PCNSE Practice Questions 2 — 50 Questions

Question 1

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 2

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. 'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 3

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Accepted Answer

Source zone. A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Answer

User-ID

Answer

Application ID

Question 4

Refer to the exhibit. A firewall system log contains a critical license expiration entry for URL Filtering. What will happen to URL Filtering functionality?

Accepted Answer

URL Filtering will continue to use the last downloaded URL database but will not receive updates.. When a URL Filtering license expires on a Palo Alto Networks firewall, the device does not immediately disable the feature. Instead, it continues to use the last downloaded URL database to categorize URLs, but it will no longer receive periodic database updates from the Palo Alto Networks update server. This ensures that existing traffic policies based on URL categories remain functional, though new or changed URLs may not be accurately categorized until the license is renewed.

Answer

The firewall will stop passing traffic until the license is renewed.

Answer

URL Filtering will stop working immediately until a new license is installed.

Answer

The firewall will automatically fall back to a basic URL category list.

Question 5

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

Accepted Answer

Inspect encrypted traffic for malware, exploits, and data leakage.. SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Answer

Mask the original source IP address for privacy.

Answer

Allow only inbound SSL traffic to be inspected.

Answer

Improve network performance by reducing encryption overhead.

Question 6

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT

Question 7

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. The Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 8

An administrator is troubleshooting VPN tunnel flapping. The logs show multiple Phase 2 rekeys. The tunnel uses IKEv2 with pre-shared key. What is the most likely cause?

Accepted Answer

The rekey time settings are too short.. Frequent Phase 2 rekeys indicate that the IPsec security associations (SAs) are being renegotiated too often. With IKEv2, the rekey time settings (e.g., lifetime seconds or kilobytes) control how long a Phase 2 SA remains active before it must be refreshed. If these values are set too short, the tunnel will flap as SAs are constantly re-established, causing intermittent connectivity.

Answer

Mismatched IKE version.

Answer

Dead Peer Detection (DPD) interval too long.

Answer

Incorrect local or peer ID.

Question 9

An enterprise requires separate administrative domains within a single firewall chassis for different business units. Each domain must have its own virtual router, security policies, and interface configuration. What is the appropriate PAN-OS feature?

Accepted Answer

Multiple virtual systems (vsys). Virtual Systems (vsys) are the PAN-OS feature that enables partitioning a single physical firewall into multiple independent virtual firewalls. Each vsys operates with its own virtual router, security policies, and interface configuration, meeting the requirement for separate administrative domains for different business units within one chassis.

Answer

Administrative roles with RBAC

Answer

Multiple contexts

Answer

Multiple virtual routers

Question 10

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 11

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

Accepted Answer

The user is prompted to authenticate via the configured authentication profile.. When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication. Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Answer

The traffic is blocked because the source-user is 'unknown'.

Answer

The traffic is allowed without authentication because the source-user is 'unknown'.

Answer

The user is redirected to the captive portal.

Question 12

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Accepted Answer

Configure a virtual router and assign interfaces. In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 13

A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?

Accepted Answer

The user's IP is not in the User-ID mapping table. When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.

Answer

The security policy order is incorrect

Answer

The firewall is not configured to use the User-ID agent

Answer

The User-ID agent is not running

Question 14

An administrator wants to ensure that all traffic from the 'Trust' zone to the 'Untrust' zone is inspected by WildFire. Which configuration is required?

Accepted Answer

Configure a WildFire profile and attach it to the security rule.. WildFire inspection is applied via a security rule using a WildFire Analysis profile. The profile defines the file types and verdict actions (e.g., alert, block) for files submitted to WildFire. Attaching this profile to the security rule that governs Trust-to-Untrust traffic ensures all matching traffic is inspected by WildFire.

Answer

Create a separate WildFire rule.

Answer

Enable WildFire on the security rule.

Answer

Enable WildFire globally under Device > Setup.

Question 15

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. Option E is correct because a security policy rule in PAN-OS matches traffic based on the Application field, so setting it to the specific application ensures the rule only matches sessions where that application is positively identified by App-ID. Option C is correct because setting the Service to 'application-default' makes the rule honor the application's standard/default port(s) as defined by the App-ID signature, rather than a custom or any service, which is exactly what is needed to match the application on its standard port. Together, Application = specific app plus Service = application-default ensures the rule matches only when that application is detected on its default port. Option A is not required for this specific matching condition, since zones define the source/destination context but do not restrict matching to a detected application on its standard port. Option B (Threat Prevention) is a security profile action applied after matching, not a matching criterion. Option D (Logging at session start) affects logging behavior, not whether the rule matches the application on its standard port.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 16

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

Accepted Answer

Link monitoring is enabled but not configured to monitor the specific interface that failed.. Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Answer

HA2 heartbeat link is down, preventing the passive from detecting the active's failure.

Answer

The fail-holdup timer is set to 0, causing immediate failover but not triggered.

Answer

Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.

Question 17

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. Option A is correct because App-ID relies on inspecting the application payload to identify the application; when SSL decryption is not enabled, the firewall only sees encrypted traffic and cannot match a signature, so the session is reported as incomplete (ssl or insufficient-data). Option D is correct because App-ID requires seeing both directions of a flow to correlate client-to-server and server-to-client data; with asymmetric routing the firewall only observes one half of the session, so it cannot complete identification and marks the traffic incomplete. Option B is not correct because a slow CPU causes performance degradation or dropped packets, not an 'incomplete' App-ID classification. Option C is not correct because Content-ID licensing affects threat, URL, and file inspection, not the base App-ID engine that classifies applications. Option E is not correct because a deny rule simply blocks the session; it does not produce an incomplete App-ID result.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 18

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

Accepted Answer

The firewalls that are not receiving the template are not included in the same template stack.. In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Answer

The device group has not been committed.

Answer

The firewalls are not licensed for Panorama management.

Answer

The template is in 'preview' mode.

Question 19

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

Accepted Answer

Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.. When internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Answer

Create a policy-based forwarding (PBF) rule to send the traffic to the server.

Answer

Add a security policy allowing traffic from internal zone to the public IP.

Answer

Add a static route on the firewall for the public IP pointing to the internal server.

Question 20

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane