PCNSE Practice Test 26 — 15 Questions

Question 1

Which THREE components are required to deploy the Palo Alto Networks User-ID agent in a typical Windows environment to map users to IP addresses?

Accepted Answer

Active Directory domain to query user information. In a typical Windows environment, the User-ID agent requires Active Directory (AD) to query user logon events and group memberships. The agent uses the AD domain to correlate user SIDs with IP addresses via NetAPI or WMI, enabling accurate IP-to-user mapping without requiring a separate LDAP server for authentication.

Answer

Firewall management server (Panorama)

Answer

LDAP server (non-AD) for authentication

Question 2

A network administrator is troubleshooting decryption failures for HTTPS traffic to a financial website. The firewall is configured with SSL Forward Proxy decryption policy that applies to the 'financial-services' URL category. The firewall uses an internal CA certificate to sign generated certificates. Users report a certificate error in their browsers when accessing 'https://www.bankofalice.com'. The error says the certificate is not trusted, even though the internal CA certificate is installed on all client devices. The administrator checks the firewall logs and sees no decryption errors; the session is being decrypted successfully. The administrator also confirms that the decryption policy is active and the firewall is not bypassing decryption. What is the most likely cause of the certificate error?

Accepted Answer

The website uses Certificate Pinning which causes the browser to reject the firewall's certificate.. Certificate pinning (HTTP Public Key Pinning or HPKP) causes the browser to reject any certificate that does not match the pinned public key, even if the firewall's certificate is signed by a trusted internal CA. Since the firewall generates a new certificate on-the-fly with its own key pair, the browser detects the mismatch and displays a certificate error, despite successful decryption at the firewall.

Answer

The firewall's decryption certificate does not have the correct subject name for the website.

Answer

The firewall's decryption certificate is expired.

Answer

The decryption policy is configured to 'no-decrypt' for that traffic.

Question 3

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

Accepted Answer

Asymmetric routing. Asymmetric routing causes the firewall to see only one direction of a TCP session, leading to session timeouts despite active session entries. When traffic from the client to the database server traverses one firewall and return traffic takes a different path, the firewall cannot properly track the TCP state, resulting in dropped packets and intermittent connectivity.

Answer

DNS resolution failure

Answer

Security policy configured with service 'any'

Answer

Incomplete TCP three-way handshake

Question 4

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 5

A company has two Palo Alto Networks firewalls in an active/passive high availability pair. The firewalls are configured with a virtual IP (VIP) for the internal network. Recently, the passive firewall was upgraded to a new PAN-OS version. After the upgrade, the active firewall is still running the old version. The administrator wants to perform a failover to make the upgraded firewall active. However, when the administrator attempts to manually failover, the new passive firewall does not become active. The HA synchronization status shows 'synchronized' but the preemption is disabled. The administrator checks the HA configuration and finds that the peer's version is not compatible. What should the administrator do to successfully failover to the upgraded firewall?

Accepted Answer

Upgrade the active firewall to the same PAN-OS version as the passive firewall. PAN-OS requires both firewalls in an active/passive HA pair to run the same major version to form a compatible HA connection. Even if synchronization status shows 'synchronized', the version mismatch prevents failover from succeeding. Upgrading the active firewall to match the passive firewall's version restores version compatibility and allows the failover to proceed.

Answer

Disable HA, then reconfigure HA on both firewalls

Answer

Force the failover via the CLI using 'request high-availability state suspend' on the active firewall

Answer

Downgrade the passive firewall back to the old version

Question 6

An administrator notices that traffic from zone A to zone B is being dropped silently. Security rules are in place. Troubleshooting shows that the session does not appear in the session table. What is the most likely cause?

Accepted Answer

The traffic is taking an asymmetric path and the firewall sees only one direction.. When traffic is silently dropped and the session does not appear in the session table, it indicates that the firewall never saw the complete three-way TCP handshake or the first packet of the flow. Asymmetric routing causes the firewall to see only one direction of traffic (e.g., only the SYN from zone A to zone B but not the SYN-ACK return), so the firewall cannot create a session entry because it requires both directions to validate the state. This results in a silent drop without any session table entry or log entry.

Answer

The traffic is being decrypted by an SSL Forward Proxy rule.

Answer

The traffic is matched by a rule with action 'deny' and logging is disabled.

Answer

The interzone default rule is set to deny.

Question 7

A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?

Accepted Answer

Update the custom application definition to include SSL decryption and a hostname match.. Since the application changed from HTTP to HTTPS on the same port, App-ID now identifies it as 'ssl' instead of 'custom-app' because the traffic is encrypted. To have App-ID recognize the encrypted traffic as the custom application, the administrator must update the custom application definition to include SSL decryption (so the firewall can inspect the encrypted payload) and a hostname match (to distinguish this specific application from other SSL traffic). This allows the existing security policy rule that allows 'custom-app' to match the traffic. Option A is incorrect because an application override would bypass App-ID entirely, reducing visibility and security. Option B is incorrect because disabling App-ID and using port-based policy loses application awareness and security. Option C is incorrect because changing the rule to allow 'ssl' would permit all SSL traffic on port 8080, which is overly permissive and a security risk.

