PCNSE Practice Test 35 — 15 Questions

Question 1

The traffic log shows a threat severity 'medium' and the threat log shows action 'allow' for the same session. What is the most likely reason that the threat was allowed?

Accepted Answer

The security policy rule that matched this traffic is configured to allow the threat.. The threat log shows action 'allow' because the security policy rule that matched the session is configured with an action of 'allow'. When a threat is detected but the security rule permits the traffic, the firewall still allows the session to pass, and the threat is logged with the action taken by the rule. This is a common scenario where the firewall's threat prevention profile is set to 'alert' rather than 'block', or the rule's action overrides the threat action.

Answer

The action 'allow' in the threat log is misleading; the traffic was actually blocked.

Answer

The threat was not detected by the firewall.

Answer

The threat log does not record blocked threats.

Question 2

An administrator wants to see only the candidate configuration changes that have not yet been committed. Which CLI command should be used?

Accepted Answer

show configuration sessions changes. The 'show configuration sessions changes' command displays the uncommitted candidate configuration changes for the current administrative session. This is the correct command because it specifically shows only the modifications that have been made to the candidate config but not yet committed to the running configuration on a Palo Alto Networks firewall.

Answer

show configuration running

Answer

show configuration sessions all

Answer

show configuration candidate

Question 3

Which TWO are required for SNMP monitoring of a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Enable SNMP on the firewall (set snmp-server enable).. Option A is correct because SNMP monitoring requires the SNMP agent to be enabled on the firewall. The command 'set snmp-server enable' activates the SNMP service, allowing the firewall to respond to SNMP queries from a management station. Without this, no SNMP communication can occur regardless of other configurations.

Answer

Specify an SNMP trap destination.

Answer

Define an SNMP v3 user with authentication.

Answer

Create an SNMP trap profile for high CPU.

Question 4

A company uses Panorama to manage multiple firewalls. An administrator pushes a template that includes a new Security Profiles group, but the firewalls do not receive the profile group. What is the most likely cause?

Accepted Answer

The firewalls are not assigned to the template that contains the profile group.. Option C is correct because Panorama pushes templates to firewalls based on template assignment. If a firewall is not assigned to the template that contains the Security Profiles group, the firewall will never receive that configuration, regardless of the push operation. Template assignment is a prerequisite for any template-based configuration to be applied to a managed firewall.

Answer

The profile group references a profile that does not exist in the template.

Answer

The push was performed to device groups instead of templates.

Answer

The commit was not selected to include the new profiles.

Question 5

Refer to the exhibit. Based on the log entry, what action was taken on this traffic?

Accepted Answer

The traffic was dropped.. The log entry shows the action field as 'drop', which indicates the firewall denied the traffic. In Palo Alto Networks firewalls, a 'drop' action means the packet was silently discarded without sending a TCP reset or ICMP unreachable message. Therefore, option C is correct.

Answer

The traffic was allowed with a reset.

Answer

The action could not be determined.

Answer

The traffic was allowed and logged.

Question 6

A network engineer needs to configure SNMP traps on a PA-5250 running PAN-OS 10.2 to alert when CPU usage exceeds 80% for more than 10 minutes. Which CLI command should be used to set this threshold?

Accepted Answer

set snmp-server trap cpu-threshold 80. Option A is correct because the CLI command 'set snmp-server trap cpu-threshold 80' directly configures the CPU utilization threshold for SNMP trap generation on a Palo Alto Networks firewall running PAN-OS 10.2. When the CPU usage exceeds 80% for a sustained period (default 10 minutes), the firewall sends an SNMP trap to configured trap destinations. This command is specific to setting the threshold value, and the 10-minute duration is a fixed, non-configurable parameter in this PAN-OS version.

Answer

show snmp-server trap

Answer

set snmp-server trap source-interface ethernet1/1

Answer

set snmp-server trap destination host 192.168.1.100 community public

Question 7

An administrator has applied the above configuration on a firewall. What will happen to traffic destined to TCP port 2525?

Accepted Answer

All traffic on TCP port 2525 will be classified as the application 'smtp'.. Option A is correct because the firewall's application override configuration explicitly maps TCP port 2525 to the application 'smtp'. When an application override is applied, the firewall bypasses App-ID and classifies all traffic matching the specified port and protocol as the defined application, regardless of the actual payload. This means any traffic on TCP port 2525 will be treated as SMTP traffic for policy enforcement and inspection purposes.

Answer

The firewall will perform deeper inspection to identify the application.

Answer

The traffic will be blocked because the application is unknown.

Answer

The traffic will be treated as generic TCP and passed without inspection.

Question 8

A firewall administrator needs to configure a new security policy rule to block traffic from the 'Guest' zone to the 'Corporate' zone for all ports except HTTP and HTTPS. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'web browsing' and 'ssl' with action 'allow'.. Option A is correct because to allow HTTP and HTTPS traffic from Guest to Corporate, you must create an allow rule that specifies the source zone 'Guest', destination zone 'Corporate', and the applications 'web-browsing' (HTTP) and 'ssl' (HTTPS). This rule permits only those specific applications while implicitly denying all other traffic, as Palo Alto Networks firewalls use a default-deny policy for inter-zone traffic.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'any' with action 'deny'.

Answer

Configure a 'Log Forwarding' profile to send alerts for denied traffic.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', and application 'any' with action 'allow'.

Question 9

What does the session state 'SYN_SENT' indicate about this traffic flow?

Accepted Answer

The firewall has sent a SYN packet and is waiting for a response.. The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Answer

The session has been torn down by the server.

Answer

The traffic is being dropped due to asymmetric routing.

Answer

The application has been identified as incomplete.

Question 10

An engineer notices a decrease in network performance and wants to verify if a specific security policy is being triggered frequently. Which CLI command will show the hit count for a specific policy?

Accepted Answer

show running security-policy hit-count. Option C is correct because the 'show running security-policy hit-count' command displays the hit count for each security policy rule, allowing the engineer to identify which specific policy is being triggered frequently. This command directly shows the number of times a rule has matched traffic, which is essential for diagnosing performance issues related to policy usage.

Answer

show security-rulebase

Answer

show rule-usage

Answer

show running security-policy

Question 11

An administrator reviews a traffic log entry: 'Source: 10.0.0.10, Destination: 8.8.8.8, Application: web-browsing, Action: allow, Bytes Sent: 500, Bytes Received: 1200'. What does this log entry indicate about the traffic?

Accepted Answer

The traffic was allowed and identified as web-browsing.. The log entry shows 'Action: allow', which explicitly indicates the firewall permitted the traffic. The 'Application: web-browsing' field confirms that the Palo Alto Networks firewall correctly identified the traffic as HTTP/HTTPS (web-browsing) using App-ID, not just by port. The presence of both 'Bytes Sent' and 'Bytes Received' with non-zero values confirms bidirectional communication, so the traffic was allowed and properly classified.

Answer

The traffic was blocked by a security policy.

Answer

The traffic was only one-way; only received bytes were logged.

Answer

The application was incorrectly identified.

Question 12

A firewall is configured with User-ID using the 'Server Monitoring' method via LDAP. The administrator notices that user-to-IP mappings are only being updated every 60 minutes instead of the configured 15-minute polling interval. The LDAP server is reachable and responds quickly. What configuration parameter is most likely causing the delayed update?

Accepted Answer

The 'User-ID' mapping aging time is set to 60 minutes.. The User-ID mapping aging time controls how long a user-to-IP mapping remains valid before it is considered stale and must be refreshed. If the aging time is set to 60 minutes, the firewall will not query the LDAP server for a new mapping until that timer expires, regardless of a shorter polling interval. This causes updates to appear only every 60 minutes, matching the symptom described.

Answer

The firewall's 'Log Forwarding' profile is slowing down the User-ID process.

Answer

The 'User-ID Agent' is configured with a 'Timeout' of 60 minutes.

Answer

The 'Server Monitoring' profile has a 'Retry Interval' set to 60 minutes.

Question 13

A network administrator notices that traffic from a specific internal subnet is not being logged to the firewall's system logs despite log forwarding being configured. The firewall is running PAN-OS 10.1. Which configuration is most likely causing the issue?

Accepted Answer

The traffic is being matched by a rule with 'Log at Session End' disabled.. Option B is correct because in PAN-OS, a security policy rule must have 'Log at Session End' enabled to generate session-end logs. If this setting is disabled, the firewall will not log the traffic even if a log forwarding profile is applied. Since the administrator has confirmed log forwarding is configured, the most likely cause is that the specific rule matching the subnet's traffic has logging disabled.

Answer

The subnet is not in the 'Log Destination' list.

Answer

Log forwarding profile is not applied to the security policy rule.

Answer

The firewall's management plane is overloaded.

Question 14

A security engineer is investigating a potential data exfiltration incident. The firewall logs show that a host in the DMZ made outbound connections to multiple external IPs on port 443, but the traffic was allowed. The engineer wants to review detailed session information including the amount of data transferred and the application used. Which three log types or tools should the engineer use? (Choose three.)

Accepted Answer

App-ID logs.. App-ID logs (option A) are correct because they provide detailed information about the application associated with each session, which is critical for identifying the specific application used in the outbound connections. Traffic logs (option E) are correct because they record session-level details including source/destination IPs, ports, and the amount of data transferred (bytes sent/received). The packet capture feature (option B) is correct because it allows the engineer to capture and inspect the actual packets for forensic analysis, revealing the exact data payload and application behavior.

Answer

System logs.

Answer

URL filtering logs.

Question 15

The firewall log shows repeated IKE phase 1 negotiation failures. The remote peer is a third-party VPN device. Which of the following is the most likely cause?

Accepted Answer

The IKE encryption algorithm settings do not match between the local firewall and the remote peer.. IKE phase 1 negotiation failures are most commonly caused by mismatched IKE parameters, particularly the encryption algorithm (e.g., AES-256 vs AES-128), hash algorithm, DH group, or lifetime. Since the remote peer is a third-party device, the local firewall and remote peer must agree on all IKE phase 1 proposals; if even one parameter (like encryption) does not match, the negotiation fails. Option C directly addresses this core requirement.

Answer

The remote peer's firewall is blocking UDP port 500.

Answer

The pre-shared key is incorrect.

Answer

The IKE version (v1 vs v2) is mismatched between the two devices.

PCNSE Practice Test 35 — 15 Questions

Exhibit

PCNSE Practice Test 35 — 15 Questions

Exhibit