PCNSE Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

Accepted Answer

Rule 1 allows all applications because it uses 'application any'.. Rule 1 uses 'application any', which matches all applications regardless of the specific App-ID. Since security policies are evaluated from top to bottom and the first matching rule is applied, any traffic that matches Rule 1's source, destination, and service will be allowed, including 'ssl' traffic. The explicit allow rules for 'ms-update' and 'facebook-base' are irrelevant because Rule 1 catches all traffic first.

Answer

App-ID is not enabled on the firewall.

Answer

Rule 4 is a deny rule but it is not effective because the traffic is allowed earlier.

Answer

The rule order is incorrect; rule 3 should be moved before rule 1.

Question 2

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

Accepted Answer

The firewall might be incorrectly identifying the application as web-browsing when it is something else. When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Answer

The traffic is being blocked because the 'From Zone' is trust

Answer

The session is being denied by a different rule

Answer

The session is not being logged correctly

Question 3

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 4

An administrator needs to allow FTP traffic from the internal network to an external server. The firewall is configured with a security policy that has the application 'ftp' and service 'service-http'. What is the most likely cause of the traffic being denied?

Accepted Answer

The service object in the rule is set to service-http, which does not match FTP traffic.. The correct answer is D because the security policy's service object is set to 'service-http' (TCP port 80), but FTP traffic uses TCP port 21 for control and TCP port 20 for data. In Palo Alto Networks firewalls, the service object defines the destination port for the traffic; if it does not match the actual port used by the application, the firewall will deny the session even if the application is correctly identified. The mismatch between the service and the application's expected port causes the traffic to be blocked.

Answer

The source address is wrong.

Answer

The application is incorrectly set to ftp.

Answer

The rule is not enabled.

Question 5

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

Accepted Answer

(addr.src eq user@domain.com) and (eventid eq auth-fail). Option C is correct because the filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.

Answer

(addr.src eq user@domain.com) or (eventid eq auth-fail)

Answer

(addr.src eq user@domain.com) and (severity ge medium)

Answer

(src eq user@domain.com) and (eventid eq auth)

Question 6

Refer to the exhibit. The firewall's disk usage is at 85% overall, and the /opt/panlogs partition is at 92%. The administrator wants to free up space without losing important log data. Which action should be taken first?

Accepted Answer

Configure log auto-deletion in the Log Settings to purge logs older than a specified period. Option A is correct because configuring log auto-deletion in the Log Settings allows the administrator to automatically purge older logs based on a specified retention period, freeing up disk space on the /opt/panlogs partition without manually deleting important log data. This is the safest and most controlled method, as it respects the firewall's log management policies and ensures compliance with data retention requirements.

Answer

Add an external storage device to the firewall

Answer

Delete configuration files from /opt/pancfg

Answer

Delete the /opt/panlogs directory and recreate it

Question 7

A user from subnet 10.0.1.0/24 accesses a website categorized as 'Finance'. Based on the exhibit, what will be the result?

Accepted Answer

The traffic will be decrypted by Rule 2.. Option B is correct because Rule 2 matches traffic from subnet 10.0.1.0/24 to the 'Finance' category and has an action of 'decrypt'. The exhibit shows Rule 2 with source 10.0.1.0/24, destination category 'Finance', and action 'decrypt'. Since the user's traffic matches all criteria in Rule 2, it will be decrypted. Rule 3 is not evaluated because Rule 2 matches first and has a higher priority (lower rule number).

Answer

The traffic will not be decrypted because Rule 3 matches.

Answer

The traffic will be blocked because no matching rule exists.

Answer

The traffic will be decrypted by Rule 1.

Question 8

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Accepted Answer

generate tech-support file. The 'generate tech-support file' command collects a comprehensive archive of system logs, configuration, resource utilization, and diagnostic data into a single file, which is the standard method for providing TAC with the necessary information to analyze performance issues. This command is specifically designed for troubleshooting and support scenarios, unlike other commands that only capture partial or real-time data.

Answer

debug system dump

Answer

show system resources

Answer

show log system

Question 9

An organization is experiencing intermittent connectivity issues with their GlobalProtect remote access VPN. Users report that they can connect but after a random period (20-40 minutes) the tunnel drops and reconnects. The firewall has sufficient licensing. Which setting should be reviewed first?

Accepted Answer

GlobalProtect gateway 'Idle Timeout' setting.. The 'Idle Timeout' setting on the GlobalProtect gateway controls how long an inactive session is allowed to remain connected. If this value is set too low (e.g., 20-30 minutes), the gateway will terminate the tunnel after that period of inactivity, causing the client to disconnect and immediately reconnect, which matches the described symptom of intermittent drops every 20-40 minutes. This is the most likely cause because the issue is periodic and consistent with a timeout-based disconnection, not a network change or authentication failure.

