PCNSE Core Concepts and Architecture — 25 Questions

Question 1

Refer to the exhibit. An administrator sees this log entry. What does it indicate?

Accepted Answer

The traffic did not match any security rule.. The log entry shows a session with action 'deny' and a reason indicating that no security rule matched (e.g., reason 'policy-deny'). In PAN-OS, when traffic does not match any security rule, it is denied by the implicit deny rule at the end of the rulebase, and the log records this as a 'deny' action with reason 'policy-deny'. This is not a buffer overflow or a rule with explicit deny action; it is the default behavior when no rule matches.

Answer

The traffic was dropped due to buffer overflow.

Answer

The traffic was allowed but not logged.

Answer

The traffic matched a rule with action 'deny'.

Question 2

A network engineer is troubleshooting why traffic from the 10.0.1.0/24 subnet to the internet is being dropped. The firewall has the following security policies (in order): 1) Allow from 10.0.1.0/24 to 10.0.2.0/24, 2) Allow from any to any, 3) Deny from 10.0.1.0/24 to any. What is the most likely cause of the traffic being dropped?

Accepted Answer

The traffic matches the 'Allow from any to any' rule first.. Palo Alto firewalls use first-match logic: rules are evaluated top-down and the first matching rule is applied. Traffic from 10.0.1.0/24 to the internet does not match rule 1 (destination 10.0.2.0/24). Rule 2 (Allow from any to any) matches first and would permit the traffic. Therefore, the traffic should not be dropped by this rule set. Among the options, D is the only factually correct statement about which rule matches first. The drop must be due to another factor not listed, but D correctly identifies the first-match behavior.

Answer

The 'Allow from 10.0.1.0/24 to 10.0.2.0/24' rule is blocking the traffic.

Answer

The firewall's implicit deny rule is applied before any security rules.

Answer

The traffic matches the 'Deny from 10.0.1.0/24 to any' rule first.

Question 3

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Accepted Answer

Create separate virtual systems (VSYS) for each tenant on the same firewall.. Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Answer

Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

Answer

Use active/active HA mode to assign each tenant to a different firewall.

Answer

Configure multiple virtual routers (VRFs) within the same virtual system.

Question 4

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 5

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

Accepted Answer

Security policy rule groups. Security policy rule groups allow administrators to organize related firewall rules into logical units, which can then be applied to specific users or devices via policy-based forwarding or rule placement. This feature simplifies management by grouping rules that share a common purpose, such as those for a particular department or application, and enables targeted application without manual rule reordering. It directly addresses the requirement for logical grouping and selective application to users or devices.

Answer

Security profiles

Answer

Security zones

Answer

Application groups

Question 6

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

Accepted Answer

Increased packet drops due to buffer exhaustion.. When dataplane packet buffer usage exceeds 90% during a traffic spike, the firewall's packet buffers are nearly exhausted, leading to a condition where incoming packets cannot be stored temporarily for processing. This directly causes packet drops because the dataplane has no available buffers to enqueue new packets, even though CPU utilization remains low. Option D correctly identifies this as the primary impact, as buffer exhaustion results in tail-drop behavior for new packets.

Answer

Reduced new session setup rate.

Answer

Reduced committed information rate (CIR) on QoS policies.

Answer

Increased latency for management access.

Question 7

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Accepted Answer

The firewall will perform a reverse path forwarding (RPF) check on the source IP.. When a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Answer

The firewall will automatically redistribute the route to VR-B if needed.

Answer

The packet will be dropped because the destination is not in the same VR as the ingress interface.

Answer

The firewall will use the zone of the egress interface to determine the security policy.

Question 8

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Accepted Answer

Define a custom application with the appropriate protocol, port, and optionally a signature.. When a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Answer

Create a security policy rule with an application override to match the port.

Answer

Enable SSL decryption on the traffic to inspect encrypted payloads.

Answer

Add the port to the default application's 'port' field in the application object.

Question 9

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

Accepted Answer

Panorama without Log Collectors. Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Answer

Panorama with Dedicated Log Collectors

Answer

Panorama with Log Collectors

Answer

Panorama in High Availability mode

Question 10

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Accepted Answer

10.0.0.0/24 via 10.0.0.2 ethernet1/2. The firewall performs a longest-prefix match on the routing table. The destination IP 10.0.0.100 matches the 10.0.0.0/24 route (prefix length 24) more specifically than the 10.0.0.0/8 route (prefix length 8) or the default route. Since the packet arrived on ethernet1/2 and the matching route points to the same interface, the route via 10.0.0.2 ethernet1/2 is selected.

Answer

10.0.1.0/24 via 10.0.0.3 ethernet1/3

Answer

10.0.0.0/8 via 10.0.0.1 ethernet1/1

Answer

0.0.0.0/0 via 10.0.0.1 ethernet1/1

Question 11

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Accepted Answer

Define a custom application object with the correct protocol signature and protocol type.. The firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer

Disable SSL inspection on the security policy for this traffic.

Answer

Create an application override policy for this traffic to mark it as the custom application.

Answer

Enable SSL decryption on the traffic to inspect the payload.

Question 12

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Session Table. The Session Table is a core dataplane component because it stores stateful session information for all active traffic flows. The dataplane uses this table to perform fast-path forwarding, applying security policies and NAT translations without involving the management plane. Without the session table, the firewall would be unable to maintain stateful inspection, which is fundamental to its operation.

Answer

Management Plane

Answer

Threat Prevention Engine

Answer

Log Database

Question 13

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 14

A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?

Accepted Answer

Add a security policy rule to allow the 'quic' application.. The correct action is to add a security policy rule allowing the 'quic' application because QUIC is a distinct protocol (UDP 443) with its own App-ID in PAN-OS 10.1. The firewall logs showing 'application: incomplete' indicate that App-ID is failing to identify the traffic, often due to a missing rule for the specific application. Allowing 'ssl' does not work because SSL/TLS operates over TCP, while QUIC uses UDP, and the firewall's App-ID engine treats them separately.

Answer

Upgrade Panorama to the latest version to add QUIC support.

Answer

Enable SSL decryption on the policy to inspect QUIC traffic.

Answer

Disable App-ID for the QUIC traffic and use a port-based rule.

Question 15

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering

Question 16

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Accepted Answer

Configure a virtual router and assign interfaces. In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 17

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets

Question 18

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Accepted Answer

Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object. The DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.

Answer

Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server

Answer

Change the security policy to use the IP address instead of the FQDN

Answer

Configure a static route for the FQDN's IP address pointing to the MPLS interface

Question 19

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Accepted Answer

The application override is incorrectly configured for the traffic.. When an application override is incorrectly configured, the firewall terminates the session with a 'tcp-fin' reason because it cannot match the expected application signature. The 'web-browsing' application expects HTTP traffic, but the actual payload may be non-HTTP (e.g., SSH or custom protocol), causing the firewall to send a TCP FIN to close the session gracefully. This is distinct from a reset (RST) or drop, as the firewall completes the TCP handshake but then terminates due to application mismatch.

Answer

The security policy has a deny action for the traffic.

Answer

The traffic is being asymmetrically routed.

Answer

The zone protection profile is dropping the session.

Question 20

An organization is deploying a pair of PA-5250 firewalls in active/passive high availability. The network team notices that the passive firewall is not receiving synchronization updates. Both devices have the same software version and licenses. The HA1 control link is connected and shows 'up' in 'show high-availability state'. What is the most likely reason for the synchronization failure?

Accepted Answer

The HA2 link is not configured or is down.. The HA2 link is used for session synchronization in active/passive HA configurations. Even if the HA1 control link is up and passing heartbeats, without a functioning HA2 link, the passive firewall will not receive session state updates. The 'show high-availability state' command only confirms HA1 status, not HA2.

Answer

The HA1 link is using a crossover cable instead of a straight-through cable.

Answer

The link speeds on the active and passive firewalls do not match.

Answer

The passive firewall is not in a 'passive' state.