PCNSE Practice Questions 2 — 50 Questions

Question 1

A GlobalProtect gateway is configured as shown. Remote users report that they can connect to the gateway but cannot authenticate. The users are using the GlobalProtect client with certificate authentication. What is the most likely cause?

Accepted Answer

The gateway does not have a root CA certificate imported for validating client certificates.. Option C is correct because for client certificate authentication, the firewall must have the root CA certificate that issued the client certificates imported; otherwise, it cannot validate the client certificate. Option A is wrong as DNS is only for client DNS server assignment. Option B (IP pool exhaustion) would prevent IP assignment, not authentication. Option D (crypto profile) affects tunnel establishment, not authentication.

Answer

The IPSec crypto profile is too strong for the clients.

Answer

The IP pool is exhausted.

Answer

The DNS server is misconfigured, causing authentication failure.

Question 2

A network administrator notices that traffic from a specific IP address is being blocked unexpectedly. The traffic is allowed in the security policy. What is the most likely cause?

Accepted Answer

The IP address is on a block list in the External Dynamic List (EDL).. Option A is correct because an External Dynamic List (EDL) configured with a block list can override the security policy and block traffic. Options B, C, and D are less likely causes for this specific symptom.

Answer

The source zone is incorrectly assigned.

Answer

The application override is misconfigured.

Answer

The profile settings for the security policy are blocking the traffic.

Question 3

A firewall is configured with two virtual routers in an active/passive HA pair. The active firewall fails over, and after failover, traffic is not passing through the new active firewall. The interface IP addresses are configured as virtual IPs. What is the most likely cause?

Accepted Answer

The session table is not synchronized between HA peers.. Option D is correct because after failover, the session table on the new active firewall may not be synchronized if session synchronization is not enabled or if the session table was not fully synced before failover. This causes the new active firewall to not have active sessions, leading to traffic drops. Options A, B, and C are incorrect because virtual router configuration, HA synchronization, and ARP tables are typically handled automatically in HA.

Answer

The passive firewall's routing table is not synchronized.

Answer

The virtual router is not configured to use the virtual IPs.

Answer

The HA configuration does not include the virtual router.

Question 4

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

Accepted Answer

Traffic Report. Option C is correct because the Traffic Report can be filtered by action (e.g., deny) to show denied traffic. Options A, B, and D are incorrect as they focus on specific categories like applications, threats, or URL filtering.

Answer

Application Report

Answer

Threat Report

Answer

URL Filtering Report

Question 5

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. Options B, C, and D are correct. 'show running resource-monitor' displays CPU and memory usage per dataplane, 'show counter global' shows packet drop counters, and 'show system resources' provides overall CPU/memory/disk usage. Option A is incorrect because 'show session info' shows active sessions but not performance bottlenecks. Option E is incorrect because 'show log traffic' is for historical logs, not real-time troubleshooting.

Answer

show session info

Answer

show log traffic

Question 6

A firewall is part of a Panorama-managed environment. The administrator needs to ensure that only specific administrators can commit changes to devices. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure role-based access on Panorama.. Options A and B are correct. Creating an admin role with commit scope limited to specific device groups (A) and configuring role-based access on Panorama (B) are necessary to restrict commit permissions to specific administrators. Option C is incorrect because Multi-Factor Authentication is for authentication, not commit restriction. Option D is incorrect because template stacks are for template management. Option E is incorrect because Panorama does not have a built-in commit approval workflow.

Answer

Enable Multi-Factor Authentication for all admins.

Answer

Use template stacks to restrict commit permissions.

Answer

Set the firewall to require approval for commits.

Question 7

An organization has a pair of PA-5250 firewalls in active/passive HA. During a maintenance window, the active firewall is rebooted. After the reboot, the firewall that was passive becomes active and passes traffic. However, the other firewall remains in a non-functional state and shows 'unknown' as HA state. The administrator checks the HA configuration and finds both firewalls have the same HA settings. What is the most likely issue?

Accepted Answer

The HA control link is down or misconfigured.. Option B is correct because if the HA control link is down or misconfigured, the firewalls cannot exchange heartbeats, causing the HA state to be 'unknown'. Option A is incorrect because a short keepalive timer would cause flapping, not 'unknown'. Option C is incorrect because different software versions would prevent HA formation. Option D is incorrect because floating IPs are not related to HA state.

Answer

The backup firewall has a different software version.

Answer

The floating IP addresses are not configured.

Answer

The HA keepalive timer is too short.

Question 8

A network administrator is troubleshooting an issue where HTTPS traffic to a particular website is being blocked. The security policy rule allows SSL traffic to that website. The firewall logs show the traffic is being blocked by the URL Filtering profile. The URL Filtering profile is set to allow the category 'Business-and-Economy'. The website belongs to the category 'Shopping'. What action should the administrator take?

Accepted Answer

Create a custom URL category for the website and set it to allow.. Option C is correct because creating a custom URL category for the specific website and setting it to allow is the best practice to override the category-based blocking without loosening security. Option A is incorrect because changing the profile might affect other traffic. Option B is incorrect because IP-based exclude lists are not recommended as websites can change IPs. Option D is incorrect because disabling URL Filtering entirely is too broad.

