PCNSE Practice Test 3 — 25 Questions

Question 1

A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)

Accepted Answer

Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.. Option B is correct because it uses the 'ssl' application to match HTTPS traffic, which is the proper application-based method for allowing outbound HTTPS. This rule specifies the source as 'internal-users' and destination as 'any', with the action 'allow', meeting requirement (1) without over-permitting. Option C is correct because it creates a rule from 'external' to 'internal', targeting the mail server IP with application 'smtp' and service 'application-default', which blocks all inbound traffic except SMTP to that specific server, satisfying requirement (2).

Answer

Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.

Answer

Rule: from internal to external, source any, destination any, application any, service any, action allow.

Answer

Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.

Question 2

A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?

Accepted Answer

Review the session log to see if the application changed during the session.. Option C is correct because App-ID can reclassify a session as more data becomes available. A session that starts as 'web-browsing' may later be identified as 'webmail-gmail' once the firewall sees application-specific traffic (e.g., SMTP, IMAP, or proprietary Gmail API calls). Reviewing the session log to see if the application changed during the session helps confirm whether the firewall eventually identified the correct application.

Answer

Disable unknown application identification to force stricter matching.

Answer

Create a custom App-ID for webmail-gmail with stricter signatures.

Answer

Increase the application identification timeout to allow more time for identification.

Question 3

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

Accepted Answer

Deny.. The standard action to block traffic in a security policy rule is 'deny'. 'Drop' also blocks but does not send a TCP reset, while 'deny' sends a reset. 'Allow' would permit the traffic, and 'reset-both' is a type of deny, but 'deny' is the typical best practice.

Answer

Drop.

Answer

Reset-both.

Answer

Allow with antivirus profile.

Question 4

During a security incident, an analyst notices that certain malware traffic is using port 443 but is being identified as 'ssl'. The malware uses a unique handshake that differs from standard SSL. Which two actions should the analyst take to correctly identify and block this malware? (Choose two.)

Accepted Answer

Create a custom application signature that matches the malware handshake.. Options C and E are correct. Creating a custom application signature (C) enables the firewall to identify the malware based on its unique handshake, bypassing the default SSL identification. Then, creating an application override rule (E) forces the firewall to treat the traffic as that custom application, allowing it to match a security rule with action Deny. Option A is incorrect because without identification, a security rule cannot block the traffic. Option B is incorrect as disabling decryption prevents visibility into encrypted payloads. Option D is incorrect because decryption is not required for identification via App-ID.

Answer

Add the custom application to a security rule with action Deny.

Answer

Disable SSL decryption on the firewall.

Answer

Create a decryption policy to forward proxy decrypt the traffic.

Question 5

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

Accepted Answer

The application override is not configured.. When a custom application is created with a signature, the firewall uses App-ID to identify the traffic based on the signature. However, if the traffic is still being misidentified as 'web-browsing', it means the firewall is matching the default HTTP/HTTPS application before the custom signature can be evaluated. An application override is required to explicitly tell the firewall to skip App-ID processing for that traffic and instead use the custom application 'my-app'. Without the override, the firewall's default App-ID logic continues to classify the traffic based on its standard signatures.

Answer

The custom application is not activated in the security policy rule.

Answer

The vulnerability protection profile is dropping the traffic.

Answer

The decryption policy is blocking the traffic.

Question 6

An engineer wants to block the use of file-sharing application BitTorrent, but allow file transfers over SFTP which also uses port 22. What is the most effective way to achieve this using App-ID?

Accepted Answer

Create a security rule that denies application 'bittorrent' and allows application 'sftp'.. D is correct because App-ID identifies applications by their unique signatures, not just ports. By creating a security rule that denies 'bittorrent' and allows 'sftp', the firewall can block BitTorrent traffic even if it uses non-standard ports, while permitting SFTP on port 22 based on its distinct application signature.

Answer

Create an application filter that matches sftp.

Answer

Use QoS to limit BitTorrent traffic.

Answer

Use an application override to classify all port 22 traffic as sftp.

Question 7

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

Accepted Answer

Create an application override rule to force the identification.. Option A is correct because an application override rule forces App-ID to classify traffic based on the custom signature, bypassing the default identification that incorrectly flags the legacy application's custom encryption over TCP 443 as 'ssl'. Without the override, App-ID may still match the traffic to the built-in 'ssl' application due to port-based heuristics, even with a custom signature defined. The override ensures the custom application is applied to the session, overriding any conflicting App-ID results.

Answer

Create a security policy rule that explicitly allows the custom application.

Answer

Change the default port of the custom application from 443 to a different port.

Answer

Disable SSL decryption for that traffic.

Question 8

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

Accepted Answer

The URL category for banking is not correctly identified.. The decryption policy rules are evaluated top-down. The administrator placed the 'No Decrypt' rule first for banking URLs, which is the correct order. However, if the banking URLs do not match the URL category defined in the rule (e.g., the category is not correctly identified or updated), the 'No Decrypt' rule will not apply. Traffic then falls through to the second 'Decrypt' rule, which decrypts all remaining traffic, including banking. Therefore, the most likely issue is that the URL category for banking is not correctly identified (Option D).

Answer

The SSL Forward Proxy profile is set to ignore the decryption policy.

Answer

The firewall is using a different decryption port than 443.

