PCNSE Practice Test 29 — 15 Questions

Question 1

A multinational corporation uses Palo Alto Networks firewalls at its headquarters and five branch offices. SSL Forward Proxy decryption is enabled for all outbound HTTPS traffic. Recently, users in the finance department have reported that several banking and financial websites fail to load, displaying a certificate error in the browser. The errors occur only for these specific sites, while other HTTPS sites work fine. The firewall administrator has already added decryption exclusion rules for the affected domains, but the problem persists. The decryption policy is configured with a single rule that decrypts all ssl service traffic, and the exclusion rules are placed below this global decrypt rule. Which of the following is the best course of action to resolve the issue?

Accepted Answer

Reorder the decryption policy rules so that the exclusion rules are above the global decrypt rule. The exclusion rules must be placed above the global decrypt rule because decryption policy rules are evaluated in order from top to bottom. If the global decrypt rule is above, it will match first and attempt decryption, causing certificate errors. Moving the exclusions above ensures they are evaluated before the decrypt rule.

Answer

Create a decryption profile that excludes the failing domains

Answer

Disable SSL decryption for all traffic

Answer

Replace the firewall's internal CA certificate with a publicly trusted certificate

Question 2

Refer to the exhibit. A user in the 10.0.0.0/8 network is unable to access a web server at 172.16.1.10 which is in the DMZ zone. The firewall's security policy is shown. What is the most likely reason for the failure?

Accepted Answer

The policy specifies the 'untrust' zone instead of the 'dmz' zone.. Option B is correct because the policy's destination zone is 'untrust', but the server is in the 'dmz' zone, so the traffic does not match this policy. Option A is incorrect because web-browsing is a valid application for HTTP traffic. Option C is incorrect because the source range is broad enough to include the user. Option D is incorrect because the action is 'allow'.

Answer

The source IP range 10.0.0.0/8 is misconfigured.

Answer

The policy is missing a 'permit' action.

Answer

The application 'web-browsing' is not the correct application for the traffic.

Question 3

A company has deployed a Palo Alto Networks firewall in an active/passive high-availability (HA) pair. The firewall uses BGP for dynamic routing with two upstream ISPs to provide load-balanced internet connectivity. After an HA failover event, the network team notices that outbound traffic from internal hosts is now using only one of the two ISPs, even though BGP sessions are established on both firewalls and the passive firewall has learned the same routes as the active one. The security policy permits all outbound traffic. No changes were made to the BGP configuration. Which of the following is the most likely cause of this behavior, and what is the appropriate solution?

Accepted Answer

The HA configuration has ECMP disabled; enable ECMP in the dataplane settings on the active firewall.. Option C is correct because ECMP (Equal Cost Multi-Path) routing must be enabled on the active firewall to use multiple BGP-learned default routes for load balancing. After failover, if ECMP is disabled, only one best path is installed, causing traffic to use a single ISP. Option A is incorrect because state synchronization deals with session state, not routing decisions. Option B is incorrect because the passive firewall's BGP configuration does not affect routing on the active firewall unless it becomes active. Option D is incorrect because asymmetric routing detection would affect return traffic, not the outbound path selection.

Answer

The firewall's asymmetric routing detection is dropping traffic; disable asymmetric routing enforcement.

Answer

The BGP configuration on the passive firewall is not identical to the active one; apply the same BGP configuration to both.

Answer

The passive firewall is not advertising routes to the ISPs because HA state synchronization is not enabled; enable state synchronization.

Question 4

Which TWO of the following are required to configure a Palo Alto Networks firewall for centralized management by Panorama?

Accepted Answer

Ensure the management interface IP is reachable from Panorama.. Option A is correct because the firewall's serial number must be added to Panorama for identification. Option B is correct because the management interface must be reachable from Panorama to establish communication. Option C is not required; XML API is not necessary for basic management. Option D is not required; a shared secret is not mandatory (certificate or pre-shared key can be used but not required). Option E is not required; a device group is used for grouping but not a prerequisite for management.

Answer

Configure a pre-shared key for authentication.

Answer

Enable the XML API on the firewall.

Answer

Define a device group in Panorama.

Question 5

A remote user reports they cannot connect to the corporate network via GlobalProtect. The GlobalProtect client shows 'Connection failed. Unable to establish a secure connection.' The portal and gateway are configured with certificate authentication. The administrator verifies that the portal/gateway certificates are valid and not expired, and the common name matches the portal's FQDN. The client's machine time is synchronized. Which configuration misconfiguration is most likely the cause?

Accepted Answer

The client's GlobalProtect app is an older version that does not support TLS 1.2.. Option D is correct because if the GlobalProtect client is an older version that does not support TLS 1.2, it will fail to establish the secure connection when the gateway requires TLS 1.2. Option A is incorrect because a HIP mismatch would typically cause a different error (e.g., 'Access denied' or 'Not compliant') after authentication, not a connection failure. Option B is incorrect because the administrator already confirmed the certificate CN matches the portal FQDN. Option C is incorrect because the gateway authentication profile is not used for the TLS handshake; it is used after the tunnel is established.

Answer

The gateway authentication profile is set to use RADIUS instead of certificate.

Answer

The portal is configured with an incorrect server certificate common name (CN) that does not match the portal's FQDN.

Answer

The GlobalProtect gateway is configured to require HIP match, but the user's endpoint does not meet the HIP profile.

Question 6

A site-to-site IPsec tunnel between two Palo Alto Networks firewalls is not passing traffic. The administrator runs the 'show vpn ipsec-sa' command and sees the output in the exhibit. The remote peer is configured to use IKEv2 only. Based on the configuration, what is the most likely cause of the tunnel being in 'init' state?

Accepted Answer

The IKE version is incompatible.. The 'init' state indicates that IKE Phase 1 has not completed successfully. Since the local firewall is configured for IKEv1 but the remote peer uses IKEv2 only, the IKE version mismatch prevents Phase 1 negotiation. Option A (pre-shared key incorrect) could also cause Phase 1 failure, but the exhibit does not indicate a key mismatch, and the problem statement emphasizes the peer's IKE version. Option B (proxy IDs mismatched) would cause Phase 2 failure, not Phase 1. Option D (lifetime too short) is unlikely to cause a permanent 'init' state; it affects re-keying.

Answer

The pre-shared key is incorrect.

Answer

The proxy IDs are mismatched with the peer.

Answer

The IPsec crypto profile lifetime is too short.

Question 7

A network engineer is configuring a new GlobalProtect gateway to provide remote access. Which TWO items are required for the gateway to function properly?

Accepted Answer

A certificate for the gateway. A certificate is required for the gateway to terminate TLS connections, and an IP pool is required to assign IP addresses to VPN clients. An authentication profile can be configured but is not strictly required if the portal handles authentication. Clientless VPN and split tunneling are optional features.

Answer

An authentication profile

Answer

A split tunneling configuration

Answer

A clientless VPN configuration

Question 8

A security administrator is configuring App-ID to identify custom applications over TCP port 8080. The traffic is HTTP-based but the firewall is classifying it as 'web-browsing'. Which two steps should the administrator take to ensure the traffic is correctly identified as the custom application? (Choose two.)

Accepted Answer

Create an application override for the custom application.. Option A (create an application override) forces the firewall to classify the traffic as the custom application regardless of detection. Option B (create a custom App-ID signature) allows the firewall to properly identify the application via pattern matching. Option C is about allowing, not identifying. Option D is irrelevant for HTTP traffic. Option E sets application to any, which prevents identification.

Answer

Enable SSL decryption on the traffic.

Answer

Set the application to 'any' in the security policy.

Answer

Configure a security policy rule to allow the application.

Question 9

Refer to the exhibit. A user at 10.1.1.100 reports that they cannot access a website at 10.2.2.200 over HTTPS. The firewall shows the session is allowed with application web-browsing, but the security policy rule "Allow-Web" has application set to ssl. What is the most likely cause?

Accepted Answer

The SSL decryption policy is not configured.. Option C is correct because without SSL decryption, the firewall cannot inspect the encrypted payload to identify the application as ssl; it classifies it as web-browsing based on port 443. Option A is wrong because application override would force a specific application, but the issue is that the session shows a different application, not that override is misconfigured. Option B is wrong because the session is allowed, indicating a rule is matched; rule order may not be the direct cause since the allowed traffic shows web-browsing. Option D is wrong because service application-default allows the default port, but the application still needs to be identified correctly.

Answer

The application override is configured incorrectly.

Answer

The security policy rule order is incorrect.

Answer

The service is set to application-default.

Question 10

A firewall administrator configured the security rule shown in the exhibit to enforce SAML authentication for web-browsing traffic from the trust zone to the untrust zone. However, users are not prompted to authenticate. What is the most likely cause?