Answer

Change the security policy rule to use a different URL Filtering profile.

Answer

Disable URL Filtering for that traffic flow.

Answer

Add the website's IP address to the URL Filtering exclude list.

Question 9

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. Option C is correct because by default, management interface failure does not trigger a failover. Option A is wrong because HA1 keepalive failure would trigger failover. Option B is wrong because HA2 link down would trigger if configured. Option D is wrong because session synchronization failure does not cause failover.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 10

Which THREE steps should be taken to verify that an HA pair is ready for a scheduled failover?

Accepted Answer

Perform a 'show high-availability sync-status' to confirm config synchronization. Options A, C, and E are correct. A: Ensure session synchronization is enabled to preserve sessions. C: Verify HA2 link is up for session sync. E: Check that both firewalls have the same configuration. B is wrong because disabling preemption is not a readiness check, it's a configuration choice. D is wrong because stopping logging is not necessary and may hide issues.

Answer

Stop all logging to reduce CPU load

Answer

Disable preemption on the active firewall

Question 11

After upgrading the software on an HA pair, the two firewalls report different HA states. Which command should be used to quickly verify the HA configuration synchronization status?

Accepted Answer

show high-availability sync-status. Option B is correct because 'show high-availability sync-status' displays the configuration sync state. Option A shows general HA state, not sync. Option C shows pending changes. Option D shows HA2 link status.

Answer

show high-availability pending-changes

Answer

show high-availability state

Answer

show high-availability link-monitoring

Question 12

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. Options C and D are correct. C: Check session sync parameters like timeout or encryption mismatch. D: Verify that the session synchronization setting is enabled on both firewalls, as it may be disabled. A is wrong because HA1 is for control, not session data; but it's used for control messages, so if HA1 is up, that's not the issue. B is wrong because restarting HA process is disruptive and not first step. E is wrong because packet buffer protection does not affect sync.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 13

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

Accepted Answer

show high-availability state. Option D is correct because 'show high-availability state' displays HA link statuses. Option A is wrong because 'show device-info' does not show HA links. Option B is wrong because 'show running np-ips' shows management plane info. Option C is wrong because 'show session info' shows sessions.

Answer

show session info

Answer

show running np-ips

Answer

show device-info

Question 14

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. Option A is correct because a dedicated physical interface for HA1 ensures reliable heartbeat. Option B is wrong because using VLAN over data interface adds latency and risk. Option C is wrong because management interface is not recommended due to traffic load. Option D is wrong because HA2 is for data sync, not heartbeat.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 15

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. Option B is correct because the reason is 'configuration mismatch'. Option A is wrong because HA1 is up (communication between IPs works). Option C is wrong because the output shows both are running. Option D is wrong because no sync failure is indicated, just mismatch.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2

Question 16

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

Accepted Answer

Increase the HA keepalive failover threshold to tolerate temporary packet loss. Option D is correct because HA keepalive failover threshold with a higher value (more missed packets) reduces false failovers. Option A is wrong because session sync does not prevent split-brain. Option B is wrong because increasing hello interval would cause faster failover, not slower. Option C is wrong because link monitoring does not address split-brain from temporary outage.

Answer

Decrease the HA1 hello interval

Answer

Enable link monitoring on all interfaces

Answer

Increase the session synchronization rate

Question 17

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

Accepted Answer

Session synchronization is not configured between the HA peers. Option B is correct because in Active/Active, stateful failover requires session sync; if not enabled, sessions are not preserved. Option A is wrong because session offload is not a standard feature. Option C is wrong because route redistribution does not cause session resets. Option D is wrong because Packet Buffer Protection affects drop behavior, not session state.

Answer

Session offload is not enabled on the passive firewall

Answer

Packet Buffer Protection threshold was exceeded

Answer

The routing table is not redistributed after failover

Question 18

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. Option A is correct because the first step is to check the HA1 link connectivity, as config sync uses HA1. Option B is wrong because HA2 is for data sync. Option C is wrong because after checking connectivity. Option D is wrong because preempt is about active/passive role.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 19

An administrator notices that the HA pair shows a state mismatch: one firewall reports active, the other reports passive, but traffic is not flowing through the active firewall. What is the most likely cause?

Accepted Answer

The HA1 link is down and preemptive mode is enabled. Option B is correct because a HA1 link failure can cause both firewalls to think they are active (split-brain), but the state mismatch indicates one sees active, one sees passive; this is often due to a preemptive configuration or hold timer issue. Option A is wrong because HA2 link failure does not cause state mismatch; it only affects session sync.

Answer

Session synchronization is incomplete

Answer

The HA2 link is down

Answer

The passive firewall has a higher priority

Question 20

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. Option C is correct because 'request high-availability sync-to-remote' pushes the active config to the passive, resolving the mismatch. Option A is wrong because that would clear state but not sync config. Option B is wrong because it would disrupt traffic. Option D is wrong because it's not a software upgrade issue.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

PCNSE Practice Questions 2 — 50 Questions

Exhibit

PCNSE Practice Questions 2 — 50 Questions

Exhibit