PCNSE Core Concepts and Architecture Practice Test 2 — 15 Questions

Question 1

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a virtual router and assign interfaces. In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 2

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets

Question 3

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Accepted Answer

Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object. The DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.

Answer

Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server

Answer

Change the security policy to use the IP address instead of the FQDN

Answer

Configure a static route for the FQDN's IP address pointing to the MPLS interface

Question 4

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Accepted Answer

The application override is incorrectly configured for the traffic.. When an application override is incorrectly configured, the firewall terminates the session with a 'tcp-fin' reason because it cannot match the expected application signature. The 'web-browsing' application expects HTTP traffic, but the actual payload may be non-HTTP (e.g., SSH or custom protocol), causing the firewall to send a TCP FIN to close the session gracefully. This is distinct from a reset (RST) or drop, as the firewall completes the TCP handshake but then terminates due to application mismatch.

Answer

The security policy has a deny action for the traffic.

Answer

The traffic is being asymmetrically routed.

Answer

The zone protection profile is dropping the session.

Question 5

An organization is deploying a pair of PA-5250 firewalls in active/passive high availability. The network team notices that the passive firewall is not receiving synchronization updates. Both devices have the same software version and licenses. The HA1 control link is connected and shows 'up' in 'show high-availability state'. What is the most likely reason for the synchronization failure?

Accepted Answer

The HA2 link is not configured or is down.. The HA2 link is used for session synchronization in active/passive HA configurations. Even if the HA1 control link is up and passing heartbeats, without a functioning HA2 link, the passive firewall will not receive session state updates. The 'show high-availability state' command only confirms HA1 status, not HA2.

Answer

The HA1 link is using a crossover cable instead of a straight-through cable.

Answer

The link speeds on the active and passive firewalls do not match.

Answer

The passive firewall is not in a 'passive' state.

Question 6

A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?

Accepted Answer

The destination IP is not reachable from the firewall.. The packet capture shows the SYN packet is received by the firewall but no SYN-ACK is sent. This indicates the firewall is not completing the TCP three-way handshake. The most common cause is that the destination IP is not reachable from the firewall, meaning the firewall cannot route the SYN packet to the next hop or the destination host is down. In this scenario, the firewall drops the SYN packet silently without generating a SYN-ACK because it cannot establish a session.

Answer

There is no NAT policy to translate the source IP.

Answer

The firewall is not configured to inspect HTTP traffic.

Answer

The security policy does not have an allow rule for HTTP.

Question 7

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Accepted Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then wait for the alarm LED to turn off and back on, then release the button.. The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Answer

Press and hold the reset button using a paperclip, then locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then release the button.

Answer

Locate the reset button on the front panel, then wait for the alarm LED to turn off and back on, then press and hold it using a paperclip, then release the button.

Answer

Locate the reset button on the front panel, then press and hold it using a paperclip, then release the button, then wait for the alarm LED to turn off and back on.

Question 8

Match each log type to its content.

Accepted Answer

Traffic: Contains information about network traffic sessions, including source, destination, ports, and action.. The correct matches are: Traffic log tracks session details; Threat log records security threats; URL Filtering log logs web browsing activity; WildFire Submissions log documents file samples sent for analysis. Common confusions include swapping Traffic with URL Filtering definitions or Threat with WildFire Submissions.

Answer

Traffic: Contains information about URL categories and user access attempts.

Answer

Threat: Contains information about files submitted to WildFire for analysis.

Question 9

A company needs to deploy a firewall in transparent inline mode to filter traffic between two switches without requiring any IP address changes on existing devices. Which interface type should be configured?

Accepted Answer

Virtual Wire. Virtual Wire (VWire) is the correct interface type because it allows the firewall to operate in transparent inline mode without requiring any IP address changes on existing devices. In VWire mode, the firewall acts as a Layer 2 bump in the wire, forwarding traffic between two interfaces based on MAC addresses without participating in routing or requiring IP configuration on the firewall interfaces themselves.

Answer

Tap

Answer

Layer3

Answer

Layer2

Question 10

An administrator notices that traffic from zone A to zone B is being dropped silently. Security rules are in place. Troubleshooting shows that the session does not appear in the session table. What is the most likely cause?

Accepted Answer

The traffic is taking an asymmetric path and the firewall sees only one direction.. When traffic is silently dropped and the session does not appear in the session table, it indicates that the firewall never saw the complete three-way TCP handshake or the first packet of the flow. Asymmetric routing causes the firewall to see only one direction of traffic (e.g., only the SYN from zone A to zone B but not the SYN-ACK return), so the firewall cannot create a session entry because it requires both directions to validate the state. This results in a silent drop without any session table entry or log entry.

Answer

The traffic is being decrypted by an SSL Forward Proxy rule.

Answer

The traffic is matched by a rule with action 'deny' and logging is disabled.

Answer

The interzone default rule is set to deny.

Question 11

An enterprise requires separate administrative domains within a single firewall chassis for different business units. Each domain must have its own virtual router, security policies, and interface configuration. What is the appropriate PAN-OS feature?

Accepted Answer

Multiple virtual systems (vsys). Virtual Systems (vsys) are the PAN-OS feature that enables partitioning a single physical firewall into multiple independent virtual firewalls. Each vsys operates with its own virtual router, security policies, and interface configuration, meeting the requirement for separate administrative domains for different business units within one chassis.

Answer

Administrative roles with RBAC

Answer

Multiple contexts

Answer

Multiple virtual routers

Question 12

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

Accepted Answer

Data plane. The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Answer

Panorama plane

Answer

Management plane

Answer

Control plane

Question 13

An organization wants to map user identity from Active Directory for traffic coming from internal LAN users without installing any agent on domain controllers. Which User-ID mapping method should be used?

Accepted Answer

Active Directory polling. Active Directory polling is the correct method because it allows the Palo Alto Networks firewall to retrieve user-to-IP mappings directly from Active Directory domain controllers using LDAP queries, without requiring any agent installation. This method polls the security event logs on domain controllers to map authenticated users to their IP addresses, making it ideal for environments where agentless user identification is desired for internal LAN traffic.

Answer

XML API

Answer

Terminal Services Agent

Answer

Captive Portal

Question 14

A firewall's dataplane CPU is consistently at 95% utilization even though session count is normal. Analysis shows that a large number of small packets are being processed. Which feature could be causing excessive dataplane processing?

Accepted Answer

Fragmented packet reassembly. Fragmented packet reassembly forces the dataplane to buffer and reassemble IP fragments before performing security policy checks. This process is CPU-intensive, especially when handling a high volume of small fragments, and can drive dataplane utilization to 95% even when the session count is normal. The firewall must allocate resources to track and reassemble each fragmented datagram, which explains the excessive processing.

Answer

Log forwarding to Panorama

Answer

User-ID agent polling

Answer

SSL Decryption with Forward Proxy

Question 15

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

Accepted Answer

Use App-ID's encrypted traffic detection capabilities. App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Answer

Deploy a network tap to capture traffic

Answer

Configure the firewall to trust all certificates

Answer

Implement SSL Forward Proxy decryption