PCNSE Practice Test 8 — 10 Questions

Question 1

Match each CLI command to its function.

Accepted Answer

show system info: Displays system information including uptime, model, and software version.. These are common commands used in PAN-OS CLI. Correct matches are: show system info shows system information, request restart system restarts the system, show running configuration shows the current config. 'request commit' commits changes, and 'show interface all' shows interfaces.

Answer

request commit: Displays the current running configuration.

Answer

show interface all: Restarts the system or a specific component.

Question 2

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

Accepted Answer

Perform a configuration synchronization from the original active firewall.. The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.

Answer

Enable preemption on the HA configuration.

Answer

Re-apply the licenses on the newly active firewall.

Answer

Disable the HA2 link to force stateful failover.

Question 3

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

Accepted Answer

Exclude known high-traffic sites from decryption.. Excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Answer

Increase the SSL session cache to 1024.

Answer

Upgrade the firewall to a higher model.

Answer

Enable SSL session re-use.

Question 4

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 5

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

Accepted Answer

The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.. App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.

Answer

The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

Answer

The traffic is using a non-standard port, so the standard rule does not match.

Answer

There is a decryption policy causing the application to be misidentified.

Question 6

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane

Question 7

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 8

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 9

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 10

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

Accepted Answer

Use App-ID's encrypted traffic detection capabilities. App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Answer

Deploy a network tap to capture traffic

Answer

Configure the firewall to trust all certificates

Answer

Implement SSL Forward Proxy decryption