PCNSE Core Concepts and Architecture Practice Test 2 — 15 Questions

Question 1

A firewall's dataplane CPU is consistently at 95% utilization even though session count is normal. Analysis shows that a large number of small packets are being processed. Which feature could be causing excessive dataplane processing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fragmented packet reassembly. Fragmented packet reassembly forces the dataplane to buffer and reassemble IP fragments before performing security policy checks. This process is CPU-intensive, especially when handling a high volume of small fragments, and can drive dataplane utilization to 95% even when the session count is normal. The firewall must allocate resources to track and reassemble each fragmented datagram, which explains the excessive processing.

Answer

Log forwarding to Panorama

Answer

User-ID agent polling

Answer

SSL Decryption with Forward Proxy

Question 2

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

Accepted Answer

Use link monitoring instead of path monitoring. Link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described. Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.

Answer

Decrease the path monitoring interval

Answer

HA1 backup link

Answer

Enable pre-emptive mode

Question 3

Which THREE are valid methods for User-ID mapping in PAN-OS?

Accepted Answer

DHCP snooping. Option A (DHCP snooping) is correct because PAN-OS can learn IP-to-username mappings by parsing DHCP transactions, either via the firewall acting as a DHCP server/relay or through DHCP snooping on a Layer 2 interface, tying the leased IP to the requesting host. Option D (Active Directory polling) is correct because the User-ID Agent or firewall can poll AD domain controllers' security event logs (e.g., 4624 logon events) to map users to IP addresses. Option E (Captive Portal) is correct because PAN-OS Captive Portal authenticates users via a web login page and then creates a User-ID mapping between the authenticated user and their source IP. Option B (Netflow collection) is not a User-ID mapping method in PAN-OS; Netflow provides traffic flow metadata, not username-to-IP bindings. Option C (SNMP traps) is not used for User-ID mapping; SNMP is for monitoring/management, not user identity resolution.

Answer

Netflow collection

Answer

SNMP traps

Question 4

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Accepted Answer

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.. The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer

The service 'application-default' does not allow TCP port 443.

Answer

The packet is not logged properly.

Answer

The destination IP is not routable in the virtual router.

Question 5

Refer to the exhibit. An administrator sees this log entry. What does it indicate?

Accepted Answer

The traffic did not match any security rule.. The log entry shows a session with action 'deny' and a reason indicating that no security rule matched (e.g., reason 'policy-deny'). In PAN-OS, when traffic does not match any security rule, it is denied by the implicit deny rule at the end of the rulebase, and the log records this as a 'deny' action with reason 'policy-deny'. This is not a buffer overflow or a rule with explicit deny action; it is the default behavior when no rule matches.

Answer

The traffic was dropped due to buffer overflow.

Answer

The traffic was allowed but not logged.

Answer

The traffic matched a rule with action 'deny'.

Question 6

A company has configured a security policy that allows HTTP traffic from the internal network 10.0.0.0/8 to the internet. However, users from subnet 10.2.0.0/24 are unable to access external websites. The firewall logs show that traffic from 10.2.0.100 to 203.0.113.1 on port 80 is being denied. Which action should the administrator take to resolve the issue?

Accepted Answer

Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.. In a stateful firewall like Palo Alto Networks, security rules are evaluated in order from top to bottom, and the first matching rule is applied. If a deny rule exists above any allow rule for the 10.2.0.0/24 subnet, traffic from that subnet will be denied. Adding a new allow rule for 10.2.0.0/24 and placing it above the existing deny rule ensures that HTTP traffic from that subnet is permitted before reaching the deny rule.

Answer

Modify the existing allow rule to include the entire 10.2.0.0/24 subnet in the source.

Answer

Change the destination zone of the allow rule to 'any'.

Answer

Delete the deny rule that is blocking the traffic.

Question 7

A multinational organization uses a pair of PA-5250 firewalls in an active/passive high-availability configuration across two data centers. They need to ensure that all management traffic (SSH, HTTPS) to the firewalls is encrypted and sourced only from a dedicated management network (10.10.0.0/24). Which configuration meets these requirements?

Accepted Answer

Configure an interface management profile allowing SSH and HTTPS only from 10.10.0.0/24 and apply it to the management interface.. An interface management profile restricts allowed management services (SSH, HTTPS) to specific source IP addresses or subnets, and applying it to the management interface ensures only traffic from 10.10.0.0/24 can reach the firewall for encrypted management. This directly meets the requirement for encryption (SSH/HTTPS are inherently encrypted) and source restriction without relying on security policies, which do not control management-plane access.

Answer

Configure the firewall to use a dedicated management port and enable IP whitelisting in device settings.

Answer

Use a loopback interface with an IP from the management subnet and attach an interface management profile.

Answer

Create a security policy allowing management access from 10.10.0.0/24 to the firewall's IP addresses.

Question 8

Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?

Accepted Answer

Deny the traffic because rule 1 matches first.. The firewall processes security rules in top-down order. Rule 1 explicitly denies traffic from the internal zone to the destination zone 'untrust-L3' for destination IP 203.0.113.1, which matches the user's traffic. Since rule 1 is matched first, the firewall denies the traffic and does not evaluate subsequent rules.

Answer

Drop the traffic because no rule matches.

