PCNSE Practice Test 30 — 15 Questions

Question 1

An enterprise requires separate administrative domains within a single firewall chassis for different business units. Each domain must have its own virtual router, security policies, and interface configuration. What is the appropriate PAN-OS feature?

Accepted Answer

Multiple virtual systems (vsys). Option D is correct because Virtual Systems (vsys) are the PAN-OS feature that enables partitioning a single physical firewall into multiple independent virtual firewalls. Each vsys operates with its own virtual router, security policies, and interface configuration, meeting the requirement for separate administrative domains for different business units within one chassis.

Answer

Administrative roles with RBAC

Answer

Multiple contexts

Answer

Multiple virtual routers

Question 2

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

Accepted Answer

Use link monitoring instead of path monitoring. Option D is correct because link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described. Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.

Answer

Decrease the path monitoring interval

Answer

HA1 backup link

Answer

Enable pre-emptive mode

Question 3

Which TWO statements correctly describe the role of the data plane in PAN-OS architecture?

Accepted Answer

It performs content inspection.. Option A is correct because the data plane performs content inspection, including threat prevention, URL filtering, and application identification, using the single-pass software architecture to scan traffic in real time. This is a core function of the data plane, separate from the control and management planes.

Answer

It runs routing protocols like OSPF.

Answer

It stores log files.

Answer

It manages the web interface and CLI.

Question 4

A firewall's dataplane CPU is consistently at 95% utilization even though session count is normal. Analysis shows that a large number of small packets are being processed. Which feature could be causing excessive dataplane processing?

Accepted Answer

Fragmented packet reassembly. Fragmented packet reassembly forces the dataplane to buffer and reassemble IP fragments before performing security policy checks. This process is CPU-intensive, especially when handling a high volume of small fragments, and can drive dataplane utilization to 95% even when the session count is normal. The firewall must allocate resources to track and reassemble each fragmented datagram, which explains the excessive processing.

Answer

Log forwarding to Panorama

Answer

User-ID agent polling

Answer

SSL Decryption with Forward Proxy

Question 5

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

Accepted Answer

Exclude known high-traffic sites from decryption.. Option C is correct because excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Answer

Increase the SSL session cache to 1024.

Answer

Upgrade the firewall to a higher model.

Answer

Enable SSL session re-use.

Question 6

Refer to the exhibit. An administrator sees this log entry. What does it indicate?

Accepted Answer

The traffic did not match any security rule.. The log entry shows a session with action 'deny' and a reason of 'rule-out-of-sessions', which indicates that the traffic was evaluated against the security policy but did not match any rule. In Palo Alto Networks firewalls, when traffic does not match any security rule, it is denied by the implicit deny rule at the end of the rulebase, and the log records this as a 'deny' action with the reason 'rule-out-of-sessions'. This is not a buffer overflow or a rule with explicit deny action; it is the default behavior when no rule matches.

Answer

The traffic was dropped due to buffer overflow.

Answer

The traffic was allowed but not logged.

Answer

The traffic matched a rule with action 'deny'.

Question 7

Which THREE are valid methods for User-ID mapping in PAN-OS?

Accepted Answer

DHCP snooping. DHCP snooping is a valid User-ID mapping method because the PAN-OS firewall can act as a DHCP snooping device, listening to DHCPACK messages from the DHCP server. By extracting the client IP address and MAC address from these packets, the firewall can map the IP to a username if the MAC is known via other means (e.g., Active Directory). This method is agentless and works well in environments where DHCP is used for IP address assignment.

Answer

Netflow collection

Answer

SNMP traps

Question 8

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Accepted Answer

Both firewalls must be the same hardware model.. Option B is correct because Palo Alto Networks high-availability (HA) active/passive pairs require both firewalls to be the same hardware model to ensure identical processing capabilities and interface configurations. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration synchronization and stateful failover compatibility; version mismatches can cause HA session sync failures or unexpected behavior.

Answer

Both firewalls must have identical licenses.

Answer

Both firewalls must be in the same data center.

Answer

The firewalls must be directly connected via a crossover cable for HA1.

Question 9

An organization uses GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show that the traffic from the GlobalProtect IP pool to internal servers is allowed. What is the most likely cause?

Accepted Answer

The internal server's default gateway does not point to the firewall.. The most likely cause is that the internal server's default gateway does not point to the firewall. When GlobalProtect clients receive an IP from the VPN IP pool and send traffic to internal servers, the servers must send return traffic back through the firewall to maintain stateful session symmetry. If the server's default gateway points elsewhere (e.g., a core switch), the firewall drops the return traffic because it does not match an existing session, causing connectivity failure despite the firewall logs showing allowed outbound traffic.

Answer

The GlobalProtect gateway is not configured with a route to internal network.

Answer

The client's VPN adapter is not set to use the default gateway on the remote network.

Answer

The security policy for internal traffic is misconfigured.

Question 10

Which three are valid security policy rule actions on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Deny. Option A (Deny) is correct because security policy rules on Palo Alto Networks firewalls use 'Deny' as a valid action to silently discard traffic without sending a TCP RST or ICMP unreachable message. This action is used when you want to block traffic while providing no feedback to the sender, which is common for stealth or compliance policies.

Answer

Log

Answer

Forward

Question 11

A company uses Panorama to manage multiple firewalls. They want to push a security policy that applies to all firewalls but with a specific exception for one firewall in a different region. Which Panorama method should be used?

Accepted Answer

Use a shared policy and override the rule on the specific device group.. Option A is correct because Panorama allows a shared policy to be pushed to all firewalls, and you can override a specific rule for a particular device group. By placing the exception rule in the device group that contains the firewall in the different region, you can override the shared policy for that firewall while the rest continue to use the shared policy. This maintains centralized management while accommodating regional exceptions.

Answer

Use a post-rule in the device group.

Answer

Use a device-specific pre-rule.

Answer

Use a template variable.

Question 12

Which TWO components are part of the PAN-OS management plane?

Accepted Answer

Log collection and reporting. Log collection and reporting is a function of the management plane in PAN-OS. The management plane handles all non-traffic-forwarding tasks, including logging, configuration management, and reporting. This is distinct from the data plane, which processes actual network traffic.

Answer

SSL decryption engine

Answer

Packet buffer

Answer

App-ID engine

Question 13

Which two are valid methods for collecting User-ID information on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Active Directory agent. Option C is correct because the Active Directory agent is a dedicated software component that integrates with Microsoft Active Directory to map user logon events to IP addresses, providing real-time User-ID information to the firewall. Option E is correct because Captive Portal actively authenticates users via browser-based or agent-based authentication, associating their IP address with a username upon successful login, which is a direct method for collecting User-ID data.

Answer

Syslog parsing

Answer

Email gateway

Answer

SNMP trap

Question 14

Refer to the exhibit. What does the serial number '0123456789' indicate?

Accepted Answer

The unique hardware identifier for licensing and support. The serial number '0123456789' is a unique hardware identifier assigned to each Palo Alto Networks firewall during manufacturing. It is used for licensing, support entitlement, and device identification in the Palo Alto Networks support portal, not for network-level addressing or software versioning.

Answer

The MAC address of the management interface

Answer

The model number of the firewall

Answer

The firmware version installed

Question 15

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

Accepted Answer

Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.. Option A is correct because when internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Answer

Create a policy-based forwarding (PBF) rule to send the traffic to the server.

Answer

Add a security policy allowing traffic from internal zone to the public IP.

Answer

Add a static route on the firewall for the public IP pointing to the internal server.