PCNSE Practice Test 4 — 25 Questions

Question 1

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Two physical or subinterfaces assigned to the vwire.. A virtual wire (vwire) requires exactly two interfaces to function as a transparent bridge between two network segments. These interfaces can be physical or subinterfaces, and they must be assigned to the vwire to pass traffic without Layer 3 processing. Without two interfaces, the vwire cannot forward frames between the connected devices.

Answer

A management profile must be applied to the vwire.

Answer

A zone must be assigned to the vwire.

Answer

The interfaces must be of type 'aggregate'.

Question 2

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

Accepted Answer

The HA2 link is down.. In an active/passive HA configuration on PAN-OS, session synchronization occurs over the HA2 link (control link). If the HA2 link is down, session synchronization will not work even though the HA state shows 'active' and 'passive' correctly. The HA3 link is used for packet forwarding in active/active mode, not for session sync in active/passive mode.

Answer

The HA3 link is not configured or is misconfigured.

Answer

The passive firewall does not have management API access.

Answer

The logging settings on both firewalls are different.

Question 3

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

Accepted Answer

SAML identity provider profile. The exhibit shows a SAML-based authentication flow where the firewall redirects the user to an external identity provider (IdP) for authentication. The authentication profile 'SAML-Auth' must reference a SAML identity provider profile to define the IdP metadata, entity ID, SSO URL, and certificate binding. Without this profile, the firewall cannot initiate or validate SAML assertions, making option A the only correct choice.

Answer

LDAP server profile

Answer

RADIUS server

Answer

Kerberos realm

Question 4

A network engineer notices that traffic from a specific subnet is being dropped by the firewall. The traffic log shows 'drop' with reason 'policy deny'. The engineer checks the security policy and confirms there is an allow rule for that subnet. What should be checked next?

Accepted Answer

Check the rule order and ensure the allow rule is above any deny rules.. When a traffic log shows 'policy deny' despite an existing allow rule, the most common cause is rule order: Palo Alto firewalls evaluate security rules from top to bottom, and the first matching rule is applied. If a deny rule appears above the allow rule for the same subnet, the deny rule will match first and drop the traffic, making it essential to verify the rule sequence.

Answer

Check the application override.

Answer

Check the QoS policy.

Answer

Check the NAT policy for the traffic.

Question 5

A GlobalProtect gateway is configured as shown. Remote users report that they can connect to the gateway but cannot authenticate. The users are using the GlobalProtect client with certificate authentication. What is the most likely cause?

Accepted Answer

The gateway does not have a root CA certificate imported for validating client certificates.. For certificate-based authentication, the GlobalProtect gateway must trust the certificate presented by the client. This requires the gateway to have the root CA certificate that issued the client certificate imported into its trusted CA list. Without this root CA, the gateway cannot validate the client's certificate chain, causing authentication to fail even though the initial connection (e.g., IPSec tunnel establishment) succeeds.

Answer

The IPSec crypto profile is too strong for the clients.

Answer

The IP pool is exhausted.

Answer

The DNS server is misconfigured, causing authentication failure.

Question 6

An administrator wants to view real-time CPU and memory usage on the firewall. Which CLI command should be used?

Accepted Answer

show system resources. The 'show system resources' command displays real-time CPU and memory utilization on a Palo Alto Networks firewall, including load averages, memory usage, and process-level details. This is the correct command for monitoring live resource consumption, as opposed to static system information or logs.

Answer

show system info

Answer

show routing route

Answer

show log system

Question 7

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 8

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

Accepted Answer

The security rule 'Allow-SSL' has 'service' set to 'application-default' but the website uses port 8443.. The security rule 'Allow-SSL' is configured with 'service' set to 'application-default', which means it only permits traffic on the default port for SSL (TCP 443). Since the website uses port 8443, the traffic is denied because the rule does not match the non-standard port. The firewall's application identification still correctly identifies the traffic as 'ssl', but the service constraint prevents the rule from applying, resulting in a deny action.

Answer

The destination IP is in a blacklist.

