PCNSE Practice Questions 1 — 50 Questions

Question 1

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Accepted Answer

Download, then Upload, then Install, then Reboot, then Verify. The correct sequence for upgrading PAN-OS on a standalone firewall is: Download the new image from the support portal, Upload it to the firewall, Install the image, Reboot the firewall to load the new version, and Verify the upgrade was successful. Common mistakes include swapping the order of upload and download, installing before upload, or reboot before install.

Answer

Download, then Install, then Upload, then Reboot, then Verify

Answer

Upload, then Download, then Install, then Reboot, then Verify

Answer

Download, then Upload, then Reboot, then Install, then Verify

Question 2

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 3

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. For an active/passive HA pair, both firewalls must be the same hardware model to ensure identical hardware resources (e.g., CPU, memory, ASICs) and port layouts. This is a mandatory requirement because the HA synchronization process relies on matching hardware capabilities to avoid configuration mismatches and failover failures.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 4

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 5

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 6

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 7

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Accepted Answer

The application 'ssl' is not allowed in any security rule.. The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Answer

The session ended with TCP FIN, causing the firewall to deny.

Answer

The destination IP is blacklisted.

Answer

The security rule 'default-deny' explicitly blocks this traffic.

Question 8

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Accepted Answer

Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.. App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.

Answer

Confirm that the source and destination users are correctly configured.

Answer

Ensure that a security profile is applied to the rule to allow the application.

Answer

Check if the rule is placed after a deny-all rule.

Question 9

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. The firewall's management plane (MP) includes a local log storage partition that can hold logs (e.g., traffic, threat, system) and allows export via the web interface (Monitor > Logs > Export). This provides a built-in method for log collection without requiring external infrastructure. Option E is correct because syslog (UDP/TCP, RFC 3164 or RFC 5424) is a standard protocol supported by Palo Alto firewalls to forward all log types to an external collector for centralized reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 10

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 11

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

Accepted Answer

Check the security policy rulebase order and matching. The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Answer

Verify the user-ID agent is mapping the IP correctly

Answer

Check the service configuration for the destination port

Answer

Check the NAT configuration for the user's subnet

Question 12

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 13

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 14

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Accepted Answer

Enable Automatic Tunnel. Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients. Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Answer

GlobalProtect client package assigned to macOS

Answer

Gateway IP Pool configured

Answer

PanGPS (Pan GlobalProtect Service) enabled

Question 15

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Question 16

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 17

A multinational corporation uses GlobalProtect with multiple gateways distributed globally for load balancing. The portal has 'Enable Location Awareness' enabled and region mapping is configured to map APAC users to the APAC gateway, US users to the US gateway, etc. Recently, users in the APAC region are being redirected to the US gateway, causing high latency. The AD admin confirms that users are in the correct APAC subnets. What is the most likely misconfiguration?

Accepted Answer

The location awareness database is outdated for APAC IP subnets. The portal uses a location awareness database to map client IP addresses to geographic regions. If this database is outdated for APAC IP subnets, the portal may fail to recognize APAC users correctly and redirect them to the US gateway, causing high latency. The AD admin confirms the users are in correct APAC subnets, ruling out a client-side subnet issue, so the most likely cause is a stale or incorrect location database on the portal.

Answer

The APAC gateway's region mapping is configured with incorrect IP subnets

Answer

The APAC gateway's IP pool is exhausted

Answer

The portal's 'Primary Gateway' is set to the US gateway

Question 18

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

Accepted Answer

The application override rule does not have the correct port.. An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Answer

The traffic is being identified as ssl instead.

Answer

The security policy does not allow the traffic.

Answer

The custom application my-custom-app is not committed.

Question 19

A company has a pair of Palo Alto Networks firewalls in active/passive HA. The active firewall manages all traffic. Recently, the network team reconfigured the virtual router by adding a new static route to a remote subnet via a next-hop IP on the same interface. After committing, they noticed that the passive firewall's management IP became unreachable. The active firewall continues to pass traffic normally. What is the most likely cause?

Accepted Answer

The passive firewall has lost its management route. In an active/passive HA pair, the passive firewall synchronizes its configuration from the active firewall, including virtual router settings. However, management IP reachability depends on the management network's routing table, which is separate from the dataplane virtual router. Adding a static route to the virtual router does not automatically add a corresponding management route. The passive firewall's management IP became unreachable because it lost its default gateway or specific management route, likely due to a misconfiguration or failure to synchronize the management plane's routing information, which is not part of the HA config sync.

Answer

The HA link is down

Answer

The static route is causing a routing loop

Answer

The virtual router configuration is not synchronized to the passive peer

Question 20

A cloud-based application is accessed via URL filtering and uses SAML authentication. After a user changes their password in the identity provider (Okta), they are unable to authenticate to the application. The firewall is configured with an authentication policy that uses SAML. Other users who have not changed passwords can authenticate successfully. What is the most likely issue?

Accepted Answer

The User-ID mapping on the firewall is outdated and still contains the user's old credentials.. When a user changes their password in Okta, the SAML assertion generated for authentication includes a new session tied to the updated credentials. However, the firewall's User-ID mapping may still cache the user's previous authentication state (including old session tokens or credentials). This stale mapping causes the firewall to reject the new SAML assertion because it does not match the cached user identity, preventing successful authentication. Other users without password changes have consistent mappings, so they authenticate normally.

Answer

The SAML token for the user has expired.

Answer

The firewall's SAML certificate is invalid.

Answer

The application does not support password changes.