Answer

The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.

Question 9

An organization has two different applications (AppA and AppB) that both use TCP port 8080. The firewall must apply different security policies to each application. What is the recommended approach?

Accepted Answer

Create an application override policy to identify each application by IP address.. Option D is correct because when two applications share the same TCP port (8080), App-ID cannot differentiate them based on port alone. An application override policy allows you to explicitly identify each application by its source/destination IP address, overriding the default App-ID classification and enabling separate security policies for AppA and AppB.

Answer

Use source/destination IP addresses in security policies instead of App-ID.

Answer

Add the applications on separate virtual wire interfaces.

Answer

Change the port of one application to a different value.

Question 10

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

Accepted Answer

SAML identity provider profile. The exhibit shows a SAML-based authentication flow where the firewall redirects the user to an external identity provider (IdP) for authentication. The authentication profile 'SAML-Auth' must reference a SAML identity provider profile to define the IdP metadata, entity ID, SSO URL, and certificate binding. Without this profile, the firewall cannot initiate or validate SAML assertions, making option A the only correct choice.

Answer

LDAP server profile

Answer

RADIUS server

Answer

Kerberos realm

Question 11

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

Accepted Answer

Enable SSL decryption for the traffic.. The 'incomplete' application label indicates that the firewall could not fully identify the application because the traffic was encrypted. Enabling SSL decryption allows the firewall to inspect the decrypted payload, which is necessary for App-ID to accurately classify the application. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is often insufficient for SSL connections.

Answer

Disable application identification for SSL traffic.

Answer

Enable HTTP/2 protocol decoding.

Answer

Allow sessions with application 'incomplete' in policy.

Question 12

During a security audit, it is discovered that a custom application signature matches too broadly, causing benign traffic to be classified as the custom app. What change should be made to narrow the signature?

Accepted Answer

Add a data pattern filter to match a specific payload signature.. Option C is correct because adding a data pattern filter allows the custom App-ID signature to match on a specific payload string or byte sequence, which narrows the scope of traffic classified as that application. Without a data pattern, the signature may rely solely on IP protocol, port, or other broad criteria, causing false positives. By requiring a unique payload signature, only traffic containing that exact data pattern is identified as the custom application.

Answer

Remove the protocol field from the signature.

Answer

Use a wider port range and remove data patterns.

Answer

Expand the port range to include more traffic.

Question 13

A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?

Accepted Answer

The threat was detected in decrypted traffic because the source was external.. The threat was detected because the decryption policy rule 'No-Decrypt-Internal' only applies to traffic where both the source and destination are internal (10.0.0.0/8). If the source is external, the traffic is decrypted by a higher-priority rule (e.g., 'Decrypt-All'), allowing the threat to be inspected and logged. The log entry shows the threat in SSL traffic to 10.0.0.5, but the source being external means the no-decrypt rule does not match, so decryption occurs.

Answer

The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.

Answer

The threat log is misconfigured.

Answer

The security policy is blocking the traffic before decryption.

Question 14

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Accepted Answer

SSL decryption is not enabled for the traffic.. When SSL decryption is not enabled, the firewall cannot inspect encrypted HTTPS traffic payloads. As a result, App-ID may classify the traffic as 'incomplete' because it cannot match the encrypted payload to the web-browsing application signature. Enabling SSL decryption allows the firewall to decrypt the traffic, inspect the payload, and correctly identify the application.

Answer

The App-ID signature database is outdated.

Answer

The security policy does not have an allow rule for web-browsing.

Answer

The firewall is experiencing asymmetric routing.

Question 15

A company uses a custom application for internal VoIP traffic. The custom App-ID signature is configured with the correct protocol and port, but traffic is still not matching. The firewall shows the application as 'unknown-tcp'. What should the administrator check next?

Accepted Answer

Ensure a protocol decoder (e.g., SIP) is enabled for the application.. Custom App-ID signatures require a protocol decoder to inspect application-layer payloads. Even if the port and protocol are correctly defined, without an enabled decoder (e.g., SIP for VoIP), the firewall cannot identify the application and falls back to 'unknown-tcp'. Enabling the appropriate decoder allows the firewall to parse the traffic and match the custom signature.

Answer

Verify that the port range in the custom application is correct.

Answer

Update the App-ID signature database.

Answer

Check for asymmetric routing on the firewall.

Question 16

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Accepted Answer

Use applications instead of ports in security policies.. Option C is correct because App-ID is designed to identify traffic based on application signatures, not ports, enabling more granular and accurate security policy enforcement. Using applications instead of ports allows the firewall to control modern applications that may use non-standard ports or hop between ports, which is a core best practice for Palo Alto Networks firewalls.

Answer

Disable App-ID for traffic that does not match any known application to improve performance.

Answer

Configure all security policies based on port only for consistency.

Answer

Limit application usage to only well-known applications to reduce attack surface.

Question 17

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. Option C is correct because using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature. Option D is wrong because removing applications reduces visibility.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 18

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. Option B is correct because the firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 19

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. Option B is correct because if the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 20

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Accepted Answer

The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.. The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.

Answer

The destination network 10.3.3.0/24 is not in the routing table.

Answer

The source network 10.2.2.0/24 is not in the routing table.

Answer

The default route 0.0.0.0/0 is missing.