PCNSE Practice Test 36 — 15 Questions

Question 1

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 2

A user complains that they cannot access internal resources via GlobalProtect. The firewall shows the user is connected with an IP address from the tunnel pool. Which log type should the administrator check first to determine if traffic is being allowed or denied?

Accepted Answer

Traffic logs.. The administrator should check Traffic logs first because they record every session attempt, showing whether traffic was allowed or denied based on security policies. Since the user is connected with a tunnel IP, the issue is likely policy-based, and Traffic logs provide the source, destination, and action (allow/deny) for each session, directly revealing if the traffic is being blocked.

Answer

System logs.

Answer

Threat logs.

Answer

User-ID logs.

Question 3

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

Accepted Answer

Verify that the user group mapping is correct.. Option D is correct because even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Answer

Restart the User-ID agent service.

Answer

Check the firewall's management plane CPU usage.

Answer

Ensure the firewall has a license for User-ID.

Question 4

A large enterprise has deployed two Palo Alto Networks PA-5250 firewalls in active/passive HA mode with Panorama for centralized management. The network contains over 10,000 users across multiple sites. Recently, the security team deployed a new security policy rule to block a set of high-risk applications. After the commit, the firewall's CPU utilization spiked to 95% and sessions started to drop intermittently. The firewall logs show a high number of session setup failures and timeouts. The existing security policy contains over 5,000 rules. The new rule uses application-based filtering and is placed near the top of the rulebase. What is the most effective course of action to reduce CPU load while maintaining security?

Accepted Answer

Remove the new rule and implement the blocking via a Threat Prevention profile instead.. The CPU spike is likely due to the heavy application identification processing required for the new rule. Option A is the most effective because using a Threat Prevention profile to block the applications offloads the processing to the threat engine, which is more efficient than application-based security rules. Option B is incorrect because moving the rule to the bottom does not reduce the number of sessions that must be matched; it may actually increase processing as rules above it are evaluated. Option C is incorrect because service-based filtering would not effectively block the targeted applications. Option D is incorrect because increasing session table size does not reduce CPU load; it might exacerbate the issue.

Answer

Move the new rule to the bottom of the rulebase to reduce matching frequency.

Answer

Convert the new rule to use a simplified service-based filter instead of application-based to reduce processing overhead.

Answer

Increase the session table size and adjust the TCP timewait timeout to reduce session setup overhead.

Question 5

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

Accepted Answer

Reorder the security rules so the custom allow rule is above the deny rule.. Option D is correct because the deny rule is matching before the allow rule due to policy ordering. Reordering the rules to place the custom allow rule before the deny rule will allow the traffic. Option A is wrong because the custom signature is already correctly defined. Option B is wrong because application override is not needed; the signature works. Option C is wrong because the traffic is reaching the firewall, as shown by the logs.

Answer

Modify the custom App-ID signature to match more precisely.

Answer

Create an application override for the custom application.

Answer

Add a virtual wire interface to ensure traffic reaches the firewall.

Question 6

A multinational corporation uses Palo Alto Networks NGFWs to secure user access to cloud-based productivity applications. Users authenticate via SAML using an external identity provider. Recently, the helpdesk has received multiple complaints that when users log in to the first application in the morning, they are prompted for SAML authentication. After authenticating successfully, if they navigate to a different application (e.g., from email to document editing) within the same browser tab, they are again prompted to re-authenticate, which disrupts their workflow. The firewall authentication logs show that each application access triggers a new SAML authentication request, even though the user’s session is still active. The administrator has verified that the SAML identity provider is properly configured, and the authentication profile on the firewall uses a unique identifier per user. The company wants to minimize re-authentication prompts while maintaining security. Which action should the administrator take?

Accepted Answer

Configure a session token lifetime in the authentication profile so that the firewall can reuse the same authentication token across multiple applications.. The issue is that the firewall is not caching the SAML authentication token across different application requests. Configuring a session token lifetime in the authentication profile allows the firewall to reuse the same authentication token for subsequent requests within the defined time window, reducing re-authentication prompts. Option A (SLO) is used for ending sessions, not avoiding re-authentication. Option B (reducing timeout) would increase prompts. Option D (removing enforcement) weakens security. Therefore, option C is correct.

Answer

Enable Single Logout (SLO) on the identity provider and configure the firewall to accept SLO requests.

Answer

Reduce the authentication timeout value in the authentication profile to force more frequent re-authentication.

Answer

Remove the authentication enforcement from the security rules for these applications and rely on user-IP mapping.

Question 7

A company with multiple branch offices connects to headquarters using IPSec VPN tunnels terminated on PA-220 firewalls. Users at one branch report intermittent connectivity issues when accessing critical applications hosted at HQ. Ping tests to HQ servers succeed consistently, but TCP-based applications (e.g., file transfers, web access) frequently drop connections after a few seconds, particularly when transferring large data. The VPN tunnel status shows 'active' with no rekeys. Security policies are configured to allow all required application traffic. Interface statistics show no discards or errors. Which action should be taken to resolve the issue?

Accepted Answer

Reduce the MTU on the branch firewall's WAN interface to 1400.. Option A is correct because the symptoms (TCP connections dropping mid-transfer, ping success) strongly suggest an MTU issue across the VPN tunnel. Reducing the MTU on the branch firewall's WAN interface to 1400 bytes often resolves fragmentation problems without disabling TCP MSS clamping. Option B is wrong because increasing TCP timeouts would delay disconnections but not prevent them; the drops are likely due to packet fragmentation. Option C is wrong because changing encryption algorithms does not significantly affect packet size and is unlikely to fix fragmentation. Option D is wrong because disabling TCP checksum offloading on clients might help if checksum offload were causing corruption, but the described symptoms point to MTU issues.

Answer

Disable TCP checksum offloading on the clients.

Answer

Change the IPSec encryption algorithm from AES-256 to AES-128.

Answer

Increase the TCP timeout value in the security policy.

Question 8

A security operations center (SOC) uses Panorama to monitor all firewalls. They notice that some log entries show a severity of 'critical' but the alerting system does not fire. The log forwarding profile on Panorama is configured to send syslog alerts for severity 'critical'. The syslog server receives other logs from Panorama but not these critical logs. The administrator checks the Panorama configuration and finds that the log forwarding profile is applied to the correct log types. What is the most likely issue?

Accepted Answer

The critical logs are generated on the firewall and not forwarded to Panorama.. Option C is correct because if the critical logs are generated on the firewall but not forwarded to Panorama (e.g., due to missing log forwarding on the firewall or a filter), Panorama cannot forward them to the syslog server. Option A is incorrect because the syslog server receives other logs from Panorama, so filtering is unlikely. Option B is incorrect because the log forwarding profile on Panorama is applied to Panorama's own logs, not to the logs forwarded from firewalls. Option D is incorrect because the log collector processes logs, and if it were an issue, other logs would also be affected.

Answer

The log forwarding profile on Panorama is not applied to the managed firewalls.

Answer

The Panorama's log collector is not processing the logs correctly.

Answer

The syslog server is filtering out the critical logs based on the source IP.

Question 9

A company uses a Palo Alto Networks firewall to decrypt all outbound SSL traffic. Recently, users have reported slow internet performance. The network administrator notices that the firewall's CPU utilization is consistently above 90%. The traffic logs show that a large portion of decrypted traffic is from software update services (e.g., Windows Update, Adobe, etc.) that do not require inspection. The firewall is a mid-range model with hardware decryption acceleration. What is the most effective action to reduce CPU usage while maintaining security?

Accepted Answer

Configure a decryption policy exception to exclude high-volume, low-risk services from decryption.. Option A is correct because excluding high-volume, low-risk services like Windows Update and Adobe updates from SSL decryption reduces the CPU load from decrypting traffic that does not require security inspection. This approach maintains security by focusing decryption resources on traffic that poses a genuine risk, while leveraging the firewall's ability to bypass decryption for trusted sources. The mid-range model's hardware deceleration is already in use, so the most effective step is to reduce the volume of decryption itself.

Answer

Increase the decryption session buffer size in the SSL/TLS proxy settings.

Answer

Enable hardware decryption offload on the firewall.

Answer

Add an additional firewall in an active/passive HA pair to distribute the decryption load.

Question 10

A company has a security policy rule that allows application 'ssl' from the internal zone to the external zone. Users report that they cannot access certain HTTPS websites. Logs show that the traffic is being matched by a later rule that denies application 'web-browsing'. The administrator verifies that the target websites are using standard HTTPS (port 443). The firewall's application identification has correctly identified the traffic as 'web-browsing' instead of 'ssl'. What is the most likely reason?

Accepted Answer

The firewall's SSL decryption is enabled and re-identifies the application after decryption.. Option C is correct because when SSL decryption is enabled, the firewall initially identifies the traffic as 'ssl' based on the SSL handshake. After decrypting the traffic, it re-inspects the HTTP payload and re-identifies the application as 'web-browsing'. This post-decryption re-identification causes the traffic to match a later rule that denies 'web-browsing', even though the initial rule allowed 'ssl'.

Answer

The application 'ssl' is only used for SSL control traffic, not encrypted payload.

Answer

The security rule is misconfigured with the source zone incorrect.

Answer

The firewall needs to have App-ID updated to recognize the websites.

Question 11

A security engineer is deploying a new PA-5220 firewall to replace an existing legacy firewall. The environment has complex routing with OSPF and BGP. The engineer configures the firewall with multiple virtual routers: one for the internal network, one for the DMZ, and one for the external connection to two ISPs. The firewall is placed in Layer 3 mode. After the cutover, users report that they can access the internet but internal traffic between two different subnets that are both in the internal virtual router fails to route properly. The engineer checks the routing table on the internal virtual router and sees correct OSPF learned routes. The security policies allow all traffic between those subnets. What is the most likely cause of the routing failure?

Accepted Answer

The internal interfaces are assigned to different virtual routers. The most likely cause is that the internal interfaces are assigned to different virtual routers. In a Palo Alto Networks firewall, Layer 3 interfaces belong to a specific virtual router, and routing between subnets in different virtual routers requires either a route leak or a shared virtual router. Since the engineer placed both subnets in the same internal virtual router but the interfaces are in different virtual routers, the firewall cannot route traffic between them even if the routing table and security policies are correct.

Answer

The firewall does not have a loopback interface for OSPF router-id

Answer

The security policy is not correctly identifying the traffic due to asymmetric routing

Answer

The OSPF metric is too high, causing route preference issues

Question 12

A global company uses a pair of PAN-220 firewalls in an active/passive HA configuration at its headquarters. The firewalls have multiple virtual routers and dozens of zones. Recently, a network upgrade changed the physical topology: a new switch was placed between the firewalls and the ISP routers. After the upgrade, the passive firewall continuously shows 'suspended' state. The HA control link (HA1) and data link (HA2) are on separate dedicated interfaces. The Active firewall logs show: 'HA monitor peer unreachable' every few seconds. The engineer has verified IP connectivity between the HA interfaces using ping from the active to the passive HA1 IP. What is the most likely cause of the HA state issue?

Accepted Answer

The new switch introduces latency or jitter that exceeds the HA keepalive timeout. The 'HA monitor peer unreachable' log combined with a 'suspended' passive firewall, despite confirmed IP connectivity on HA1, points to a failure in the HA keepalive mechanism. The new switch introduces latency or jitter that causes keepalive packets to arrive outside the default 2-second hello interval and 8-second dead-interval, triggering the active firewall to declare the peer unreachable. This is a classic issue when a switch is inserted into the HA path without adjusting the HA keepalive timers or ensuring the switch provides low-latency forwarding.

Answer

The HA2 link is misconfigured or unplugged

Answer

The session table on the active firewall is full, preventing HA keepalives

Answer

The HA1 encryption setting is mismatched between the two firewalls

Question 13

A small business uses a single PA-220 firewall with PAN-OS 10.2. The administrator notices that the firewall is no longer receiving automatic threat updates. The License page shows the Threat Prevention license is active with 200 days remaining. The administrator can manually download updates from the Palo Alto Networks update server. What is the most likely cause?

Accepted Answer

The update schedule is disabled.. The most likely cause is that the update schedule is disabled. Even though the Threat Prevention license is active and manual downloads work, the firewall will not automatically check for or download updates if the scheduled update feature is turned off. In PAN-OS 10.2, the administrator must configure a recurring schedule under Device > Dynamic Updates for automatic updates to occur; otherwise, only manual downloads are possible.

Answer

The firewall is behind a proxy that blocks the update service.

Answer

The firewall's system clock is incorrect.

Answer

The DNS settings are misconfigured.

Question 14

A small company has two sites connected by a policy-based IPsec VPN. Users at Site B report they cannot reach a server at Site A with IP 10.1.1.100. The firewall administrator checks the VPN monitor and sees the tunnel is active and IKE SAs are up. From the Site B firewall, a ping to 10.1.1.100 succeeds. However, a user on a PC (192.168.50.10) behind the Site B firewall cannot ping 10.1.1.100. The security policy on the Site B firewall allows traffic from trust to VPN zones. What is the most likely cause of the issue?

Accepted Answer

The security policy on Site B does not include the user subnet as a source VPN zone traffic. Option B is correct because the tunnel is policy-based and needs a security policy that includes the user subnet. Even though a general rule exists, it may not match the specific source. Option A is incorrect because the tunnel is up. Option C is incorrect because ping from firewall works. Option D is incorrect because routing is fine since the firewall can reach the destination.

Answer

NAT is translating the user's IP to an incorrect address

Answer

The IPsec tunnel has a misconfigured proxy ID

Answer

The Site A firewall has a route missing for the Site B user subnet

Question 15

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.

PCNSE Practice Test 36 — 15 Questions

Exhibit

PCNSE Practice Test 36 — 15 Questions

Exhibit