PCNSE Practice Test 2 — 30 Questions

Question 1

An administrator wants to ensure that all traffic from the internal network to the internet uses a specific public IP address for source NAT. There are multiple public IP addresses available. What is the best way to achieve this?

Accepted Answer

Create a dynamic IP and port (DIPP) NAT policy with the specific IP as translated address. Option C is correct because a Dynamic IP and Port (DIPP) NAT policy allows you to specify a single translated address (the specific public IP) while still performing port address translation (PAT) to handle multiple internal sessions. This ensures all outbound traffic uses that exact public IP, unlike a pool which would distribute across multiple IPs. DIPP is the standard method for source NAT with a single IP when many internal hosts need concurrent internet access.

Answer

Configure a NAT IP pool

Answer

Use a static NAT policy

Answer

Use a PAT pool

Question 2

Which TWO of the following are prerequisites for configuring User-ID on an interface?

Accepted Answer

A User-ID agent must be installed.. Option C is correct because a User-ID agent (or the built-in User-ID service on the firewall) is required to map IP addresses to usernames. Without an agent—such as the PAN-OS User-ID Agent, Terminal Services Agent, or GlobalProtect—the firewall cannot collect user mapping data from directory services (e.g., Active Directory) or authentication logs. Option D is correct because User-ID must be explicitly enabled on the zone; if the zone does not have User-ID enabled, the firewall will not perform user mapping for traffic traversing that zone, even if the interface is configured correctly.

Answer

The firewall must be in FIPS mode.

Answer

The interface must be in a zone.

Answer

An authentication profile must be configured.

Question 3

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 4

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 5

A company has a pair of Palo Alto Networks firewalls in active/passive HA. The active firewall manages all traffic. Recently, the network team reconfigured the virtual router by adding a new static route to a remote subnet via a next-hop IP on the same interface. After committing, they noticed that the passive firewall's management IP became unreachable. The active firewall continues to pass traffic normally. What is the most likely cause?

Accepted Answer

The passive firewall has lost its management route. In an active/passive HA pair, the passive firewall synchronizes its configuration from the active firewall, including virtual router settings. However, management IP reachability depends on the management network's routing table, which is separate from the dataplane virtual router. Adding a static route to the virtual router does not automatically add a corresponding management route. The passive firewall's management IP became unreachable because it lost its default gateway or specific management route, likely due to a misconfiguration or failure to synchronize the management plane's routing information, which is not part of the HA config sync.

Answer

The HA link is down

Answer

The static route is causing a routing loop

Answer

The virtual router configuration is not synchronized to the passive peer

Question 6

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 7

An administrator needs to generate a tech support file for TAC. Which CLI command accomplishes this?

Accepted Answer

generate tech-support. The correct command to generate a tech support file on Palo Alto Networks firewalls is 'generate tech-support'. This command collects all relevant logs, configurations, and diagnostic data into a single archive file for TAC analysis. The 'generate' keyword is specific to Palo Alto's CLI syntax for creating output files, unlike Cisco's 'show' or 'request' commands.

Answer

debug generate dump

Answer

show tech-support

Answer

request tech-support

Question 8

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

Accepted Answer

The HA3 link is not configured or is misconfigured.. In an active/passive HA configuration, session synchronization occurs over the HA2 link (control link) and HA3 link (packet forwarding link). The HA3 link is specifically responsible for synchronizing session tables between the peers. If the HA3 link is not configured or is misconfigured, session synchronization will fail even though the HA state shows 'active' and 'passive' correctly. The HA2 link handles keepalives and configuration sync, not session sync, so its status being up does not guarantee session synchronization.

Answer

The HA2 link is down.

Answer

The passive firewall does not have management API access.

Answer

The logging settings on both firewalls are different.

Question 9

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

Accepted Answer

Syslog over TCP with buffering enabled in the log forwarding profile.. Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Answer

Email (SMTP) for each log.

Answer

Syslog over UDP with a log forwarding profile.

Answer

Syslog over SSL without optional buffering.

Question 10

An administrator wants to receive SNMP traps from the firewall for critical events such as failed login attempts and high CPU usage. Which configuration step is required?

Accepted Answer

Configure an SNMP trap destination under Device > Setup > SNMP Trap.. To receive SNMP traps from a Palo Alto Networks firewall, you must configure the trap destination under Device > Setup > SNMP Trap. This step defines where the firewall sends SNMP notifications (traps) for events like failed login attempts and high CPU usage. Without a configured trap destination, the firewall will not transmit any SNMP traps, even if other SNMP settings are enabled.

Answer

Enable SNMP monitoring on the interface.

Answer

Set up a log forwarding profile with SNMP action.

Answer

Create an SNMP read-only community string.

