PCNSE Practice Test 3 — 10 Questions

Question 1

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 2

A network security engineer is troubleshooting an application that is inconsistently identified as 'unknown-tcp' in the traffic logs. The application uses TCP port 8080 and initiates with a proprietary binary handshake. The engineer confirms that no custom App-ID has been created. Which action should the engineer take to ensure the firewall reliably identifies this application?

Accepted Answer

Create a custom App-ID with a signature that matches the proprietary binary handshake and assign it to the application.. The firewall cannot identify a proprietary application if no signature exists. Creating a custom App-ID with a signature that matches the unique binary handshake enables the firewall to classify the traffic correctly based on application-layer attributes, not just port. This ensures consistent policy enforcement and visibility. Other options either bypass identification or misapply features like SSL decryption.

Answer

Configure an Application Override policy for port 8080 to force the firewall to treat the traffic as the desired application.

Answer

Enable SSL decryption for all traffic on port 8080 to allow the firewall to inspect the payload.

Answer

Add a security policy rule that allows TCP port 8080 and relies on the firewall's default App-ID for that port.

Question 3

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

Accepted Answer

Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.. Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Answer

Reboot both firewalls simultaneously to reset the HA state.

Answer

Disable link speed and duplex settings on the HA interfaces to force a failover.

Answer

Set the HA mode to 'active/active' to allow both firewalls to process traffic.

Question 4

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

Accepted Answer

Upgrade the passive firewall, failover to it, then upgrade the original active. In an active/passive HA pair, the passive firewall is upgraded first while the active firewall continues to handle traffic. After the passive firewall is upgraded and rebooted, an administrative failover is performed to make it the new active firewall, minimizing traffic loss. The original active firewall is then upgraded, ensuring there is always a firewall processing traffic during the upgrade process.

Answer

Upgrade the active firewall first, then failover to the passive

Answer

Suspend HA, upgrade both, then re-enable HA

Answer

Upgrade both firewalls simultaneously after disconnecting HA links

Question 5

Refer to the exhibit. Based on the log, what triggered the failover?

Accepted Answer

A path monitoring group determined that the upstream ISP is unreachable. The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.

Answer

Loss of HA1 heartbeat from the peer

Answer

A link failure on ethernet1/1

Answer

An administrator manually triggered a failover

Question 6

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 7

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 8

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 9

Based on the exhibit, what is the most likely cause for the majority of bypassed sessions?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the clients or servers.. The majority of bypassed sessions are most likely caused by a cipher mismatch between the firewall's SSL/TLS service profile and the clients or servers. When the firewall decrypts traffic, it must negotiate a cipher suite that both the client and server support; if the service profile does not include the cipher suites used by the endpoints, the firewall cannot complete the SSL/TLS handshake and bypasses the session. This is a common misconfiguration in Palo Alto Networks firewalls where the SSL/TLS service profile's cipher list is too restrictive.

Answer

The firewall is overloaded and cannot handle more decryption sessions.

Answer

The decryption certificate is not trusted by clients.

Answer

There is a network connectivity issue between firewall and servers.

Question 10

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Accepted Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then wait for the alarm LED to turn off and back on, then release the button.. The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Answer

Press and hold the reset button using a paperclip, then locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then release the button.

Answer

Locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then press and hold it using a paperclip, then release the button.

Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then release the button, then wait for the alarm LED to turn off and back on.