Answer

Allow the traffic because rule 2 matches.

Answer

Reset the traffic because of rule 1.

Question 9

Refer to the exhibit. A user attempts to access a banking site (category: finance) over HTTPS. What will happen?

Accepted Answer

The traffic is not decrypted because the second rule matches and overrides the first.. The firewall processes security rules from top to bottom, and the second rule explicitly matches HTTPS traffic to the finance category with an action of 'No Decrypt'. Since the second rule matches before any decryption rule, it overrides the first rule's decrypt action, and the traffic is not decrypted.

Answer

The traffic is decrypted because the first rule matches.

Answer

The traffic is dropped because no rule matches.

Answer

The traffic is decrypted only if the SSL certificate is installed.

Question 10

Which two are valid methods for collecting User-ID information on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Active Directory agent. Option C (Active Directory agent) is correct because the Palo Alto Networks User-ID Agent (or the Windows-based User-ID agent / agentless LDAP-based User-ID) queries Active Directory domain controllers via WMI and the Windows Event Log to map IP addresses to usernames, which is a core supported method for populating the User-ID database. Option E (Captive portal) is correct because the firewall's Captive Portal feature authenticates users through a web login page and then maps the source IP to the authenticated username, feeding the User-ID table. Option A (Syslog parsing) is not a native User-ID collection method on the firewall; User-ID relies on agents, agentless LDAP, captive portal, XML API, and terminal services agents rather than generic syslog parsing. Option B (Email gateway) is unrelated to User-ID mapping, as email gateways do not provide IP-to-user mappings to the firewall. Option D (SNMP trap) is a monitoring/alerting mechanism and does not deliver username-to-IP mappings for User-ID.

Answer

Syslog parsing

Answer

Email gateway

Answer

SNMP trap

Question 11

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Accepted Answer

Both firewalls must be the same hardware model.. Option B is correct because a Palo Alto Networks HA active/passive pair requires both devices to be the same hardware model, ensuring identical interface layouts and consistent failover behavior. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration compatibility and reliable state synchronization. Option A is not required, as HA pairing does not mandate identical licenses; only the necessary feature licenses must be present on each device. Option C is not required because HA peers can be deployed across different locations or data centers, provided latency and connectivity requirements are met. Option E is not required because HA1 can use a dedicated link or an in-band path, and a crossover cable is not mandatory.

Answer

Both firewalls must have identical licenses.

Answer

Both firewalls must be in the same data center.

Answer

The firewalls must be directly connected via a crossover cable for HA1.

Question 12

Which three are valid security policy rule actions on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Deny. In a Palo Alto Networks firewall security policy, the valid rule actions are Allow, Deny, and Drop, making options A, C, and D correct. Allow (D) permits matching traffic and applies the configured security profiles, while Deny (A) silently blocks the session and sends a TCP reset to the client, and Drop (C) silently discards the packet without notifying the source. These three actions are the only ones selectable in the Action column of the Security policy rule. Log (B) is not an action but a separate logging setting configured per rule, and Forward (E) is not a security policy action at all, as forwarding behavior is handled by routing and other features rather than the rule action.

Answer

Log

Answer

Forward

Question 13

A company uses Panorama to manage multiple firewalls. They want to push a security policy that applies to all firewalls but with a specific exception for one firewall in a different region. Which Panorama method should be used?

Accepted Answer

Use a shared policy and override the rule on the specific device group.. Panorama allows a shared policy to be pushed to all firewalls, and you can override a specific rule for a particular device group. By placing the exception rule in the device group that contains the firewall in the different region, you can override the shared policy for that firewall while the rest continue to use the shared policy. This maintains centralized management while accommodating regional exceptions.

Answer

Use a post-rule in the device group.

Answer

Use a device-specific pre-rule.

Answer

Use a template variable.

Question 14

A security engineer is troubleshooting a connectivity issue where traffic from a specific internal host is allowed by security policy but fails to establish a connection to an external server. The firewall logs show the session was created, but no response packets are seen. What is the most likely cause?

Accepted Answer

The source NAT is not configured.. When traffic from an internal host is allowed by security policy and the session is created but no response packets are seen, the most likely cause is that source NAT (also known as outbound NAT or PAT) is not configured. Without source NAT, the firewall forwards the packet with the internal private IP address as the source, and the external server sends responses back to that private address, which is not routable over the public internet. The firewall sees the session as created because it matched the security policy and forwarded the initial packet, but the return traffic never reaches the firewall, so no response packets are logged.

Answer

The destination NAT is configured incorrectly.

Answer

The security policy is missing the return traffic rule.

Answer

The firewall is in FIPS mode.

Question 15

A Palo Alto Networks firewall is configured with multiple virtual routers. Traffic between two different virtual routers is not being forwarded. What is required to enable routing between them?

Accepted Answer

Enable inter-VR routing with a security policy.. By default, Palo Alto Networks firewalls isolate traffic between virtual routers (VRs) to enforce segmentation. To allow inter-VR routing, you must explicitly enable it by creating a security policy that permits the traffic between the zones associated with each VR. This policy acts as the routing decision point, allowing the firewall to forward packets from one VR to another.

Answer

Configure a zone protection profile.

Answer

Configure a static route between the virtual routers.

Answer

Use a virtual wire to connect them.