PCNSE Practice Test 3 — 30 Questions

Question 1

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall and IdP system clocks are out of sync. The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock. If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Answer

The IdP does not support IdP-initiated SAML flow

Answer

The user mapping agent is not configured

Answer

The SAML identity provider certificate is expired

Question 2

An organization has a pair of PA-5250 firewalls in active/passive HA. During a maintenance window, the active firewall is rebooted. After the reboot, the firewall that was passive becomes active and passes traffic. However, the other firewall remains in a non-functional state and shows 'unknown' as HA state. The administrator checks the HA configuration and finds both firewalls have the same HA settings. What is the most likely issue?

Accepted Answer

The HA control link is down or misconfigured.. After a reboot, the previously active firewall fails to join the HA pair and shows 'unknown' state, which indicates it cannot communicate with its peer. Since both firewalls have identical HA settings, the most likely cause is that the HA control link (the dedicated link used for heartbeat and state synchronization) is down or misconfigured, preventing the rebooted firewall from establishing a valid HA session.

Answer

The backup firewall has a different software version.

Answer

The floating IP addresses are not configured.

Answer

The HA keepalive timer is too short.

Question 3

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

Accepted Answer

show session all filter source 10.1.1.100. The 'show session all filter source 10.1.1.100' command displays active sessions in the firewall's session table, including the source IP, destination IP, and the translated (NAT) IP addresses. This allows the administrator to verify whether the internal IP 10.1.1.100 is being NATed to a public IP when accessing the internet, as the session table shows both the pre-NAT and post-NAT source addresses.

Answer

show running nat-policy

Answer

show nat rule

Answer

show address 10.1.1.100

Question 4

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

Accepted Answer

Floating static routes were not configured on the passive firewall.. In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Answer

Static routes were not synchronized.

Answer

OSPF routes were not synchronized.

Answer

BGP routes were not synchronized.

Question 5

A company uses Panorama to manage multiple firewalls. They want to push a security policy that applies to all firewalls but with a specific exception for one firewall in a different region. Which Panorama method should be used?

Accepted Answer

Use a shared policy and override the rule on the specific device group.. Panorama allows a shared policy to be pushed to all firewalls, and you can override a specific rule for a particular device group. By placing the exception rule in the device group that contains the firewall in the different region, you can override the shared policy for that firewall while the rest continue to use the shared policy. This maintains centralized management while accommodating regional exceptions.

Answer

Use a post-rule in the device group.

Answer

Use a device-specific pre-rule.

Answer

Use a template variable.

Question 6

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 7

Order the steps to configure a static route on a Palo Alto Networks firewall.

Accepted Answer

Navigate to the virtual router, add a static route, configure destination and next-hop, then commit.. The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Answer

Navigate to the virtual router, configure destination and next-hop, add the static route, then commit.

Answer

Navigate to the virtual router, add a static route, commit, then configure destination and next-hop.

Answer

Add a static route, navigate to the virtual router, configure destination and next-hop, then commit.

Question 8

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Accepted Answer

Navigate to Network > Zones, then click Add, then enter the zone name and select the zone type, then click OK.. The correct sequence to configure a new zone on a Palo Alto Networks firewall is: first, navigate to Network > Zones; second, click Add to create a new zone object; third, enter the zone name and select the zone type (e.g., Layer3); finally, click OK to save the configuration. This order ensures that the zone is properly created and configured before committing changes.

Answer

Click Add, then navigate to Network > Zones, then enter the zone name and select the zone type, then click OK.

Answer

Navigate to Network > Zones, then enter the zone name and select the zone type, then click Add, then click OK.

Answer

Navigate to Network > Zones, then click Add, then click OK, then enter the zone name and select the zone type.

Question 9

A large enterprise has deployed two Palo Alto Networks PA-5250 firewalls in active/passive HA mode with Panorama for centralized management. The network contains over 10,000 users across multiple sites. Recently, the security team deployed a new security policy rule to block a set of high-risk applications. After the commit, the firewall's CPU utilization spiked to 95% and sessions started to drop intermittently. The firewall logs show a high number of session setup failures and timeouts. The existing security policy contains over 5,000 rules. The new rule uses application-based filtering and is placed near the top of the rulebase. What is the most effective course of action to reduce CPU load while maintaining security?

Accepted Answer

Remove the new rule and implement the blocking via a Threat Prevention profile instead.. The CPU spike is caused by the firewall having to perform application identification (App-ID) on every packet matching the new rule, which is placed near the top of a 5,000-rule policy. By moving the blocking logic to a Threat Prevention profile, the firewall can block the applications at the security profile stage after a faster initial match, reducing the per-session processing overhead. This approach offloads the heavy App-ID processing from the rulebase to a profile that is applied only to relevant traffic, thus lowering CPU utilization while still blocking the high-risk applications.

Answer

Move the new rule to the bottom of the rulebase to reduce matching frequency.

Answer

Convert the new rule to use a simplified service-based filter instead of application-based to reduce processing overhead.

Answer

Increase the session table size and adjust the TCP timewait timeout to reduce session setup overhead.

Question 10

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 11

Match each CLI command to its function.

Accepted Answer

show system info: Displays system information including uptime, model, and software version.. These are common commands used in PAN-OS CLI. Correct matches are: show system info shows system information, request restart system restarts the system, show running configuration shows the current config. 'request commit' commits changes, and 'show interface all' shows interfaces.

Answer

request commit: Displays the current running configuration.

Answer

show interface all: Restarts the system or a specific component.

Question 12

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

Accepted Answer

Perform a configuration synchronization from the original active firewall.. The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.

Answer

Enable preemption on the HA configuration.

Answer

Re-apply the licenses on the newly active firewall.

Answer

Disable the HA2 link to force stateful failover.

Question 13

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

Accepted Answer

Exclude known high-traffic sites from decryption.. Excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Answer

Increase the SSL session cache to 1024.

Answer

Upgrade the firewall to a higher model.

Answer

Enable SSL session re-use.

Question 14

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 15

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

Accepted Answer

The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.. App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.

Answer

The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

Answer

The traffic is using a non-standard port, so the standard rule does not match.

Answer

There is a decryption policy causing the application to be misidentified.

Question 16

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane

Question 17

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 18

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 19

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 20

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

Accepted Answer

Use App-ID's encrypted traffic detection capabilities. App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Answer

Deploy a network tap to capture traffic

Answer

Configure the firewall to trust all certificates

Answer

Implement SSL Forward Proxy decryption