PCNSE Practice Test 4 — 10 Questions

Question 1

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 2

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 3

Based on the exhibit, which THREE conclusions can be drawn?

Accepted Answer

The session was matched by the security rule 'allow-ssl'.. The exhibit shows the session matched the security rule 'allow-ssl', which is explicitly listed in the session details. This indicates that the firewall applied this rule to permit the traffic, confirming the session was matched by that specific security rule.

Answer

The source NAT is not translating the source IP.

Answer

The traffic is using UDP protocol.

Question 4

A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?

Accepted Answer

Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.. Increasing the HA keepalive interval and the number of missed keepalives allowed makes the passive firewall less sensitive to transient packet loss on the HA1 link. This reduces false failovers while still ensuring that a sustained loss of heartbeats (indicating a true failure) will eventually trigger a failover. The default HA keepalive settings use a 1-second interval with 3 missed keepalives allowed; increasing these values provides tolerance for intermittent loss without disabling failure detection.

Answer

Disable HA1 link monitoring and rely solely on path monitoring.

Answer

Change the HA mode to active/active to balance traffic and reduce load on the active unit.

Answer

Enable HA2 and configure it as a second heartbeat link for redundancy.

Question 5

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

Accepted Answer

Configure an Authentication Policy to enforce user authentication for their traffic. An Authentication Policy enforces user authentication for traffic, which triggers the firewall to learn the user-to-IP mapping in real time via authentication logs. This approach works regardless of DHCP changes, as each new IP address is immediately associated with the authenticated user. It is the most reliable method for environments with dynamic IP assignments.

Answer

Increase the IP-to-user mapping timeout

Answer

Use GlobalProtect with pre-logon token

Answer

Deploy a User-ID agent with WMI probing

Question 6

A financial institution operates a pair of PA-5260 firewalls in active/active HA using Virtual Wire mode. They are experiencing intermittent asymmetric traffic flows causing session setup failures. The firewall logs show sessions being created with a one-sided flow. Which configuration change is most likely to resolve this issue?

Accepted Answer

Configure session distribution to use IP hash instead of round-robin.. In an active/active HA pair using Virtual Wire mode, asymmetric traffic flows can cause session setup failures because each firewall may see only one direction of the traffic. Configuring session distribution to use IP hash (e.g., based on source and destination IP addresses) ensures that all packets belonging to the same flow are consistently forwarded to the same firewall, preventing one-sided sessions. This resolves the issue by guaranteeing session affinity across the HA pair.

Answer

Enable symmetric return on the virtual wire interfaces.

Answer

Disable session offloading between the HA peers.

Answer

Set the HA timer to asymmetric routing active/passive mode.

Question 7

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

Accepted Answer

Reorder the security rules so the custom allow rule is above the deny rule.. Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.

Answer

Modify the custom App-ID signature to match more precisely.

Answer

Create an application override for the custom application.

Answer

Add a virtual wire interface to ensure traffic reaches the firewall.

Question 8

A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?

Accepted Answer

The domain controller security policy is blocking RPC traffic.. User-ID mapping via domain controller polling relies on the firewall querying the domain controller's security event logs using RPC (Remote Procedure Call). If the domain controller's security policy blocks RPC traffic (typically TCP port 135 and dynamic RPC ports), the firewall cannot retrieve the login events needed to map users to IP addresses, causing incorrect or missing User-ID mappings.

Answer

The firewall is not configured for TLS decryption.

Answer

The user-ID agent is not installed.

Answer

The firewall does not have network access to the domain controller.

Question 9

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Accepted Answer

show vpn ike-sa. 'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Answer

show system info

Answer

show routing route

Answer

show interface all

Question 10

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Accepted Answer

Use the Panorama API to retrieve logs.. Panorama provides a RESTful API that allows external systems to programmatically retrieve logs via HTTPS requests. This is a supported method for exporting logs to external systems, enabling integration with SIEM tools or custom scripts for log analysis and monitoring.

Answer

Configure a NetFlow exporter on Panorama.

Answer

Export logs as CSV directly from the Panorama web interface.

Answer

Use SNMP traps to send log data.