PCNSE Practice Test 37 — 15 Questions

Question 1

A company uses Policy-Based Forwarding (PBF) to route specific traffic from internal users to a partner network through an MPLS connection. The PBF rule is configured to match source addresses 10.1.1.0/24 and forward to a next-hop of 10.2.1.1. The administrator verifies that the MPLS router is reachable from the firewall. Traffic from the 10.1.1.0/24 network does not go through the MPLS link; instead, it takes the default route out the internet connection. Logs show that the traffic hits the PBF rule. What is the most likely issue?

Accepted Answer

The PBF rule is missing the egress interface configuration; it only specifies the next-hop IP.. Option A is correct because a PBF rule in PAN-OS requires both a next-hop IP and an egress interface to be explicitly configured. Without the egress interface, the firewall cannot determine which physical or logical interface to use for forwarding the matched traffic, so it falls back to the default route. Even though the traffic hits the PBF rule, the missing interface configuration prevents the policy-based forwarding from taking effect.

Answer

The PBF rule's source zone is misconfigured.

Answer

The firewall's routing table does not have a route to the partner network via the MPLS router.

Answer

The PBF rule does not include a security policy to allow the traffic.

Question 2

A network engineer configures a Source NAT policy on a Palo Alto Networks firewall to translate internal private IP addresses to the public IP of the external interface. The NAT rule is configured with source zone 'internal', destination zone 'external', and uses 'interface address' as the translated address. The associated security rule allows traffic from 'internal' to 'external' with the translated IP as the source. After committing, users cannot access the internet. Traceroute from an internal host to 8.8.8.8 shows: Hop 1: 192.168.1.1 (firewall internal IP), Hop 2: * * * (no response). The firewall's external interface has a public IP and is in the 'external' zone. What is the most likely cause of the issue?

Accepted Answer

The NAT rule's source zone is configured as 'external' instead of 'internal'.. The NAT rule's source zone must match the zone of the incoming traffic. If the source zone is set to 'external' instead of 'internal', the firewall will not apply the NAT rule to traffic arriving from the internal zone. As a result, packets are forwarded without translation, and the security rule expecting the translated IP as the source will not match, causing traffic to be dropped. The traceroute showing no response beyond the firewall's internal IP confirms that packets are not being translated or forwarded correctly.

Answer

The security rule's action is set to 'deny' for the translated IP.

Answer

The firewall's default route is missing.

Answer

The NAT rule is configured with destination zone 'any' but should be 'external'.

Question 3

A network administrator is troubleshooting decryption failures for HTTPS traffic to a financial website. The firewall is configured with SSL Forward Proxy decryption policy that applies to the 'financial-services' URL category. The firewall uses an internal CA certificate to sign generated certificates. Users report a certificate error in their browsers when accessing 'https://www.bankofalice.com'. The error says the certificate is not trusted, even though the internal CA certificate is installed on all client devices. The administrator checks the firewall logs and sees no decryption errors; the session is being decrypted successfully. The administrator also confirms that the decryption policy is active and the firewall is not bypassing decryption. What is the most likely cause of the certificate error?

Accepted Answer

The website uses Certificate Pinning which causes the browser to reject the firewall's certificate.. Option A is correct because certificate pinning (HTTP Public Key Pinning or HPKP) causes the browser to reject any certificate that does not match the pinned public key, even if the firewall's certificate is signed by a trusted internal CA. Since the firewall generates a new certificate on-the-fly with its own key pair, the browser detects the mismatch and displays a certificate error, despite successful decryption at the firewall.

Answer

The firewall's decryption certificate does not have the correct subject name for the website.

Answer

The firewall's decryption certificate is expired.

Answer

The decryption policy is configured to 'no-decrypt' for that traffic.

Question 4

A financial institution operates a pair of PA-5260 firewalls in active/active HA using Virtual Wire mode. They are experiencing intermittent asymmetric traffic flows causing session setup failures. The firewall logs show sessions being created with a one-sided flow. Which configuration change is most likely to resolve this issue?

Accepted Answer

Configure session distribution to use IP hash instead of round-robin.. Option B is correct because configuring session distribution to use IP hash (based on source/destination IP) ensures that all packets for a session go to the same firewall, avoiding asymmetry. Option A is incorrect because 'symmetric return' is not a standard option in Virtual Wire mode. Option C is incorrect because disabling session offloading would prevent the firewalls from sharing session information, exacerbating the problem. Option D is incorrect because there is no such HA timer setting for asymmetric routing.

Answer

Enable symmetric return on the virtual wire interfaces.

Answer

Disable session offloading between the HA peers.

Answer

Set the HA timer to asymmetric routing active/passive mode.

Question 5

A medium-sized enterprise has two Palo Alto Networks PA-5250 firewalls configured in an active/passive HA pair with session synchronization and configuration synchronization enabled. The HA1 link is a direct copper cable, and the HA2 link is also a direct copper cable. The firewalls are connected to two upstream routers (R1 and R2) and two downstream switches (S1 and S2). The network uses OSPF for dynamic routing. The active firewall (FW-A) is connected to R1 and S1, while the passive firewall (FW-P) is connected to R2 and S2. The OSPF cost is set symmetrically on both sides. During a maintenance window, the network team shuts down the HA1 and HA2 links on both firewalls to test failover behavior. After the links are brought back up, the firewalls are in a state of 'non-functional' and 'suspended'. The team suspects the HA configuration is broken. What is the most likely cause and the best course of action to restore HA?

Accepted Answer

Reboot both firewalls after verifying the HA configuration and that the links are operationally up. Option D is correct. When HA1 and HA2 links are shut down simultaneously, both firewalls may enter suspended state due to loss of all HA keepalives. The recommended recovery is to reboot both firewalls after verifying configuration. Option A is wrong because changing preemptive mode does not address the suspension. Option B is wrong because creating a dedicated HA management network does not fix the current issue. Option C is wrong because different software versions are not allowed in HA.

Answer

Upgrade both firewalls to the same software version and then re-initialize HA

Answer

Change the HA mode to active/active and enable asymmetric routing

Answer

Configure a dedicated management interface for HA1 communication and ensure HA2 is on a different subnet

Question 6

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

Accepted Answer

Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.. The issue is likely caused by both firewalls becoming active after the power outage due to lack of preemptive behavior. Configuring the 'preemptive' option and setting FW-A with higher device priority ensures it reclaims the active role when both are healthy, preventing split-state.

Answer

Reboot both firewalls simultaneously to reset the HA state.

Answer

Disable link speed and duplex settings on the HA interfaces to force a failover.

Answer

Set the HA mode to 'active/active' to allow both firewalls to process traffic.

Question 7

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. The passive firewall went non-functional after the switch replacement, suggesting that path monitoring (which tracks data plane connectivity) is misconfigured or the new switches cause the monitored path to appear down. The first step is to review path monitoring on both firewalls to ensure the AE interface to the new switches is correctly monitored. Checking HA2 (A) is less likely since it is dedicated and unchanged; checking logs (B) is a secondary step; rebooting (C) is disruptive and may not fix the root cause.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 8

A large organization uses GlobalProtect for remote access. Recently, users in the APAC region have been reporting frequent disconnections from the VPN. They can connect and authenticate, but after about 5 minutes the session drops and they must reconnect. The firewall logs show 'GlobalProtect gateway timeout' for these users. The gateway's tunnel timeout is set to 30 minutes. What is the most likely cause?

Accepted Answer

The GlobalProtect client's keepalive interval is set to 60 minutes. Option A is correct because if the tunnel timeout is 30 minutes but the client's keepalive interval is longer than the gateway's idle timeout, the gateway may drop the session. Option B is incorrect because hostname resolution causes connection issues, not timeouts. Option C is incorrect because authentication timeout is set to 120 minutes, which is longer. Option D is incorrect because IP pool exhaustion would prevent new connections, not drop established.

Answer

The portal's authentication timeout is set to 120 minutes

Answer

The IP pool for the gateway is exhausted

Answer

The internal gateway hostname cannot be resolved by the client

Question 9

After upgrading a firewall pair from PAN-OS 9.1 to 10.0, a route-based IPsec VPN to a partner is no longer establishing. The tunnel is configured with a tunnel interface (tunnel.1) with IP 10.0.0.1/30 and the remote tunnel interface is 10.0.0.2/30. IKE phase 1 completes successfully, but phase 2 fails with 'no proposal chosen' on both sides. Both firewalls have identical IPsec crypto profiles (ESP-AES-256, SHA-256, DH-5, 1-hour lifetime). What is the most likely cause?

Accepted Answer

The proxy ID configuration was removed during the upgrade. Option C is correct because after an upgrade, proxy ID configurations may be lost or reset. Option A is incorrect because the crypto profiles are identical. Option B is incorrect because route-based VPNs use proxy IDs for traffic selection. Option D is incorrect because the security policy would affect phase 1.

Answer

The tunnel interface IP address conflicts with another interface

Answer

The new PAN-OS version requires a stronger DH group for IPsec

Answer

A security policy block IKE is blocking the tunnel

Question 10

A multinational corporation uses GlobalProtect with multiple gateways distributed globally for load balancing. The portal has 'Enable Location Awareness' enabled and region mapping is configured to map APAC users to the APAC gateway, US users to the US gateway, etc. Recently, users in the APAC region are being redirected to the US gateway, causing high latency. The AD admin confirms that users are in the correct APAC subnets. What is the most likely misconfiguration?

