PCNSE Practice Test 6 — 10 Questions

Question 1

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. Using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature. Option D is wrong because removing applications reduces visibility.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 2

A security architect needs to enforce authentication for all application-based policies using an external authentication source with MFA. Which combination of features best achieves this?

Accepted Answer

SAML authentication with an identity provider that supports MFA. B is correct because SAML authentication with an identity provider (IdP) that supports MFA allows the firewall to offload authentication to an external IdP, which can enforce multi-factor authentication (MFA) before granting access. This meets the requirement for application-based policies to use an external authentication source with MFA, as SAML provides a standards-based (SAML 2.0) mechanism for the firewall to trust the IdP's authentication assertions, including MFA status.

Answer

Local user database with password policies

Answer

Kerberos authentication with Active Directory

Answer

RADIUS authentication with one-time passwords via token

Question 3

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Accepted Answer

SSL decryption is not enabled for the traffic.. When SSL decryption is not enabled, the firewall cannot inspect encrypted HTTPS traffic payloads. As a result, App-ID may classify the traffic as 'incomplete' because it cannot match the encrypted payload to the web-browsing application signature. Enabling SSL decryption allows the firewall to decrypt the traffic, inspect the payload, and correctly identify the application.

Answer

The App-ID signature database is outdated.

Answer

The security policy does not have an allow rule for web-browsing.

Answer

The firewall is experiencing asymmetric routing.

Question 4

A network administrator is troubleshooting an issue where HTTPS traffic to a particular website is being blocked. The security policy rule allows SSL traffic to that website. The firewall logs show the traffic is being blocked by the URL Filtering profile. The URL Filtering profile is set to allow the category 'Business-and-Economy'. The website belongs to the category 'Shopping'. What action should the administrator take?

Accepted Answer

Create a custom URL category for the website and set it to allow.. Creating a custom URL category for the specific website and setting it to allow is the best practice to override the category-based blocking without loosening security. Option A is incorrect because changing the profile might affect other traffic. Option B is incorrect because disabling URL Filtering entirely is too broad and could allow malicious traffic. Option D is incorrect because IP-based exclude lists are not recommended as websites can change IPs, and URL filtering decisions are based on URLs, not IPs.

Answer

Change the security policy rule to use a different URL Filtering profile.

Answer

Disable URL Filtering for that traffic flow.

Answer

Add the website's IP address to the URL Filtering exclude list.

Question 5

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Accepted Answer

Create a custom application with a hostname condition.. A custom application can be defined with a hostname condition to match traffic based on the SNI field in the TLS handshake, which allows App-ID to identify the application even when it uses a non-standard port like 8443. Option E is correct because enabling SSL forward proxy with the internal CA certificate allows the firewall to decrypt the SSL/TLS traffic and inspect the application payload, which is necessary for App-ID to accurately identify the custom application.

Answer

Disable App-ID on port 8443.

Answer

Use an application override with port 8443.

Answer

Add a custom URL category for the domain.

Question 6

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

Accepted Answer

The authentication sequence settings in the Captive Portal configuration. When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail. Checking this first isolates the issue efficiently before investigating other components.

Answer

The certificate used for the Captive Portal page

Answer

The session timeout for authenticated users

Answer

The User-ID agent mapping

Question 7

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

Accepted Answer

The authentication sequence changed after upgrade.. After upgrading the GlobalProtect portal and gateway from version 5.0 to 5.1, the authentication sequence may have been reset or changed. If the authentication profile uses LDAP but the sequence now includes a RADIUS server that is unreachable or misconfigured, the user will fail to authenticate even though the LDAP bind works from the CLI. The error 'Unable to connect to gateway' combined with authentication failure points to a change in the authentication order, not a certificate or connectivity issue.

Answer

The LDAP server certificate has expired.

Answer

The RADIUS server is not reachable.

Answer

The GP portal certificate is not trusted by the client.

Question 8

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 9

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

Accepted Answer

The 'allow-list' is restricting authentication to only user1 and user2. The authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Answer

The Kerberos server profile 'KDC-Profile' is misconfigured

Answer

The expiration time of 60 minutes is too short

Answer

The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

Question 10

When configuring a custom application signature, which field is mandatory to define the application?

Accepted Answer

Protocol. In Palo Alto Networks App-ID, when creating a custom application signature, the Protocol field is mandatory because App-ID uses protocol detection as the first step to identify traffic. Without specifying the protocol (e.g., TCP, UDP, or a specific protocol number), the firewall cannot associate the signature with the correct traffic stream, making the application definition incomplete.

Answer