PCNSE Practice Test 6 — 10 Questions

Question 1

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 2

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. 'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 3

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Accepted Answer

Source zone. A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Answer

User-ID

Answer

Application ID

Question 4

Refer to the exhibit. A firewall system log contains a critical license expiration entry for URL Filtering. What will happen to URL Filtering functionality?

Accepted Answer

URL Filtering will continue to use the last downloaded URL database but will not receive updates.. When a URL Filtering license expires on a Palo Alto Networks firewall, the device does not immediately disable the feature. Instead, it continues to use the last downloaded URL database to categorize URLs, but it will no longer receive periodic database updates from the Palo Alto Networks update server. This ensures that existing traffic policies based on URL categories remain functional, though new or changed URLs may not be accurately categorized until the license is renewed.

Answer

The firewall will stop passing traffic until the license is renewed.

Answer

URL Filtering will stop working immediately until a new license is installed.

Answer

The firewall will automatically fall back to a basic URL category list.

Question 5

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

Accepted Answer

Inspect encrypted traffic for malware, exploits, and data leakage.. SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Answer

Mask the original source IP address for privacy.

Answer

Allow only inbound SSL traffic to be inspected.

Answer

Improve network performance by reducing encryption overhead.

Question 6

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT

Question 7

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. The Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 8

An administrator is troubleshooting VPN tunnel flapping. The logs show multiple Phase 2 rekeys. The tunnel uses IKEv2 with pre-shared key. What is the most likely cause?

Accepted Answer

The rekey time settings are too short.. Frequent Phase 2 rekeys indicate that the IPsec security associations (SAs) are being renegotiated too often. With IKEv2, the rekey time settings (e.g., lifetime seconds or kilobytes) control how long a Phase 2 SA remains active before it must be refreshed. If these values are set too short, the tunnel will flap as SAs are constantly re-established, causing intermittent connectivity.

Answer

Mismatched IKE version.

Answer

Dead Peer Detection (DPD) interval too long.

Answer

Incorrect local or peer ID.

Question 9

An enterprise requires separate administrative domains within a single firewall chassis for different business units. Each domain must have its own virtual router, security policies, and interface configuration. What is the appropriate PAN-OS feature?

Accepted Answer

Multiple virtual systems (vsys). Virtual Systems (vsys) are the PAN-OS feature that enables partitioning a single physical firewall into multiple independent virtual firewalls. Each vsys operates with its own virtual router, security policies, and interface configuration, meeting the requirement for separate administrative domains for different business units within one chassis.

Answer

Administrative roles with RBAC

Answer

Multiple contexts

Answer

Multiple virtual routers

Question 10

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.