PCNSE Practice Test 5 — 10 Questions

Question 1

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an application layer gateway (ALG) for FTP. FTP uses separate control and data channels, and the data channel port is dynamically negotiated via the PORT or PASV command. Without an application layer gateway (ALG) for FTP, the firewall cannot track these dynamic ports, so session synchronization would only replicate the control session, causing data sessions to drop after a failover. Enabling the FTP ALG ensures the firewall inspects FTP commands and creates the necessary pinholes for data sessions, which are then synchronized to the passive peer.

Answer

Use HA3 link for session synchronization

Answer

Enable asymmetric routing support

Answer

Enable UDP session synchronization

Question 2

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

Accepted Answer

Check the IPSec tunnel status and IKE/IPSEC SA rekey timers. The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Answer

Check the traffic logs for any denial events

Answer

Reboot the firewall to clear any stale sessions

Answer

Verify the routing table on both firewalls

Question 3

A multinational corporation uses Palo Alto Networks firewalls at its headquarters and five branch offices. SSL Forward Proxy decryption is enabled for all outbound HTTPS traffic. Recently, users in the finance department have reported that several banking and financial websites fail to load, displaying a certificate error in the browser. The errors occur only for these specific sites, while other HTTPS sites work fine. The firewall administrator has already added decryption exclusion rules for the affected domains, but the problem persists. The decryption policy is configured with a single rule that decrypts all ssl service traffic, and the exclusion rules are placed below this global decrypt rule. Which of the following is the best course of action to resolve the issue?

Accepted Answer

Reorder the decryption policy rules so that the exclusion rules are above the global decrypt rule. Palo Alto Networks decryption policy rules are evaluated in top-down order, and the first matching rule is applied. Since the exclusion rules are placed below the global decrypt rule that decrypts all SSL traffic, the global rule matches first and decrypts the traffic, causing certificate errors on sites that require specific handling. Reordering the exclusion rules above the global rule ensures they are evaluated first, allowing the affected domains to bypass decryption and load correctly.

Answer

Create a decryption profile that excludes the failing domains

Answer

Disable SSL decryption for all traffic

Answer

Replace the firewall's internal CA certificate with a publicly trusted certificate

Question 4

A security operations center (SOC) uses Panorama to monitor all firewalls. They notice that some log entries show a severity of 'critical' but the alerting system does not fire. The log forwarding profile on Panorama is configured to send syslog alerts for severity 'critical'. The syslog server receives other logs from Panorama but not these critical logs. The administrator checks the Panorama configuration and finds that the log forwarding profile is applied to the correct log types. What is the most likely issue?

Accepted Answer

The critical logs are generated on the firewall and not forwarded to Panorama.. The most likely issue is that the critical logs are generated on the firewall but not forwarded to Panorama. Panorama can only forward logs it has received from its managed firewalls; if the firewall’s log forwarding or logging settings (e.g., log severity threshold, log buffering, or connectivity to the Log Collector) prevent those critical logs from reaching Panorama, then Panorama’s syslog forwarding profile will never see them. The fact that other logs arrive at the syslog server indicates Panorama’s forwarding works, so the gap must be upstream at the firewall-to-Panorama log collection stage.

Answer

The log forwarding profile on Panorama is not applied to the managed firewalls.

Answer

The Panorama's log collector is not processing the logs correctly.

Answer

The syslog server is filtering out the critical logs based on the source IP.

Question 5

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

Accepted Answer

Create an application override rule to force the identification.. An application override rule forces App-ID to classify traffic based on the custom signature, bypassing the default identification that incorrectly flags the legacy application's custom encryption over TCP 443 as 'ssl'. Without the override, App-ID may still match the traffic to the built-in 'ssl' application due to port-based heuristics, even with a custom signature defined. The override ensures the custom application is applied to the session, overriding any conflicting App-ID results.

Answer

Create a security policy rule that explicitly allows the custom application.

Answer

Change the default port of the custom application from 443 to a different port.

Answer

Disable SSL decryption for that traffic.

Question 6

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. Option B is correct because CDSS subscriptions such as DNS Security and WildFire are cloud-hosted services that the firewall must reach over the internet to submit files/URLs and retrieve verdicts, unlike purely on-box inspection. Option C is correct because the architectural split is that CDSS performs cloud-based threat analysis and delivers dynamic signature/content updates, while the NGFW remains the inline enforcement point that applies policy and blocks traffic. Option E is correct because CDSS aggregates telemetry from all subscribed firewalls and pushes newly derived threat intelligence back out globally, giving every firewall protection from threats seen anywhere. Option A is not correct because full application-level packet inspection is done by the NGFW's App-ID engine on the firewall itself, not by CDSS. Option D is not correct because CDSS augments rather than replaces the firewall's local threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) capabilities.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 7

A company uses a custom application definition for a proprietary application that runs on UDP port 12345. The security rule allowing the application is configured, but traffic logs show the application as 'unknown' instead of matching the custom app. What is the most likely cause?

Accepted Answer

The traffic is not matching the app's protocol or port in the signature.. The custom application definition specifies UDP port 12345, but if the actual traffic uses a different port or does not match the protocol (UDP) defined in the signature, the firewall will classify it as 'unknown'. The security rule allows the application, but the traffic must first be identified by the App-ID engine based on the signature's protocol and port criteria; a mismatch here prevents proper classification.

Answer

The custom application signature is not associated with the security rule.

Answer

The firewall is running in L2 mode.

Answer

The application timeout is too short.

Question 8

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.

Question 9

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering

Question 10

An organization has two different applications (AppA and AppB) that both use TCP port 8080. The firewall must apply different security policies to each application. What is the recommended approach?

Accepted Answer

Create an application override policy to identify each application by IP address.. When two applications share the same TCP port (8080), App-ID cannot differentiate them based on port alone. An application override policy allows you to explicitly identify each application by its source/destination IP address, overriding the default App-ID classification and enabling separate security policies for AppA and AppB.

Answer

Use source/destination IP addresses in security policies instead of App-ID.

Answer

Add the applications on separate virtual wire interfaces.

Answer

Change the port of one application to a different value.