Accepted Answer

The authentication profile 'saml-profile' is not associated with a valid SAML identity provider object.. The most likely cause is that the authentication profile 'saml-profile' does not have a valid SAML identity provider object configured. Without the IdP, the firewall cannot initiate or validate SAML authentication. Option A is correct. Option B is incorrect because source user 'any' works; authentication is triggered for unknown users. Option C is incorrect because SSL decryption is not required for SAML. Option D is incorrect because 'web-browsing' covers both HTTP and HTTPS, which includes SAML traffic. Option E is plausible but less likely given the exhibit; the immediate configuration issue is the profile.

Answer

SSL decryption must be enabled on the firewall for SAML to function.

Answer

The application must be changed from 'web-browsing' to 'ssl'.

Answer

A previous security rule allows web-browsing traffic without authentication enforcement.

Answer

The source user must be set to 'known-user' to trigger authentication.

Question 11

A company wants to enforce multi-factor authentication (MFA) for employees accessing a specific internal application through the firewall. Which two configurations are required on the Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Define an authentication profile that includes an MFA method. To enforce MFA, an authentication policy rule must be created to trigger authentication for the target application, and an authentication profile containing the MFA method must be defined and referenced. Option B triggers the authentication process, and option D defines the MFA method. Option A is not required if using a different MFA method. Option C is not required for MFA. Option E is not needed for browser-based MFA.

Answer

Configure a SAML identity provider

Answer

Install the GlobalProtect client on user endpoints

Answer

Enable SSL decryption on the firewall

Question 12

A security administrator reports that they can ping and access internal resources, but cannot access any external websites. The firewall is configured with a default route pointing to the internet router, and the NAT policy includes a source NAT rule for the internal subnet. Which step should the administrator take first to troubleshoot this issue?

Accepted Answer

Review the security policy to ensure traffic from the internal zone to the external zone is allowed.. Option C is correct because if internal access works but external website access fails, the most likely cause is a security policy blocking web traffic. The default route and NAT appear configured, so checking the security policy is the logical first step. Option A is wrong because DNS proxy would affect name resolution, but the issue could persist even with DNS if the web traffic is blocked by policy. Option B is wrong because internal access working indicates routing is likely correct. Option D is wrong because the NAT rule is already configured and internal access works, so NAT is likely functioning.

Answer

Check the NAT rule for correct interface assignment.

Answer

Check the DNS proxy configuration on the firewall.

Answer

Verify that the default route is active by checking the routing table.

Question 13

Based on the exhibit, which THREE conclusions can be drawn?

Accepted Answer

The session was matched by the security rule 'allow-ssl'.. Options A, C, and E are correct. The destination IP 203.0.113.50 is a public IP address (A). The session matched rule 'allow-ssl' (C). The session state is ACTIVE (E). Option B is incorrect because the NAT source IP differs from the original source IP (10.10.1.100 -> 192.0.2.100), indicating source NAT is applied. Option D is incorrect because the protocol is TCP, not UDP.

Answer

The source NAT is not translating the source IP.

Answer

The traffic is using UDP protocol.

Question 14

A large enterprise uses Panorama to manage 100+ firewalls. The security team wants to deploy a new security policy rule to block a specific application across all firewalls. The rule must be placed before the existing rules. The administrator creates the rule in the appropriate rulebase in the device group and pushes. However, the rule appears at the end of the rulebase on the managed firewalls. What is the most likely cause?

Accepted Answer

The rule ordering was not adjusted in the device group.. Option B is correct because when adding a rule via Panorama, the rule order must be explicitly set using drag-and-drop or ordering options. If the administrator did not adjust the order, the rule will be appended at the end. Option A is incorrect because pre-rules are placed before local rules, but ordering still applies. Option C is incorrect because Panorama rules take precedence over local rules unless local rules are configured to override. Option D is incorrect because the rule was created in the correct device group (as stated).

Answer

The firewall's local rulebase overrides the Panorama rule.

Answer

The rule was created in a pre-rulebase instead of post-rulebase.

Answer

The rule was added to a different device group.

Question 15

A company needs to deploy a firewall in transparent inline mode to filter traffic between two switches without requiring any IP address changes on existing devices. Which interface type should be configured?

Accepted Answer

Virtual Wire. Virtual Wire (VWire) is the correct interface type because it allows the firewall to operate in transparent inline mode without requiring any IP address changes on existing devices. In VWire mode, the firewall acts as a Layer 2 bump in the wire, forwarding traffic between two interfaces based on MAC addresses without participating in routing or requiring IP configuration on the firewall interfaces themselves.

Answer

Tap

Answer

Layer3

Answer

Layer2