PCNSE Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall can buffer up to 1024 KB of packet data for App-ID analysis.. The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Answer

App-ID can only handle 1024 KB of packet data per session.

Answer

The firewall logs the first 1024 KB of every session for App-ID.

Answer

The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

Question 2

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Accepted Answer

The traffic matched a security rule that explicitly denies it. The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Answer

A threat prevention profile detected and blocked the session

Answer

The traffic was blocked because the application is not allowed

Answer

The destination URL is categorized as prohibited

Question 3

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 4

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 5

Which THREE are valid methods to collect logs from a firewall to Panorama? (Choose three.)

Accepted Answer

Configuring the firewall to send syslog to Panorama's log collector.. A firewall can be configured to send syslog data directly to Panorama's log collector, which is a standard method for centralized logging. This leverages the syslog protocol to forward logs, allowing Panorama to aggregate and analyze them without requiring additional infrastructure.

Answer

Using the REST API to pull logs from the firewall to Panorama.

Answer

Logging to a remote syslog server and importing CSV files to Panorama.

Question 6

Which of the following is NOT a valid method to identify users for User-ID on a Palo Alto Networks firewall?

Accepted Answer

XML API. The XML API is not a method for identifying users for User-ID; it is a management interface used to configure, monitor, and retrieve data from the firewall programmatically. User-ID relies on mechanisms that actively map IP addresses to usernames, such as LDAP sync, Terminal Services Agent, and Captive Portal, none of which involve the XML API.

Answer

LDAP sync

Answer

Terminal Services Agent (TS Agent)

Answer

Captive Portal

Question 7

A company wants to decrypt traffic to productivity and collaboration sites but avoid decrypting traffic to financial and healthcare sites due to compliance. How should the SSL decryption policy be configured?

Accepted Answer

Create a rule to decrypt based on URL categories except financial and healthcare.. Palo Alto Networks' SSL decryption policy can use URL categories to specify which traffic to decrypt. Creating a rule that decrypts traffic based on URL categories except for financial and healthcare ensures compliance by never decrypting those sensitive categories. Option A is wrong because maintaining a custom URL list is inefficient and prone to errors compared to using built-in categories. Option B is wrong because a decrypt-all rule with exceptions would initially decrypt all traffic, including financial and healthcare, before the exception is applied, which could violate compliance. Option D is wrong because decryption policy does not support time-based rules.

Answer

Add all financial and healthcare sites to a custom URL list and exclude them.

Answer

Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

Answer

Use time-based rules to apply decryption only during business hours.

Question 8

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Accepted Answer

The static route in VR1 does not point to an interface or next hop that is reachable via VR2.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Answer

The firewall does not support multiple virtual routers.

Answer

The virtual routers are not connected to each other.

Answer

NAT is not configured on VR2.

Question 9

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Accepted Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then wait for the alarm LED to turn off and back on, then release the button.. The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Answer

Press and hold the reset button using a paperclip, then locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then release the button.

Answer

Locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then press and hold it using a paperclip, then release the button.

Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then release the button, then wait for the alarm LED to turn off and back on.

Question 10

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Accepted Answer

SSL decryption is not enabled for the traffic.. App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Answer

The traffic is allowed by a security policy rule.

Answer

An application override policy is configured for the traffic.

Answer

The firewall is using port-based application identification.

Question 11

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Accepted Answer

Matching IKE version and encryption algorithms. IKE (Internet Key Exchange) is the protocol that establishes the security association (SA) for an IPsec VPN. Both firewalls must agree on the IKE version (v1 or v2) and the encryption algorithms (e.g., AES-256, 3DES) during Phase 1 negotiation; a mismatch will cause the tunnel to fail to establish.

Answer

Same firewall model

Answer

Same certificate authority

Question 12

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 13

A company has deployed SSL Inbound Inspection to inspect HTTPS traffic to their internal web server hosting a custom application that requires mutual TLS authentication. The firewall is configured with a decryption policy that includes the server's certificate and the action 'decrypt'. The web server is configured to request client certificates. After implementation, users report that the application fails to authenticate them. The firewall logs show that SSL handshake with the client completes successfully, but the server never receives the client certificate during the handshake. The administrator has verified that the decryption policy is active and the server certificate is correctly imported. What is the most likely cause of this issue?

Accepted Answer

The firewall is not configured to forward client certificates to the server.. In SSL Inbound Inspection, the firewall acts as a man-in-the-middle, terminating the client's SSL connection and then initiating a new SSL connection to the server. By default, the firewall does not forward the client certificate from the original client handshake to the server. To enable mutual TLS authentication, the administrator must explicitly configure the firewall to forward client certificates, typically via a Decryption Profile setting. Since the logs show a successful handshake with the client but the server never receives the client certificate, the missing forwarding configuration is the most likely cause.

Answer

The decryption policy is set to 'no-decrypt' for the application's traffic.

Answer

The client certificates are not trusted by the firewall.

Answer

The firewall's SSL Inbound Inspection profile is set to 'passive' mode.

Question 14

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

Accepted Answer

Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.. App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Answer

Create a security rule with destination port 80 and 443 and action set to 'allow'.

Answer

Create a security profile that blocks all applications not in the allow list.

Answer

Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.

Question 15

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Accepted Answer

Another rule earlier in the policy matches the traffic and allows it before reaching this rule.. In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.

Answer

The firewall is configured to not log interzone traffic.

Answer

The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

Answer

The logging profile is not applied to the rule.

Question 16

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 17

A network security engineer is troubleshooting an issue where certain VoIP traffic is being dropped by the firewall. The traffic logs show that the application is identified as 'voip' and the security rule allows 'voip'. However, the traffic is still being dropped. What should the engineer check next?

Accepted Answer

Check if a vulnerability protection profile is dropping the traffic based on a threat signature.. Even when App-ID correctly identifies the traffic as 'voip' and a security rule allows it, a vulnerability protection profile applied to the rule can still drop the traffic if it matches a threat signature. This is a common scenario where the firewall's threat prevention engine, not the security rule, is responsible for the drop. The engineer should inspect the threat logs for any matching signatures.

Answer

Confirm that the VoIP protocol is supported by App-ID.

Answer

Ensure that the security rule action is set to 'allow' and not 'deny'.

Answer

Verify that the application override is not set for this traffic.

Question 18

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 19

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

Accepted Answer

Add the URL to an allow list in the URL filtering profile. The traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Answer

Disable URL filtering on the existing security rule

Answer

Check the user-ID mapping to ensure the user is authenticated

Answer

Create a new security rule allowing the user's IP to any

Question 20

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT