PCNSE Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. An active/active HA pair shows the local firewall as active-secondary. The last failover reason is 'path-group-down'. What should the administrator investigate first?

Accepted Answer

Verify the link status of interface ethernet1/2 and its association with the path monitoring group.. The 'path-group-down' failover reason indicates that the firewall detected a failure in a monitored path group, which is associated with specific interfaces. Option B is correct because the administrator should first verify the link status of interface ethernet1/2 and its association with the path monitoring group, as this directly addresses the root cause of the failover trigger. Path monitoring is used to detect upstream connectivity loss and can cause a firewall to transition to active-secondary if the monitored path fails.

Answer

Inspect the session table for asymmetric routing between the firewalls.

Answer

Ensure the HA2 link is properly connected and firewalls can synchronize sessions.

Answer

Check the HA priority settings to ensure the local firewall should be active-secondary.

Question 2

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

Accepted Answer

Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.. Option A is correct because App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Answer

Enable unknown application identification in the security rule.

Answer

Use the default application override for port 4444 to allow traffic.

Answer

Change the security rule to use 'application-default' as the service to rely on port-based identification.

Question 3

An organization wants to enforce multi-factor authentication (MFA) for administrative access to the Palo Alto Networks firewall. Which TWO authentication methods are supported for local administrator accounts?

Accepted Answer

One-time password (OTP) via RADIUS. Option C is correct because Palo Alto Networks firewalls support one-time password (OTP) authentication for local administrator accounts via RADIUS, where the RADIUS server generates and validates the OTP. Option D is correct because time-based one-time password (TOTP) is natively supported for local administrator MFA, using RFC 6238 to generate time-synchronized codes that the firewall validates directly without an external server.

Answer

LDAP authentication

Answer

SAML IdP authentication

Answer

Client certificate authentication

Question 4

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The correct answer is D because the PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Question 5

A network engineer needs to troubleshoot why a specific user cannot access a web application through a Palo Alto Networks firewall. The engineer has verified that the user's traffic reaches the firewall and that no security policy explicitly blocks the traffic. Which CLI command should be used to check if the traffic is being matched by a hidden or implicit rule?

Accepted Answer

test security-policy-match source destination destination-port protocol . Option C, 'test security-policy-match', is the correct command because it simulates a packet against the firewall's security policy rulebase, including any hidden or implicit rules (such as the default intra-zone allow or inter-zone deny rules). This allows the engineer to see exactly which rule the traffic matches, even if no explicit policy is configured, which is essential for troubleshooting implicit rule behavior.

Answer

show session all

Answer

debug dataplane packet-diag

Answer

show running security-policy

Question 6

Match each security profile type to its purpose.

Question 7

Match each PAN-OS component to its description.

Question 8

Match each log type to its content.

Question 9

Match each CLI command to its function.

Question 10

Match each decryption type to its description.

Question 11

Match each security rule action to its effect.

Question 12

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Question 13

Arrange the steps to deploy a new Panorama template to a managed firewall.

Question 14

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Question 15

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

PCNSE Practice Test 26 — 15 Questions

Exhibit

PCNSE Practice Test 26 — 15 Questions

Exhibit