Answer

The 'Disconnect on Network Change' option on the client.

Answer

The authentication timeout on the firewall.

Answer

'Tunnel Rekey' interval in the IPSec configuration.

Question 10

An engineer is troubleshooting a security policy that is not matching traffic as expected. The traffic is from source IP 10.1.1.10 to destination 172.16.0.1 port 443. The policy has source zone 'Internal', destination zone 'DMZ', source address '10.1.1.0/24', destination address '172.16.0.0/24', application 'ssl'. The firewall shows the traffic hitting a different rule. What is the most likely cause?

Accepted Answer

The traffic is being matched by an earlier rule with broader criteria.. The most likely cause is that an earlier rule in the security policy rulebase matches the traffic before the intended rule. Palo Alto Networks firewalls evaluate security rules in sequential order from top to bottom, and the first rule that matches all criteria (source/destination zone, source/destination address, application, etc.) is applied. If a rule with broader criteria (e.g., any/any or a less specific application) appears earlier, it will match the traffic, preventing the intended rule from being hit.

Answer

The source zone is incorrectly assigned; traffic is coming from a different zone.

Answer

The destination address is not in the specified subnet due to NAT.

Answer

The application 'ssl' does not match because the traffic is actually using TLS 1.3.

Question 11

A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?

Accepted Answer

Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.. Increasing the keepalive interval (making it less frequent) and increasing the number of missed keepalives before declaring a failure allows the firewall to tolerate occasional packet loss, reducing false failovers. Option B would not address keepalive loss; C changes the HA mode but does not reduce sensitivity; D adds redundancy but does not reduce sensitivity; it might even add complexity.

Answer

Disable HA1 link monitoring and rely solely on path monitoring.

Answer

Change the HA mode to active/active to balance traffic and reduce load on the active unit.

Answer

Enable HA2 and configure it as a second heartbeat link for redundancy.

Question 12

A network engineer is configuring an active/passive HA pair of Palo Alto Networks firewalls. The engineer wants to ensure that a specific interface failure triggers a failover, but only if the interface loses connectivity to its directly connected next-hop router. Which two configuration settings must be enabled to achieve this behavior?

Accepted Answer

Enable link monitoring on the interface.. Path monitoring monitors connectivity to a specific IP (next-hop router) via the interface; link monitoring detects link state changes. Both are required to trigger failover on loss of connectivity to the next-hop router. Option A is for HA1 link, not interface; D is for heartbeat redundancy; E is for passive interface state.

Answer

Configure HA2 as a backup heartbeat link.

Answer

Set HA1 link monitoring to ping the peer firewall's management IP.

Answer

Set the passive link state to 'auto'.

Question 13

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

Accepted Answer

Link monitoring is enabled but not configured to monitor the specific interface that failed.. The exhibit shows link monitoring enabled but path monitoring disabled. Link monitoring only detects link state changes, but if the specific interface that lost link is not included in the link monitoring group, the failure is not considered. The passive did not take over because the interface that failed was not being monitored. Option A is wrong because HA1 is up, HA2 is optional; B is wrong because path monitoring is not related to link state; D is wrong because fail-holdup is 0, which would not delay.

Answer

HA2 heartbeat link is down, preventing the passive from detecting the active's failure.

Answer

The fail-holdup timer is set to 0, causing immediate failover but not triggered.

Answer

Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.

Question 14

Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy and SSL Inbound Inspection are the two primary decryption scenarios. SSH Proxy is not a decryption scenario; it is a separate proxy feature. Decryption Broker is not a Palo Alto feature. SSL Termination is not a standalone scenario; it is part of inbound inspection.

Answer

Decryption Broker

Answer

SSL Termination

Answer

SSH Proxy

Question 15

A network administrator observes that some SSL connections are failing to be decrypted. Based on the exhibit, what is the most likely reason for the majority of the failures?

Accepted Answer

No decryption policy rule matches the traffic. The highest count under Failed Handshakes is "Decryption policy not matched" with 20 failures, indicating that no decryption policy rule matches the traffic for those connections. The other causes have lower counts.

Answer

The firewall's certificate is not trusted by clients

Answer

The client and server negotiate an unsupported cipher

Answer

The decryption profile is misconfigured

PCNSE Practice Test 28 — 15 Questions

Exhibit

PCNSE Practice Test 28 — 15 Questions

Exhibit