Answer

The security rule is placed too low in the rulebase.

Answer

The SSL certificate is expired.

Question 9

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 10

Refer to the exhibit. An administrator notices that HTTPS traffic to a specific website is being denied. What is the most likely cause?

Accepted Answer

The HTTPS traffic is being identified as web-browsing instead of ssl, so it does not match rule 2 and is denied by rule 3.. When App-ID identifies HTTPS traffic as web-browsing (HTTP over port 443) instead of ssl, the traffic does not match rule 2 (which requires the 'ssl' application). Consequently, it falls through to rule 3, which denies the traffic. This misidentification often occurs when the SSL handshake is incomplete or when decryption is not configured, causing the firewall to classify the traffic based on the port rather than the application signature.

Answer

Rule 2 does not have a service set to application-default, so it cannot match the traffic.

Answer

The traffic is from trust to trust, matching rule 4, but still denied.

Answer

The traffic requires a specific service other than application-default.

Question 11

A small business uses a single PA-220 firewall with PAN-OS 10.2. The administrator notices that the firewall is no longer receiving automatic threat updates. The License page shows the Threat Prevention license is active with 200 days remaining. The administrator can manually download updates from the Palo Alto Networks update server. What is the most likely cause?

Accepted Answer

The update schedule is disabled.. The most likely cause is that the update schedule is disabled. Even though the Threat Prevention license is active and manual downloads work, the firewall will not automatically check for or download updates if the scheduled update feature is turned off. In PAN-OS 10.2, the administrator must configure a recurring schedule under Device > Dynamic Updates for automatic updates to occur; otherwise, only manual downloads are possible.

Answer

The firewall is behind a proxy that blocks the update service.

Answer

The firewall's system clock is incorrect.

Answer

The DNS settings are misconfigured.

Question 12

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

Accepted Answer

Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.. App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Answer

Create a security rule with destination port 80 and 443 and action set to 'allow'.

Answer

Create a security profile that blocks all applications not in the allow list.

Answer

Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.

Question 13

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Accepted Answer

Configure filter, Start capture, Generate traffic, Stop capture, Download. The correct sequence for packet capture on a Palo Alto Networks firewall is: first configure the capture filter to define which traffic to capture, then start the capture, generate the traffic, stop the capture to finalize the data, and finally download the capture file. This order ensures that the desired traffic is captured cleanly and the file is ready for analysis.

Answer

Start capture, Configure filter, Generate traffic, Stop capture, Download

Answer

Configure filter, Generate traffic, Start capture, Stop capture, Download

Answer

Configure filter, Start capture, Generate traffic, Download, Stop capture

Question 14

Refer to the exhibit. An engineer configures HA with link monitoring and path monitoring. However, failover does not occur when ethernet1/2 goes down. What is the likely reason?

Accepted Answer

'link-monitoring' is configured under the high-availability hierarchy but not explicitly enabled. In Palo Alto Networks HA configuration, link monitoring is not enabled by default even when the 'link-monitoring' block is present under the 'high-availability' hierarchy. The engineer must explicitly set 'enabled yes' within the 'link-monitoring' configuration to activate it. Without this explicit enable, the firewall will not monitor the specified interfaces for link state changes, so a failure on ethernet1/2 will not trigger a failover.

Answer

The HA group-id is not unique in the network

Answer

HA2 link is down preventing failover

Answer

Path monitoring interval is set too high, causing delayed failover

Question 15

An engineer is troubleshooting a security policy that is not matching traffic as expected. The traffic is from source IP 10.1.1.10 to destination 172.16.0.1 port 443. The policy has source zone 'Internal', destination zone 'DMZ', source address '10.1.1.0/24', destination address '172.16.0.0/24', application 'ssl'. The firewall shows the traffic hitting a different rule. What is the most likely cause?

Accepted Answer

The traffic is being matched by an earlier rule with broader criteria.. The most likely cause is that an earlier rule in the security policy rulebase matches the traffic before the intended rule. Palo Alto Networks firewalls evaluate security rules in sequential order from top to bottom, and the first rule that matches all criteria (source/destination zone, source/destination address, application, etc.) is applied. If a rule with broader criteria (e.g., any/any or a less specific application) appears earlier, it will match the traffic, preventing the intended rule from being hit.

Answer

The source zone is incorrectly assigned; traffic is coming from a different zone.

Answer

The destination address is not in the specified subnet due to NAT.

Answer

The application 'ssl' does not match because the traffic is actually using TLS 1.3.

Question 16

Refer to the exhibit. A user at 10.1.1.10 is trying to connect to a web server at 203.0.113.5 on port 443. The session shows 'State: DROP' with reason 'policy-deny'. However, the administrator has a security policy rule that allows SSL traffic from the source zone to the destination zone. What is the most likely cause of the drop?

Accepted Answer

The security policy rule that allows SSL is in a different rulebase or zone than the traffic.. The session shows 'policy-deny' with a DROP state, which indicates that the traffic matched a deny rule or did not match any allow rule in the security policy. Even though the administrator believes an SSL allow rule exists, the most common cause is that the rule is in a different rulebase (e.g., pre-rulebase or post-rulebase) or the traffic is traversing a different zone pair than the one the rule applies to. The firewall evaluates rules in a specific order (pre-rulebase, then rulebase, then post-rulebase), and if the rule is not in the correct location for the traffic's ingress and egress zones, it will not be matched, resulting in a policy-deny drop.

Answer

The source NAT rule is missing, so the private IP cannot reach the internet.

Answer

The SSL application is not correctly identified because the traffic is encrypted.

Answer

The firewall is configured to block SSL sessions that use weak ciphers.

Question 17

A company has a firewall with multiple virtual systems (vsys). The administrator wants to delegate management of one vsys to a junior administrator, allowing them to configure security policies but not access system settings or other vsys. Which administrative role should be assigned?

Accepted Answer

Virtual System Admin. A Virtual System Admin role is specifically designed to delegate administrative access to a single virtual system (vsys) within a Palo Alto Networks firewall. This role allows the junior administrator to configure security policies and objects within their assigned vsys, while explicitly preventing access to system settings, device-level configurations, or other virtual systems. This matches the requirement exactly.

Answer

Superuser

Answer

Device Admin

Answer

Role-Based Admin

Question 18

Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?

Accepted Answer

rule2. Rule2 is correct because it is the first rule in the security policy that matches the traffic from the trust zone (source zone trust) to the external server (destination zone untrust) for HTTPS (destination port 443). Palo Alto Networks firewalls evaluate rules in top-down order, and rule2 explicitly permits HTTPS traffic from trust to untrust, while rule1 only permits HTTP (port 80). Rule3 and rule4 do not match because they are either for different zones or deny the traffic.

Answer

rule4

Answer

rule3

Answer

rule1

Question 19

Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?

Accepted Answer

SSL Forward Proxy. B is correct because SSL Forward Proxy allows the firewall to decrypt outbound traffic from internal clients to external servers by acting as an intermediary, generating a new certificate on the fly to inspect the session. E is correct because SSL Inbound Inspection enables the firewall to decrypt inbound traffic destined for protected servers, typically by importing the server's private key, allowing inspection of encrypted payloads.

Answer

Decryption Broker

Answer

SSL Termination

Answer

SSH Proxy

Question 20

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Accepted Answer

Verify that the HA2 link is operational and has sufficient bandwidth.. Session synchronization in an active/passive HA pair uses the HA2 link (or HA2 backup) to replicate session tables between firewalls. If the HA2 link is down, has insufficient bandwidth, or is misconfigured, session synchronization will fail, causing the newly active firewall to have an incomplete session table after a failover. Verifying that the HA2 link is operational and has sufficient bandwidth is therefore a critical first step in troubleshooting this issue.

Answer

Check that the session synchronization encryption is disabled to reduce latency.

Answer

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Answer

Confirm that the HA1 link is using the correct IP address and is in the same subnet.