Answer

Create an application override for the traffic on port 8080.

Answer

Disable App-ID for that traffic and use a port-based policy.

Answer

Change the security policy rule to allow application 'ssl' instead.

Question 8

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

Accepted Answer

Syslog over TCP with buffering enabled in the log forwarding profile.. Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Answer

Email (SMTP) for each log.

Answer

Syslog over UDP with a log forwarding profile.

Answer

Syslog over SSL without optional buffering.

Question 9

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

Accepted Answer

Traffic Report. The Traffic Report is the correct choice because it provides detailed logs of all traffic passing through the firewall, including both allowed and denied sessions. By filtering the report to show only denied traffic over the past week, the administrator can generate the exact report needed. Other report types focus on specific categories like applications, threats, or URLs, not general traffic denials.

Answer

Application Report

Answer

Threat Report

Answer

URL Filtering Report

Question 10

After a PAN-OS upgrade from 9.1 to 10.2, users report that captive portal authentication fails consistently. The authentication profile uses LDAP and the LDAP server is reachable from the firewall. The captive portal page loads, but after entering credentials, users are redirected back to the login page. What is the most likely cause?

Accepted Answer

The captive portal authentication profile is not applied to the ingress interface after the upgrade.. After a PAN-OS upgrade, the captive portal authentication profile must be explicitly applied to the ingress interface. If it is not, the firewall will not enforce captive portal authentication on traffic entering that interface, causing the login page to load but credentials to be rejected and the user redirected back to the login page. This is a common post-upgrade configuration requirement in PAN-OS 10.2.

Answer

The authentication sequence order in the profile is incorrect.

Answer

The captive portal certificate is mismatched with the LDAP server certificate.

Answer

The LDAP server schema has changed after the upgrade.

Question 11

Arrange the steps to deploy a new Panorama template to a managed firewall.

Accepted Answer

Create template, then add configuration objects, then assign template to device group, then commit template. The correct sequence for deploying a new Panorama template to a managed firewall is: first, create the template; second, add configuration objects such as interfaces and zones; third, assign the template to the relevant device group; and finally, commit the template to push the configuration to the managed firewalls. This order ensures that the template exists, contains the desired settings, is linked to the correct devices, and is then applied.

Answer

Add configuration objects, then create template, then assign template to device group, then commit template

Answer

Create template, then assign template to device group, then add configuration objects, then commit template

Answer

Create template, then add configuration objects, then commit template, then assign template to device group

Question 12

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

Accepted Answer

Create an application override rule to force the identification.. An application override rule forces App-ID to classify traffic based on the custom signature, bypassing the default identification that incorrectly flags the legacy application's custom encryption over TCP 443 as 'ssl'. Without the override, App-ID may still match the traffic to the built-in 'ssl' application due to port-based heuristics, even with a custom signature defined. The override ensures the custom application is applied to the session, overriding any conflicting App-ID results.

Answer

Create a security policy rule that explicitly allows the custom application.

Answer

Change the default port of the custom application from 443 to a different port.

Answer

Disable SSL decryption for that traffic.

Question 13

A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?

Accepted Answer

Create an authentication profile using RADIUS with MFA enabled and assign it to the admin accounts.. To enforce MFA for administrative access using a RADIUS server with MFA capability, you must create an authentication profile that specifies RADIUS as the authentication method with MFA enabled. This authentication profile is then assigned to each admin account or to the admin role. Option A is incorrect because a security policy is not required for the firewall to communicate with the RADIUS server; the firewall's management interface initiates outbound RADIUS traffic, which is typically allowed by default. Option B is incorrect because User-ID agent configuration is for user mapping, not admin authentication. Option D is incorrect because authentication enforcement rules are for end-user traffic, not administrative access.

Answer

Create a security policy to allow RADIUS traffic from the firewall to the RADIUS server.

Answer

Enable MFA in the User-ID agent configuration.

Answer

Configure an authentication enforcement rule in the authentication policy.

Question 14

An engineer notices a decrease in network performance and wants to verify if a specific security policy is being triggered frequently. Which CLI command will show the hit count for a specific policy?

Accepted Answer

show running security-policy hit-count. The 'show running security-policy hit-count' command displays the hit count for each security policy rule, allowing the engineer to identify which specific policy is being triggered frequently. This command directly shows the number of times a rule has matched traffic, which is essential for diagnosing performance issues related to policy usage.

Answer

show security-rulebase

Answer

show rule-usage

Answer

show running security-policy

Question 15

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2