PCNSE Practice Test 4 — 25 Questions

Question 1

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane

Question 2

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 3

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 4

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 5

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

Accepted Answer

Use App-ID's encrypted traffic detection capabilities. App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Answer

Deploy a network tap to capture traffic

Answer

Configure the firewall to trust all certificates

Answer

Implement SSL Forward Proxy decryption

Question 6

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

Accepted Answer

The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.. In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.

Answer

The firewall is using a forward trust certificate that is expired.

Answer

The decryption policy is not applied to the correct security rule.

Answer

The decryption policy is set to 'no-decrypt' for the traffic.

Question 7

Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?

Accepted Answer

Deny the traffic because rule 1 matches first.. The firewall processes security rules in top-down order. Rule 1 explicitly denies traffic from the internal zone to the destination zone 'untrust-L3' for destination IP 203.0.113.1, which matches the user's traffic. Since rule 1 is matched first, the firewall denies the traffic and does not evaluate subsequent rules.

Answer

Drop the traffic because no rule matches.

Answer

Allow the traffic because rule 2 matches.

Answer

Reset the traffic because of rule 1.

Question 8

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Accepted Answer

Both firewalls must be the same hardware model.. Palo Alto Networks high-availability (HA) active/passive pairs require both firewalls to be the same hardware model to ensure identical processing capabilities and interface configurations. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration synchronization and stateful failover compatibility; version mismatches can cause HA session sync failures or unexpected behavior.

Answer

Both firewalls must have identical licenses.

Answer

Both firewalls must be in the same data center.

Answer

The firewalls must be directly connected via a crossover cable for HA1.

Question 9

A company uses SSL Forward Proxy decryption for user traffic. Recently, some users cannot access a specific HTTPS website that uses a self-signed certificate. The firewall's decryption policy is set to 'decrypt' and the action is 'forward proxy'. The firewall does not have the self-signed CA certificate installed. What is the most likely cause of the issue?

Accepted Answer

The firewall cannot decrypt the session because it does not trust the self-signed certificate of the website.. In SSL Forward Proxy decryption, the firewall must generate a new server certificate on-the-fly to present to the client. To do this, it needs to trust the original server's certificate so it can validate the server's identity and then re-sign the session. Since the website uses a self-signed certificate and the firewall does not have that CA certificate installed, the firewall cannot validate the server's certificate, causing the decryption to fail and the session to be blocked.

Answer

The website is not included in the decryption policy's URL category.

Answer

The firewall's decryption certificate is not trusted by the client browsers.

Answer

The firewall's forward proxy decryption requires a server certificate that matches the original website.

Question 10

Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?

Accepted Answer

rule2. Rule2 is correct because it is the first rule in the security policy that matches the traffic from the trust zone (source zone trust) to the external server (destination zone untrust) for HTTPS (destination port 443). Palo Alto Networks firewalls evaluate rules in top-down order, and rule2 explicitly permits HTTPS traffic from trust to untrust, while rule1 only permits HTTP (port 80). Rule3 and rule4 do not match because they are either for different zones or deny the traffic.

Answer

rule4

Answer

rule3

Answer

rule1

Question 11

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 12

Which TWO of the following are minimum required configurations to enable User-ID on a Palo Alto Networks firewall? (Choose exactly two.)

Accepted Answer

Configure a server profile for LDAP or other authentication protocol.. A is correct because User-ID requires a server profile (e.g., LDAP, Kerberos, or a WMI-based agent) to query the directory service for user-to-IP mappings. Without this profile, the firewall cannot resolve usernames from authentication events or directory lookups, which is the foundational step for User-ID functionality.

Answer

Deploy a User-ID agent on every domain controller.

Answer

Install a captive portal to authenticate users.

Answer

Configure a security policy rule that uses a user group as a source.

Question 13

Refer to the exhibit. What does the uptime indicate?

Accepted Answer

The firewall has been restarted approximately 3 hours ago.. The uptime displayed in the exhibit shows the firewall has been running for approximately 3 hours. This directly indicates that the firewall was restarted or rebooted about 3 hours ago, making option D correct. Uptime is a measure of time since the last system boot, not related to licensing, HA mode, or memory usage.

Answer

The firewall license is about to expire.

Answer

The firewall is in active-passive HA mode.

Answer

The firewall has high memory usage.

Question 14

A network engineer needs to configure SNMP traps on a PA-5250 running PAN-OS 10.2 to alert when CPU usage exceeds 80% for more than 10 minutes. Which CLI command should be used to set this threshold?

Accepted Answer

set snmp-server trap cpu-threshold 80. The CLI command 'set snmp-server trap cpu-threshold 80' directly configures the CPU utilization threshold for SNMP trap generation on a Palo Alto Networks firewall running PAN-OS 10.2. When the CPU usage exceeds 80% for a sustained period (default 10 minutes), the firewall sends an SNMP trap to configured trap destinations. This command is specific to setting the threshold value, and the 10-minute duration is a fixed, non-configurable parameter in this PAN-OS version.

Answer

show snmp-server trap

Answer

set snmp-server trap source-interface ethernet1/1

Answer

set snmp-server trap destination host 192.168.1.100 community public

Question 15

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

Accepted Answer

Verify that the user group mapping is correct.. Even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Answer

Restart the User-ID agent service.

Answer

Check the firewall's management plane CPU usage.

Answer

Ensure the firewall has a license for User-ID.

Question 16

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 17

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Accepted Answer

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.. The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer

The service 'application-default' does not allow TCP port 443.

Answer

The packet is not logged properly.

Answer

The destination IP is not routable in the virtual router.

Question 18

A security administrator needs to block an application that uses multiple ports, including dynamic ports. Which of the following methods can be used to block this application using App-ID? (Choose two.)

Accepted Answer

Create a security rule with the application set to the malicious application and action Deny.. App-ID identifies applications regardless of port, so a security rule with the application set to the malicious application and action Deny will block that application even when it uses dynamic ports. This leverages App-ID's ability to classify traffic based on application signatures, not just port numbers.

Answer

Create an application override to force identification of the application on all ports.

Answer

Use decryption to inspect the application content.

Answer

Create a security rule with the destination port range that covers all possible ports.

Question 19

An administrator needs to configure a firewall to send email alerts when a specific security policy rule is triggered. Which two configuration elements are required? (Choose two.)

Accepted Answer

An 'Email Server' profile configured with SMTP server details.. To send email alerts when a specific security policy rule is triggered, you need an Email Server profile configured with SMTP server details (Option B) to define the mail server, and a Log Forwarding profile that includes email notification (Option C) to specify which log events trigger the email. The Log Forwarding profile is attached to the Security Policy rule, and when the rule matches traffic, the firewall sends the log data to the configured email server.

Answer

A 'Security Policy' rule with 'Log at Session End' enabled.

Answer

A 'Panorama' template to push the configuration.

Answer

A 'User-ID' agent to identify users.

Question 20

A global company uses a pair of PAN-220 firewalls in an active/passive HA configuration at its headquarters. The firewalls have multiple virtual routers and dozens of zones. Recently, a network upgrade changed the physical topology: a new switch was placed between the firewalls and the ISP routers. After the upgrade, the passive firewall continuously shows 'suspended' state. The HA control link (HA1) and data link (HA2) are on separate dedicated interfaces. The Active firewall logs show: 'HA monitor peer unreachable' every few seconds. The engineer has verified IP connectivity between the HA interfaces using ping from the active to the passive HA1 IP. What is the most likely cause of the HA state issue?

Accepted Answer

The new switch introduces latency or jitter that exceeds the HA keepalive timeout. The 'HA monitor peer unreachable' log combined with a 'suspended' passive firewall, despite confirmed IP connectivity on HA1, points to a failure in the HA keepalive mechanism. The new switch introduces latency or jitter that causes keepalive packets to arrive outside the default 2-second hello interval and 8-second dead-interval, triggering the active firewall to declare the peer unreachable. This is a classic issue when a switch is inserted into the HA path without adjusting the HA keepalive timers or ensuring the switch provides low-latency forwarding.

Answer

The HA2 link is misconfigured or unplugged

Answer

The session table on the active firewall is full, preventing HA keepalives

Answer

The HA1 encryption setting is mismatched between the two firewalls