Accepted Answer

The location awareness database is outdated for APAC IP subnets. Option A is correct because if the location database is outdated, the portal cannot determine the correct region. Option B is incorrect because the IP pool does not affect location redirection. Option C is incorrect because the primary gateway setting is not used with location awareness. Option D is incorrect because the admin has already enabled region mapping.

Answer

The APAC gateway's region mapping is configured with incorrect IP subnets

Answer

The APAC gateway's IP pool is exhausted

Answer

The portal's 'Primary Gateway' is set to the US gateway

Question 11

A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?

Accepted Answer

Update the custom application definition to include SSL decryption and a hostname match.. Option B is correct because the custom application definition was designed for HTTP, not HTTPS. To identify the new HTTPS traffic as the custom application, the administrator must update the definition to include SSL decryption and a hostname match, so that App-ID correctly recognizes the encrypted traffic. Option A is wrong because an override would bypass App-ID, losing visibility. Option C is wrong because allowing all SSL traffic is too broad a security risk. Option D is wrong because disabling App-ID is not a best practice and reduces security.

Answer

Create an application override for the traffic on port 8080.

Answer

Disable App-ID for that traffic and use a port-based policy.

Answer

Change the security policy rule to allow application 'ssl' instead.

Question 12

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

Accepted Answer

The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.. Option D is correct: YouTube traffic uses HTTPS, and without SSL decryption, the firewall cannot inspect the URL. Therefore, the URL category condition fails, and the rule does not match. The traffic is then denied by a default deny rule. Option A is wrong because the URL filtering license is required but typically already in place. Option B is wrong because zones are configured. Option C is wrong because application and URL category are ANDed; the issue is decryption, not logic.

Answer

The rule must also specify the source zone.

Answer

The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.

Answer

The URL filtering license is not installed or expired.

Question 13

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

Accepted Answer

The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.. Option C is correct: App-ID may correctly identify most sessions as 'trading-app', but if some sessions have slightly different characteristics (e.g., variations in the protocol), the firewall may fail to identify them and fall back to 'unknown-tcp'. The prior deny rule then blocks those sessions. Option A is wrong because App-ID does not assign multiple identities to the same session. Option B is wrong because the traffic uses the default port. Option D is wrong because no decryption policy is mentioned.

Answer

The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

Answer

The traffic is using a non-standard port, so the standard rule does not match.

Answer

There is a decryption policy causing the application to be misidentified.

Question 14

Dynamics Inc., a mid-sized company, uses Palo Alto Networks PA-5250 firewalls at their data center. They recently deployed a new web-based CRM application that uses HTTPS and WebSocket connections on TCP port 8443. The security team configured a custom application 'crm-app' with a signature that matches the 'Host' header in HTTP requests, and set the protocol decoder to 'tcp' and the port to 8443. The application is used in a security policy to allow traffic from internal users to the CRM server. However, after deployment, the traffic logs show the application is identified as 'ssl' instead of 'crm-app'. The firewall's App-ID and threat prevention subscriptions are active and up to date. The team has verified that the custom application signature is correctly configured, and the traffic clearly matches the defined host header. Which action should be taken to ensure the CRM traffic is correctly identified by App-ID?

Accepted Answer

Create a new security rule with an application override that sets the application to 'crm-app' for the CRM traffic.. Option B is correct because when App-ID fails to correctly identify traffic despite a properly configured custom application signature, an application override in a security policy can force the identification. This is a supported and common troubleshooting step. Option A is incorrect because disabling SSL decryption would prevent App-ID from inspecting HTTPS headers, making identification less accurate. Option C is incorrect because the timeout parameter controls how long App-ID waits before updating the application, not the initial identification. Option D is incorrect because the protocol decoder and port are already correctly set per the verification; changing them would not resolve the misclassification.

Answer

Increase the 'timeout' value for the custom application signature from 0 to 60 seconds.

Answer

Modify the custom application signature to use the 'tcp' protocol decoder and set the port to 8443.

Answer

Disable SSL decryption for the CRM traffic to allow App-ID to inspect the unencrypted HTTP headers.

Question 15

A large enterprise uses GlobalProtect with SAML authentication integrated with Azure AD for remote access. Users on laptops report intermittent authentication failures when moving between different office locations or switching wireless access points. The firewall clusters are geographically distributed and connected via MPLS. The authentication policy is configured correctly and the SAML identity provider is reachable. What should the administrator check first to resolve the issue?

Accepted Answer

Enable persistent cookie for GlobalProtect authentication to maintain session continuity.. Option C is correct because persistent cookies maintain the SAML session across IP changes, which is common when users roam between networks. Option A might help but is not a direct solution for IP changes. Option B is unrelated. Option D does not affect SAML authentication.

Answer

Increase the SAML session timeout on the identity provider to 24 hours.

Answer

Configure authentication caching at the firewall to store user credentials.

Answer

Verify that the client certificate is not expiring and is properly installed.