall, you must first create the administrator account by navigating to Device > Administrators and clicking Add. Then enter the username and password. Next, assign a role (e.g., Superuser, Read‑Only, or a custom role) to define the access level. Finally, commit the changes to apply the configuration. This sequence ensures the account is fully defined before committing.

Answer

Step 1: Enter username and password. Step 2: Navigate to Device > Administrators and click Add. Step 3: Select the role. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Select the role. Step 3: Enter username and password. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Commit. Step 4: Select the role.

Question 11

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

Accepted Answer

The application override is not configured.. When a custom application is created with a signature, the firewall uses App-ID to identify the traffic based on the signature. However, if the traffic is still being misidentified as 'web-browsing', it means the firewall is matching the default HTTP/HTTPS application before the custom signature can be evaluated. An application override is required to explicitly tell the firewall to skip App-ID processing for that traffic and instead use the custom application 'my-app'. Without the override, the firewall's default App-ID logic continues to classify the traffic based on its standard signatures.

Answer

The custom application is not activated in the security policy rule.

Answer

The vulnerability protection profile is dropping the traffic.

Answer

The decryption policy is blocking the traffic.

Question 12

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct. This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile

Question 13

Refer to the exhibit. The firewall's disk usage is at 85% overall, and the /opt/panlogs partition is at 92%. The administrator wants to free up space without losing important log data. Which action should be taken first?

Accepted Answer

Configure log auto-deletion in the Log Settings to purge logs older than a specified period. Configuring log auto-deletion in the Log Settings allows the administrator to automatically purge older logs based on a specified retention period, freeing up disk space on the /opt/panlogs partition without manually deleting important log data. This is the safest and most controlled method, as it respects the firewall's log management policies and ensures compliance with data retention requirements.

Answer

Add an external storage device to the firewall

Answer

Delete configuration files from /opt/pancfg

Answer

Delete the /opt/panlogs directory and recreate it

Question 14

A company uses Panorama to manage multiple firewalls. An administrator pushes a template that includes a new Security Profiles group, but the firewalls do not receive the profile group. What is the most likely cause?

Accepted Answer

The firewalls are not assigned to the template that contains the profile group.. Panorama pushes templates to firewalls based on template assignment. If a firewall is not assigned to the template that contains the Security Profiles group, the firewall will never receive that configuration, regardless of the push operation. Template assignment is a prerequisite for any template-based configuration to be applied to a managed firewall.

Answer

The profile group references a profile that does not exist in the template.

Answer

The push was performed to device groups instead of templates.

Answer

The commit was not selected to include the new profiles.

Question 15

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. 'show running resource-monitor' displays real-time CPU and memory utilization per dataplane or control plane process, which directly helps identify resource exhaustion causing latency. This command provides granular per-process metrics, unlike the aggregated 'show system resources', making it essential for pinpointing bottlenecks in high-latency scenarios.

Answer

show session info

Answer

show log traffic

Question 16

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

Accepted Answer

Configure an application layer gateway (ALG) for FTP. FTP uses separate control and data channels, and the data channel port is dynamically negotiated via the PORT or PASV command. Without an application layer gateway (ALG) for FTP, the firewall cannot track these dynamic ports, so session synchronization would only replicate the control session, causing data sessions to drop after a failover. Enabling the FTP ALG ensures the firewall inspects FTP commands and creates the necessary pinholes for data sessions, which are then synchronized to the passive peer.

Answer

Use HA3 link for session synchronization

Answer

Enable asymmetric routing support

Answer

Enable UDP session synchronization

Question 17

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

Accepted Answer

Check the IPSec tunnel status and IKE/IPSEC SA rekey timers. The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Answer

Check the traffic logs for any denial events

Answer

Reboot the firewall to clear any stale sessions

Answer

Verify the routing table on both firewalls

Question 18

A multinational corporation uses Palo Alto Networks firewalls at its headquarters and five branch offices. SSL Forward Proxy decryption is enabled for all outbound HTTPS traffic. Recently, users in the finance department have reported that several banking and financial websites fail to load, displaying a certificate error in the browser. The errors occur only for these specific sites, while other HTTPS sites work fine. The firewall administrator has already added decryption exclusion rules for the affected domains, but the problem persists. The decryption policy is configured with a single rule that decrypts all ssl service traffic, and the exclusion rules are placed below this global decrypt rule. Which of the following is the best course of action to resolve the issue?

Accepted Answer

Reorder the decryption policy rules so that the exclusion rules are above the global decrypt rule. Palo Alto Networks decryption policy rules are evaluated in top-down order, and the first matching rule is applied. Since the exclusion rules are placed below the global decrypt rule that decrypts all SSL traffic, the global rule matches first and decrypts the traffic, causing certificate errors on sites that require specific handling. Reordering the exclusion rules above the global rule ensures they are evaluated first, allowing the affected domains to bypass decryption and load correctly.

Answer

Create a decryption profile that excludes the failing domains

Answer

Disable SSL decryption for all traffic

Answer

Replace the firewall's internal CA certificate with a publicly trusted certificate

Question 19

A security operations center (SOC) uses Panorama to monitor all firewalls. They notice that some log entries show a severity of 'critical' but the alerting system does not fire. The log forwarding profile on Panorama is configured to send syslog alerts for severity 'critical'. The syslog server receives other logs from Panorama but not these critical logs. The administrator checks the Panorama configuration and finds that the log forwarding profile is applied to the correct log types. What is the most likely issue?

Accepted Answer

The critical logs are generated on the firewall and not forwarded to Panorama.. The most likely issue is that the critical logs are generated on the firewall but not forwarded to Panorama. Panorama can only forward logs it has received from its managed firewalls; if the firewall’s log forwarding or logging settings (e.g., log severity threshold, log buffering, or connectivity to the Log Collector) prevent those critical logs from reaching Panorama, then Panorama’s syslog forwarding profile will never see them. The fact that other logs arrive at the syslog server indicates Panorama’s forwarding works, so the gap must be upstream at the firewall-to-Panorama log collection stage.

Answer

The log forwarding profile on Panorama is not applied to the managed firewalls.

Answer

The Panorama's log collector is not processing the logs correctly.

Answer

The syslog server is filtering out the critical logs based on the source IP.

Question 20

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

Accepted Answer

Create an application override rule to force the identification.. An application override rule forces App-ID to classify traffic based on the custom signature, bypassing the default identification that incorrectly flags the legacy application's custom encryption over TCP 443 as 'ssl'. Without the override, App-ID may still match the traffic to the built-in 'ssl' application due to port-based heuristics, even with a custom signature defined. The override ensures the custom application is applied to the session, overriding any conflicting App-ID results.

Answer

Create a security policy rule that explicitly allows the custom application.

Answer

Change the default port of the custom application from 443 to a different port.

Answer

Disable SSL decryption for that traffic.