PCNSE Practice Test 7 — 10 Questions

Question 1

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

Accepted Answer

The user is prompted to authenticate via the configured authentication profile.. When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication. Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Answer

The traffic is blocked because the source-user is 'unknown'.

Answer

The traffic is allowed without authentication because the source-user is 'unknown'.

Answer

The user is redirected to the captive portal.

Question 2

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Accepted Answer

Configure a virtual router and assign interfaces. In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 3

A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?

Accepted Answer

The user's IP is not in the User-ID mapping table. When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.

Answer

The security policy order is incorrect

Answer

The firewall is not configured to use the User-ID agent

Answer

The User-ID agent is not running

Question 4

An administrator wants to ensure that all traffic from the 'Trust' zone to the 'Untrust' zone is inspected by WildFire. Which configuration is required?

Accepted Answer

Configure a WildFire profile and attach it to the security rule.. WildFire inspection is applied via a security rule using a WildFire Analysis profile. The profile defines the file types and verdict actions (e.g., alert, block) for files submitted to WildFire. Attaching this profile to the security rule that governs Trust-to-Untrust traffic ensures all matching traffic is inspected by WildFire.

Answer

Create a separate WildFire rule.

Answer

Enable WildFire on the security rule.

Answer

Enable WildFire globally under Device > Setup.

Question 5

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. Option E is correct because a security policy rule in PAN-OS matches traffic based on the Application field, so setting it to the specific application ensures the rule only matches sessions where that application is positively identified by App-ID. Option C is correct because setting the Service to 'application-default' makes the rule honor the application's standard/default port(s) as defined by the App-ID signature, rather than a custom or any service, which is exactly what is needed to match the application on its standard port. Together, Application = specific app plus Service = application-default ensures the rule matches only when that application is detected on its default port. Option A is not required for this specific matching condition, since zones define the source/destination context but do not restrict matching to a detected application on its standard port. Option B (Threat Prevention) is a security profile action applied after matching, not a matching criterion. Option D (Logging at session start) affects logging behavior, not whether the rule matches the application on its standard port.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 6

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

Accepted Answer

Link monitoring is enabled but not configured to monitor the specific interface that failed.. Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Answer

HA2 heartbeat link is down, preventing the passive from detecting the active's failure.

Answer

The fail-holdup timer is set to 0, causing immediate failover but not triggered.

Answer

Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.

Question 7

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. Option A is correct because App-ID relies on inspecting the application payload to identify the application; when SSL decryption is not enabled, the firewall only sees encrypted traffic and cannot match a signature, so the session is reported as incomplete (ssl or insufficient-data). Option D is correct because App-ID requires seeing both directions of a flow to correlate client-to-server and server-to-client data; with asymmetric routing the firewall only observes one half of the session, so it cannot complete identification and marks the traffic incomplete. Option B is not correct because a slow CPU causes performance degradation or dropped packets, not an 'incomplete' App-ID classification. Option C is not correct because Content-ID licensing affects threat, URL, and file inspection, not the base App-ID engine that classifies applications. Option E is not correct because a deny rule simply blocks the session; it does not produce an incomplete App-ID result.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 8

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

Accepted Answer

The firewalls that are not receiving the template are not included in the same template stack.. In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Answer

The device group has not been committed.

Answer

The firewalls are not licensed for Panorama management.

Answer

The template is in 'preview' mode.

Question 9

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

Accepted Answer

Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.. When internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Answer

Create a policy-based forwarding (PBF) rule to send the traffic to the server.

Answer

Add a security policy allowing traffic from internal zone to the public IP.

Answer

Add a static route on the firewall for the public IP pointing to the internal server.

Question 10

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane