PCNSE Practice Test 1 — 30 Questions

Question 1

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

allow. The correct action is 'allow' because the security engineer needs to permit inbound HTTPS traffic from the Untrust zone to the DMZ web server. In Palo Alto Networks firewalls, the security policy action 'allow' explicitly permits the traffic to pass through the firewall, which is required for legitimate inbound web traffic.

Answer

reset-both

Answer

deny

Answer

drop

Question 2

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

Accepted Answer

The session was idle for longer than the timeout threshold.. The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Answer

The session was terminated by a firewall policy.

Answer

The session was forcibly closed by an administrator.

Answer

The session ended due to a TCP FIN/RST from the client.

Question 3

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

Accepted Answer

A security policy allowing traffic between the zones associated with the virtual routers. In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Answer

Redistribution of routes between the virtual routers

Answer

Enabling packet forwarding on the virtual router interfaces

Answer

A static route on both virtual routers pointing to each other's subnets

Question 4

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 5

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Accepted Answer

generate tech-support file. The 'generate tech-support file' command collects a comprehensive archive of system logs, configuration, resource utilization, and diagnostic data into a single file, which is the standard method for providing TAC with the necessary information to analyze performance issues. This command is specifically designed for troubleshooting and support scenarios, unlike other commands that only capture partial or real-time data.

Answer

debug system dump

Answer

show system resources

Answer

show log system

Question 6

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 7

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog.. A syslog server profile must first be created under Device > Server Profiles > Syslog to define the external syslog server's IP address, port (default 514), and transport protocol (UDP/TCP). This profile is a prerequisite for any log forwarding to an external syslog server.

Answer

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Answer

Directly apply the syslog server profile to each Security policy rule.

Answer

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Question 8

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Accepted Answer

The traffic matched a security rule that explicitly denies it. The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Answer

A threat prevention profile detected and blocked the session

Answer

The traffic was blocked because the application is not allowed

Answer

The destination URL is categorized as prohibited

Question 9

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 10

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 11

A network security engineer is configuring a Palo Alto Networks firewall to perform URL filtering. The company requires that all HTTP and HTTPS traffic from the trust zone to the untrust zone be inspected, and that access to known malware sites be blocked. The firewall is running PAN-OS 10.1. The engineer has already created a URL filtering profile with the appropriate categories set to block. Which additional configuration is required to ensure that HTTPS traffic is filtered based on the full URL?

Accepted Answer

Enable SSL decryption for the trust zone and apply a decryption policy for HTTPS traffic.. To filter HTTPS based on the full URL, the firewall must decrypt the traffic to inspect the HTTP Host header and path. SSL decryption, configured via a decryption policy, allows the firewall to act as a forward proxy. Without decryption, URL filtering for HTTPS is limited to server name indication or certificate information, which may not cover the full URL. Therefore, enabling SSL decryption is the necessary step.

Answer

Configure a security policy rule with application 'ssl' and attach the URL filtering profile.

Answer

Enable 'HTTP Header Logging' in the URL filtering profile and commit.

Answer

Create a custom URL category with the malware sites and apply it to a security policy rule.

Question 12

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Accepted Answer

Navigate to Network > Zones, then click Add, then enter the zone name and select the zone type, then click OK.. The correct sequence to configure a new zone on a Palo Alto Networks firewall is: first, navigate to Network > Zones; second, click Add to create a new zone object; third, enter the zone name and select the zone type (e.g., Layer3); finally, click OK to save the configuration. This order ensures that the zone is properly created and configured before committing changes.

Answer

Click Add, then navigate to Network > Zones, then enter the zone name and select the zone type, then click OK.

Answer

Navigate to Network > Zones, then enter the zone name and select the zone type, then click Add, then click OK.

Answer

Navigate to Network > Zones, then click Add, then click OK, then enter the zone name and select the zone type.

Question 13

An administrator wants to receive SNMP traps from the firewall for critical events such as failed login attempts and high CPU usage. Which configuration step is required?

Accepted Answer

Configure an SNMP trap destination under Device > Setup > SNMP Trap.. To receive SNMP traps from a Palo Alto Networks firewall, you must configure the trap destination under Device > Setup > SNMP Trap. This step defines where the firewall sends SNMP notifications (traps) for events like failed login attempts and high CPU usage. Without a configured trap destination, the firewall will not transmit any SNMP traps, even if other SNMP settings are enabled.

Answer

Enable SNMP monitoring on the interface.

Answer

Set up a log forwarding profile with SNMP action.

Answer

Create an SNMP read-only community string.

Question 14

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 15

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Accepted Answer

Kerberos. Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Answer

LDAP

Answer

Local Database

Answer

RADIUS

Question 16

An engineer wants to block the use of file-sharing application BitTorrent, but allow file transfers over SFTP which also uses port 22. What is the most effective way to achieve this using App-ID?

Accepted Answer

Create a security rule that denies application 'bittorrent' and allows application 'sftp'.. D is correct because App-ID identifies applications by their unique signatures, not just ports. By creating a security rule that denies 'bittorrent' and allows 'sftp', the firewall can block BitTorrent traffic even if it uses non-standard ports, while permitting SFTP on port 22 based on its distinct application signature.

Answer

Create an application filter that matches sftp.

Answer

Use QoS to limit BitTorrent traffic.

Answer

Use an application override to classify all port 22 traffic as sftp.

Question 17

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 18

Order the steps to configure a static route on a Palo Alto Networks firewall.

Accepted Answer

Navigate to the virtual router, add a static route, configure destination and next-hop, then commit.. The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Answer

Navigate to the virtual router, configure destination and next-hop, add the static route, then commit.

Answer

Navigate to the virtual router, add a static route, commit, then configure destination and next-hop.

Answer

Add a static route, navigate to the virtual router, configure destination and next-hop, then commit.

Question 19

A network administrator is troubleshooting an IPsec site-to-site VPN that fails to establish. IKE phase 1 completes successfully, but phase 2 fails with a 'no proposal chosen' message. Both sides have identical IKE and IPsec crypto profiles, and the pre-shared key is correct. What is the most likely cause of the failure?

Accepted Answer

The proxy IDs (local/remote subnets) do not match between peers. In IPsec site-to-site VPNs, IKE phase 1 establishes the secure management channel using parameters like encryption, authentication, and Diffie-Hellman groups. Phase 2 negotiates the IPsec security associations (SAs) for actual data traffic, and the 'no proposal chosen' error indicates a mismatch in the phase 2 parameters. Since both sides have identical crypto profiles and the pre-shared key is correct, the most likely cause is that the proxy IDs (local and remote subnets) do not match between peers. Proxy IDs define the traffic selectors that each peer expects to protect; if they are misaligned, the IPsec SA negotiation fails even if all other settings are identical.

Answer

The tunnel is configured as route-based instead of policy-based

Answer

The IKE gateway's local interface is down

Answer

Dead peer detection is not enabled on the IKE gateway

Question 20

A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?

Accepted Answer

Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.. The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.

Answer

Enable IKE on the management interface.

Answer

Enable User-ID on the management interface.

Answer

Configure a service route to redirect management traffic to a dataplane interface.