Question 11

A team uses the Panorama API to generate custom reports. They need to retrieve a list of all rules that have logging at session end enabled. Which API endpoint should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules. The 'SecurityRule' object in the API provides access to security policy rules, including logging settings. 'LogSetting' is for log forwarding profiles. 'DeviceGroup' is for device group hierarchy. 'Report' is for running predefined reports.

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=get&xpath=/config/shared/log-settings

Answer

GET /api/?type=report&reporttype=predefined

Question 12

A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?

Accepted Answer

TCP sessions are being terminated due to MSS clamping issues.. The 'flow_aged_error_tcp_mss' counter increments when the firewall ages out TCP sessions due to TCP MSS (Maximum Segment Size) clamping issues. This occurs when the firewall modifies the MSS value in SYN packets to avoid fragmentation, but the actual path MTU is smaller than the clamped MSS, causing the session to be terminated prematurely. The rapid increment indicates that MSS clamping is misconfigured or the path MTU is inconsistent, leading to session failures.

Answer

The firewall is experiencing a SYN flood attack.

Answer

There is a routing loop causing packet retransmission.

Answer

The firewall's hardware acceleration is failing.

Question 13

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. Option A is correct because the Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 14

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

Accepted Answer

The server is sending a FIN/RST prematurely due to application layer issues.. Option C is correct because a session in CLOSE state indicates the firewall has already processed and closed the session, often due to a FIN/RST received. This could happen if the server closes the connection prematurely due to a mismatch in application detection or timeout. Option A is wrong because a deny policy would show a different drop reason. Option B is wrong because asymmetric routing would show a different session state (e.g., SYN_SENT). Option D is wrong because packet buffer exhaustion would cause drops across all traffic, not specific sessions.

Answer

A deny all security policy is blocking the traffic.

Answer

Asymmetric routing is causing the session to be torn down.

Answer

Packet buffer exhaustion on the firewall is causing drops.

Question 15

A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?

Accepted Answer

Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet. This is the standard method for inter-virtual-router routing without dynamic redistribution.

Answer

Create a security policy rule allowing the traffic between the zones.

Answer

Configure route redistribution between VR-A and VR-B using a routing protocol.

Answer

Place all interfaces in the same virtual router.

Question 16

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 17

After upgrading a PA-5250 from PAN-OS 9.1 to PAN-OS 10.1, the firewall fails to establish IPsec VPN tunnels with remote peers. The crypto profiles and IKE gateways appear unchanged. What is the most likely cause?

Accepted Answer

The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.. In PAN-OS 10.1, the default minimum pre-shared key length for IKEv2 was increased to 32 characters. If the existing PSK is shorter than 32 characters, the firewall will reject it during IKE negotiation, causing the tunnel to fail even though the crypto profiles and IKE gateways appear unchanged. This is a common compatibility issue when upgrading from PAN-OS 9.1, which had no such minimum length requirement.

Answer

The default SSL/TLS service profile changed, affecting management access.

Answer

The upgrade reset the IKE gateway configuration to default.

Answer

The firewall's management IP address changed during the upgrade.

Question 18

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Option C is correct because enabling 'Buffering' in the log forwarding profile stores logs locally when Panorama is unreachable and forwards them once connectivity is restored. Options A and B do not address unreachability. Option D (syslog) is independent but still requires connectivity.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 19

An organization is migrating from a legacy firewall to a Palo Alto Networks firewall and needs to ensure that all existing application-based policies are accurately replicated. The engineer exports the configuration from the old firewall and imports it using the 'Config Audit' feature. After import, the engineer notices that many security policy rules have the application set to 'any' instead of the specific applications from the old firewall. What is the most likely reason?

Accepted Answer

The administrator did not correctly map the old firewall's application signatures to Palo Alto Networks application IDs during the migration.. Option C is correct because the 'Config Audit' feature in Palo Alto Networks firewalls compares rule configurations but does not automatically translate third-party application signatures into Palo Alto Networks App-IDs. The administrator must manually map the old firewall's application definitions to the correct App-IDs during migration; otherwise, the imported rules default to 'any' for the application field, as the system cannot infer the intended application without explicit mapping.

Answer

The old firewall did not support application identification, so the import process defaulted to 'any'.

Answer

The import process uses a different naming convention for applications, causing a mismatch.

Answer

The 'Config Audit' tool does not import applications; it only identifies rule conflicts.

Question 20

An administrator needs to configure a firewall to send email alerts when a specific security policy rule is triggered. Which two configuration elements are required? (Choose two.)

Accepted Answer

An 'Email Server' profile configured with SMTP server details.. Options A and B are correct. A log forwarding profile defines the action (email), and an email server profile defines the SMTP server details. The security policy rule itself also needs logging enabled, but the question specifically asks for elements to send email alerts, which are the log forwarding profile and the email server profile.

Answer

A 'Security Policy' rule with 'Log at Session End' enabled.

Answer

A 'Panorama' template to push the configuration.

Answer

A 'User-ID' agent to identify users.