PCNSE Practice Test 2 — 30 Questions

Question 1

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 2

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 3

Based on the exhibit, which THREE conclusions can be drawn?

Accepted Answer

The session was matched by the security rule 'allow-ssl'.. The exhibit shows the session matched the security rule 'allow-ssl', which is explicitly listed in the session details. This indicates that the firewall applied this rule to permit the traffic, confirming the session was matched by that specific security rule.

Answer

The source NAT is not translating the source IP.

Answer

The traffic is using UDP protocol.

Question 4

A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?

Accepted Answer

Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.. Increasing the HA keepalive interval and the number of missed keepalives allowed makes the passive firewall less sensitive to transient packet loss on the HA1 link. This reduces false failovers while still ensuring that a sustained loss of heartbeats (indicating a true failure) will eventually trigger a failover. The default HA keepalive settings use a 1-second interval with 3 missed keepalives allowed; increasing these values provides tolerance for intermittent loss without disabling failure detection.

Answer

Disable HA1 link monitoring and rely solely on path monitoring.

Answer

Change the HA mode to active/active to balance traffic and reduce load on the active unit.

Answer

Enable HA2 and configure it as a second heartbeat link for redundancy.

Question 5

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

Accepted Answer

Configure an Authentication Policy to enforce user authentication for their traffic. An Authentication Policy enforces user authentication for traffic, which triggers the firewall to learn the user-to-IP mapping in real time via authentication logs. This approach works regardless of DHCP changes, as each new IP address is immediately associated with the authenticated user. It is the most reliable method for environments with dynamic IP assignments.

Answer

Increase the IP-to-user mapping timeout

Answer

Use GlobalProtect with pre-logon token

Answer

Deploy a User-ID agent with WMI probing

Question 6

A financial institution operates a pair of PA-5260 firewalls in active/active HA using Virtual Wire mode. They are experiencing intermittent asymmetric traffic flows causing session setup failures. The firewall logs show sessions being created with a one-sided flow. Which configuration change is most likely to resolve this issue?

Accepted Answer

Configure session distribution to use IP hash instead of round-robin.. In an active/active HA pair using Virtual Wire mode, asymmetric traffic flows can cause session setup failures because each firewall may see only one direction of the traffic. Configuring session distribution to use IP hash (e.g., based on source and destination IP addresses) ensures that all packets belonging to the same flow are consistently forwarded to the same firewall, preventing one-sided sessions. This resolves the issue by guaranteeing session affinity across the HA pair.

Answer

Enable symmetric return on the virtual wire interfaces.

Answer

Disable session offloading between the HA peers.

Answer

Set the HA timer to asymmetric routing active/passive mode.

Question 7

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

Accepted Answer

Reorder the security rules so the custom allow rule is above the deny rule.. Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.

Answer

Modify the custom App-ID signature to match more precisely.

Answer

Create an application override for the custom application.

Answer

Add a virtual wire interface to ensure traffic reaches the firewall.

Question 8

A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?

Accepted Answer

The domain controller security policy is blocking RPC traffic.. User-ID mapping via domain controller polling relies on the firewall querying the domain controller's security event logs using RPC (Remote Procedure Call). If the domain controller's security policy blocks RPC traffic (typically TCP port 135 and dynamic RPC ports), the firewall cannot retrieve the login events needed to map users to IP addresses, causing incorrect or missing User-ID mappings.

Answer

The firewall is not configured for TLS decryption.

Answer

The user-ID agent is not installed.

Answer

The firewall does not have network access to the domain controller.

Question 9

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Accepted Answer

show vpn ike-sa. 'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Answer

show system info

Answer

show routing route

Answer

show interface all

Question 10

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Accepted Answer

Use the Panorama API to retrieve logs.. Panorama provides a RESTful API that allows external systems to programmatically retrieve logs via HTTPS requests. This is a supported method for exporting logs to external systems, enabling integration with SIEM tools or custom scripts for log analysis and monitoring.

Answer

Configure a NetFlow exporter on Panorama.

Answer

Export logs as CSV directly from the Panorama web interface.

Answer

Use SNMP traps to send log data.

Question 11

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 12

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 13

A security engineer is investigating a potential data exfiltration incident. The firewall logs show that a host in the DMZ made outbound connections to multiple external IPs on port 443, but the traffic was allowed. The engineer wants to review detailed session information including the amount of data transferred and the application used. Which three log types or tools should the engineer use? (Choose three.)

Accepted Answer

App-ID logs.. App-ID logs (option A) are correct because they provide detailed information about the application associated with each session, which is critical for identifying the specific application used in the outbound connections. Traffic logs (option E) are correct because they record session-level details including source/destination IPs, ports, and the amount of data transferred (bytes sent/received). The packet capture feature (option B) is correct because it allows the engineer to capture and inspect the actual packets for forensic analysis, revealing the exact data payload and application behavior.

Answer

System logs.

Answer

URL filtering logs.

Question 14

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 15

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Accepted Answer

Log forwarding supports sending logs to multiple destinations. Log Forwarding in Panorama supports sending logs to multiple destinations, including syslog servers, email, SNMP traps, and Panorama collectors. This flexibility allows administrators to distribute logs for redundancy, compliance, or analysis across different systems. Option C is correct because Panorama can forward logs to multiple destinations simultaneously, not just one.

Answer

Log forwarding must use TLS encryption

Answer

Log forwarding requires an external syslog server

Answer

Log forwarding can only send logs to a single Panorama collector

Question 16

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 17

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.

Question 18

A user complains that they cannot access internal resources via GlobalProtect. The firewall shows the user is connected with an IP address from the tunnel pool. Which log type should the administrator check first to determine if traffic is being allowed or denied?

Accepted Answer

Traffic logs.. The administrator should check Traffic logs first because they record every session attempt, showing whether traffic was allowed or denied based on security policies. Since the user is connected with a tunnel IP, the issue is likely policy-based, and Traffic logs provide the source, destination, and action (allow/deny) for each session, directly revealing if the traffic is being blocked.

Answer

System logs.

Answer

Threat logs.

Answer

User-ID logs.

Question 19

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

Accepted Answer

The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.. When traffic is encrypted (HTTPS), the firewall cannot inspect the URL path or query parameters unless SSL decryption is enabled. Without decryption, URL filtering relies on the Server Name Indication (SNI) or IP address, which may not distinguish between 'youtube' and 'youtube.com/education' traffic. Since the rule requires both the application 'youtube' and the URL category 'educational-videos', the firewall cannot match the URL category for encrypted YouTube traffic, causing all YouTube traffic to be blocked by the implicit deny rule.

Answer

The rule must also specify the source zone.

Answer

The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.

Answer

The URL filtering license is not installed or expired.

Question 20

An administrator wants to see only the candidate configuration changes that have not yet been committed. Which CLI command should be used?

Accepted Answer

show configuration sessions changes. The 'show configuration sessions changes' command displays the uncommitted candidate configuration changes for the current administrative session. This is the correct command because it specifically shows only the modifications that have been made to the candidate config but not yet committed to the running configuration on a Palo Alto Networks firewall.

Answer

show configuration running

Answer

show configuration sessions all

Answer

show configuration candidate