PCNSE Core Concepts and Architecture — 10 Questions

Question 1

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security policy rule groups. Security policy rule groups allow administrators to organize related firewall rules into logical units, which can then be applied to specific users or devices via policy-based forwarding or rule placement. This feature simplifies management by grouping rules that share a common purpose, such as those for a particular department or application, and enables targeted application without manual rule reordering. It directly addresses the requirement for logical grouping and selective application to users or devices.

Answer

Security profiles

Answer

Security zones

Answer

Application groups

Question 2

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Accepted Answer

The firewall will perform a reverse path forwarding (RPF) check on the source IP.. When a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Answer

The firewall will automatically redistribute the route to VR-B if needed.

Answer

The packet will be dropped because the destination is not in the same VR as the ingress interface.

Answer

The firewall will use the zone of the egress interface to determine the security policy.

Question 3

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Accepted Answer

10.0.0.0/24 via 10.0.0.2 ethernet1/2. The firewall performs a longest-prefix match on the routing table. The destination IP 10.0.0.100 matches the 10.0.0.0/24 route (prefix length 24) more specifically than the 10.0.0.0/8 route (prefix length 8) or the default route. Since the packet arrived on ethernet1/2 and the matching route points to the same interface, the route via 10.0.0.2 ethernet1/2 is selected.

Answer

10.0.1.0/24 via 10.0.0.3 ethernet1/3

Answer

10.0.0.0/8 via 10.0.0.1 ethernet1/1

Answer

0.0.0.0/0 via 10.0.0.1 ethernet1/1

Question 4

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Accepted Answer

Define a custom application object with the correct protocol signature and protocol type.. The firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer

Disable SSL inspection on the security policy for this traffic.

Answer

Create an application override policy for this traffic to mark it as the custom application.

Answer

Enable SSL decryption on the traffic to inspect the payload.

Question 5

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Session Table. The Session Table (B) is a valid dataplane component because it resides in the dataplane and tracks the state of all network sessions, enabling stateful inspection, NAT, and security policy enforcement for traffic passing through the firewall. The Packet Buffer (E) is also a valid dataplane component since it temporarily stores packets in the dataplane while they are being processed, reassembled, or queued for inspection and forwarding. The Management Plane (A) is incorrect because it is a separate functional plane responsible for configuration, administration, and management services, not for forwarding or inspecting traffic. The Threat Prevention Engine (C) is not a dataplane component in the strict architectural sense; threat inspection is performed by dataplane processing using content and threat signatures, but the named engine is not one of the dataplane components. The Log Database (D) is incorrect because it resides on the management plane and stores logs generated by the system, rather than participating in dataplane packet processing.

Answer

Management Plane

Answer

Threat Prevention Engine

Answer

Log Database

Question 6

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID identifies the application by combining several session attributes rather than relying on a single field. Option A is correct because the firewall uses application signatures and, when decryption is configured, inspects the decrypted content to accurately identify applications that would otherwise be hidden inside TLS/SSL. Option B is correct because the transport protocol (TCP or UDP) is part of the session key and helps determine which decoder and signature set applies. Option C is correct because source and destination port numbers are used as part of the session matching and can indicate the expected application, though App-ID does not rely on ports alone. Options D and E are not correct because the destination and source IP addresses are used for routing, zone, and policy matching, but they are not the factors App-ID uses to identify the application itself.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 7

A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?

Accepted Answer

Add a security policy rule to allow the 'quic' application.. The correct action is to add a security policy rule allowing the 'quic' application because QUIC is a distinct protocol (UDP 443) with its own App-ID in PAN-OS 10.1. The firewall logs showing 'application: incomplete' indicate that App-ID is failing to identify the traffic, often due to a missing rule for the specific application. Allowing 'ssl' does not work because SSL/TLS operates over TCP, while QUIC uses UDP, and the firewall's App-ID engine treats them separately.

Answer

Upgrade Panorama to the latest version to add QUIC support.

Answer

Enable SSL decryption on the policy to inspect QUIC traffic.

Answer

Disable App-ID for the QUIC traffic and use a port-based rule.

Question 8

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets

Question 9

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Accepted Answer

Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object. The DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.

Answer

Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server

Answer

Change the security policy to use the IP address instead of the FQDN

Answer

Configure a static route for the FQDN's IP address pointing to the MPLS interface

Question 10

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Accepted Answer

The application override is incorrectly configured for the traffic.. When an application override is incorrectly configured, the firewall terminates the session with a 'tcp-fin' reason because it cannot match the expected application signature. The 'web-browsing' application expects HTTP traffic, but the actual payload may be non-HTTP (e.g., SSH or custom protocol), causing the firewall to send a TCP FIN to close the session gracefully. This is distinct from a reset (RST) or drop, as the firewall completes the TCP handshake but then terminates due to application mismatch.

Answer

The security policy has a deny action for the traffic.

Answer

The traffic is being asymmetrically routed.

Answer

The zone protection profile is dropping the session.