PCNSE Core Concepts and Architecture Practice Test 3 — 15 Questions

Question 1

An organization uses GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show that the traffic from the GlobalProtect IP pool to internal servers is allowed. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The internal server's default gateway does not point to the firewall.. The most likely cause is that the internal server's default gateway does not point to the firewall. When GlobalProtect clients receive an IP from the VPN IP pool and send traffic to internal servers, the servers must send return traffic back through the firewall to maintain stateful session symmetry. If the server's default gateway points elsewhere (e.g., a core switch), the firewall drops the return traffic because it does not match an existing session, causing connectivity failure despite the firewall logs showing allowed outbound traffic.

Answer

The GlobalProtect gateway is not configured with a route to internal network.

Answer

The client's VPN adapter is not set to use the default gateway on the remote network.

Answer

The security policy for internal traffic is misconfigured.

Question 2

A network engineer is troubleshooting why traffic from the 10.0.1.0/24 subnet to the internet is being dropped. The firewall has the following security policies (in order): 1) Allow from 10.0.1.0/24 to 10.0.2.0/24, 2) Allow from any to any, 3) Deny from 10.0.1.0/24 to any. What is the most likely cause of the traffic being dropped?

Accepted Answer

The traffic matches the 'Allow from any to any' rule first.. Palo Alto firewalls use first-match logic: rules are evaluated top-down and the first matching rule is applied. Traffic from 10.0.1.0/24 to the internet does not match rule 1 (destination 10.0.2.0/24). Rule 2 (Allow from any to any) matches first and would permit the traffic. Therefore, the traffic should not be dropped by this rule set. Among the options, D is the only factually correct statement about which rule matches first. The drop must be due to another factor not listed, but D correctly identifies the first-match behavior.

Answer

The 'Allow from 10.0.1.0/24 to 10.0.2.0/24' rule is blocking the traffic.

Answer

The firewall's implicit deny rule is applied before any security rules.

Answer

The traffic matches the 'Deny from 10.0.1.0/24 to any' rule first.

Question 3

A firewall is using App-ID to identify applications running on non-standard ports. The administrator has configured a custom application with a default port of 8080, but traffic on port 8080 is still not being identified correctly. The application uses multiple connections on different ports. What is the most likely cause?

Accepted Answer

The application is defined with the wrong protocol (TCP vs UDP).. App-ID identification depends on the application object's protocol definition matching the actual traffic. If the custom application is defined as UDP but the application actually uses TCP (or vice versa), the firewall will not match the signature and the traffic on port 8080 will remain unidentified. The protocol field is a fundamental matching criterion, so a mismatch prevents correct App-ID classification regardless of port configuration.

Answer

The application's timeout value is too short.

Answer

Content-ID is disabled on the security policy.

Answer

The application requires URL categorization to be enabled.

Question 4

A company is deploying a Palo Alto Networks firewall in an existing Layer 2 switched environment. They need to inspect traffic between VLAN 10 and VLAN 20 without changing the IP addresses of hosts and without performing any routing. Which firewall mode should be used?

Accepted Answer

Transparent (Layer 2). Transparent (Layer 2) mode allows the firewall to operate as a Layer 2 bridge, inspecting traffic between VLAN 10 and VLAN 20 without requiring any IP address changes or routing. The firewall forwards frames based on MAC addresses, preserving the existing IP subnet and host configurations, which is ideal for inserting security into an existing switched environment.

Answer

Virtual Wire

Answer

Tap mode

Answer

Layer 3

Question 5

An organization runs a pair of Palo Alto Networks firewalls in an active/passive HA configuration. During a maintenance window, the active firewall experiences a link down event on one of its data interfaces. The passive firewall does not assume the active role. What is the most likely reason?

Accepted Answer

Path monitoring is not configured on the interfaces.. In an active/passive HA configuration, a link down event on a data interface does not automatically trigger a failover unless path monitoring is configured. Path monitoring allows the firewall to monitor the link state of specific data interfaces and initiate a failover when those interfaces go down. Without path monitoring, the passive firewall remains passive because it only monitors the HA heartbeat and the active firewall's health via the control link, not the data plane link state.

Answer

HA is configured in active/active mode, which does not support failover on link failure.

Answer

The passive firewall has lost its heartbeat connection to the active firewall.

Answer

The active firewall has a higher priority value.

Question 6

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

Accepted Answer

The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.. In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.

Answer

The firewall is using a forward trust certificate that is expired.

Answer

The decryption policy is not applied to the correct security rule.

Answer

The decryption policy is set to 'no-decrypt' for the traffic.

Question 7

Which TWO of the following are minimum required configurations to enable User-ID on a Palo Alto Networks firewall? (Choose exactly two.)

Accepted Answer

Configure a server profile for LDAP or other authentication protocol.. Option A is correct because User-ID requires a server profile that defines how the firewall connects to a directory service (LDAP, Active Directory, or other authentication protocol) to map IP addresses to usernames; without this mapping source, User-ID cannot resolve users. Option C is correct because User-ID must be enabled on the specific firewall interface(s) where user traffic is received (via the zone's User-ID setting) so the firewall can associate source IP addresses with the mapped user identities. Option B is not required because a User-ID agent is not needed on every domain controller; the firewall can use direct LDAP/AD integration or a single agent/agentless configuration. Option D is not required because captive portal is an optional authentication method for unknown users, not a minimum requirement. Option E is not required because a security policy rule using a user group is a use case for User-ID, not a prerequisite to enable it.

Answer

Deploy a User-ID agent on every domain controller.

Answer

Install a captive portal to authenticate users.

Answer

Configure a security policy rule that uses a user group as a source.

Question 8

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. Option A is correct because an active/passive HA pair requires both firewalls to be the same hardware model, ensuring identical interface layouts and consistent failover behavior. Option C is correct because both peers must run the same PAN-OS version to maintain HA compatibility and synchronized configuration/state. Option B is not required since VLAN counts can differ as long as the HA configuration and interfaces are properly matched. Option D is wrong because each firewall must have a unique management IP address; sharing one would cause an address conflict. Option E is not mandatory because HA can form with differing license subscriptions, though matching licenses are recommended for full feature parity.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 9

A network engineer configures a Source NAT policy on a Palo Alto Networks firewall to translate internal private IP addresses to the public IP of the external interface. The NAT rule is configured with source zone 'internal', destination zone 'external', and uses 'interface address' as the translated address. The associated security rule allows traffic from 'internal' to 'external' with the translated IP as the source. After committing, users cannot access the internet. Traceroute from an internal host to 8.8.8.8 shows: Hop 1: 192.168.1.1 (firewall internal IP), Hop 2: * * * (no response). The firewall's external interface has a public IP and is in the 'external' zone. What is the most likely cause of the issue?

Accepted Answer

The NAT rule's source zone is configured as 'external' instead of 'internal'.. The NAT rule's source zone must match the zone of the incoming traffic. If the source zone is set to 'external' instead of 'internal', the firewall will not apply the NAT rule to traffic arriving from the internal zone. As a result, packets are forwarded without translation, and the security rule expecting the translated IP as the source will not match, causing traffic to be dropped. The traceroute showing no response beyond the firewall's internal IP confirms that packets are not being translated or forwarded correctly.

Answer

The security rule's action is set to 'deny' for the translated IP.

Answer

The firewall's default route is missing.

Answer

The NAT rule is configured with destination zone 'any' but should be 'external'.

Question 10

A company uses a Palo Alto Networks firewall to decrypt all outbound SSL traffic. Recently, users have reported slow internet performance. The network administrator notices that the firewall's CPU utilization is consistently above 90%. The traffic logs show that a large portion of decrypted traffic is from software update services (e.g., Windows Update, Adobe, etc.) that do not require inspection. The firewall is a mid-range model with hardware decryption acceleration. What is the most effective action to reduce CPU usage while maintaining security?

Accepted Answer

Configure a decryption policy exception to exclude high-volume, low-risk services from decryption.. Excluding high-volume, low-risk services like Windows Update and Adobe updates from SSL decryption reduces the CPU load from decrypting traffic that does not require security inspection. This approach maintains security by focusing decryption resources on traffic that poses a genuine risk, while leveraging the firewall's ability to bypass decryption for trusted sources. The mid-range model's hardware deceleration is already in use, so the most effective step is to reduce the volume of decryption itself.

Answer

Increase the decryption session buffer size in the SSL/TLS proxy settings.

Answer

Enable hardware decryption offload on the firewall.

Answer

Add an additional firewall in an active/passive HA pair to distribute the decryption load.

Question 11

An organization uses GlobalProtect to provide VPN access to remote users. After connecting, users can access internal resources, but the firewall's User-ID does not show the usernames in the logs or policy matches. The GlobalProtect gateway is configured to use the authentication server for user mapping. The authentication server (LDAP) is reachable from the firewall. The firewall's User-ID settings have the 'GlobalProtect' mapping method enabled. What is the most likely reason that users are not being identified?

Accepted Answer

The GlobalProtect gateway is not configured to collect User-ID information.. The GlobalProtect gateway must have the 'Collect User-ID Information' option enabled to send user mapping data to the firewall. Without this setting, the gateway does not forward the authenticated username to the firewall's User-ID agent, so even though the authentication server is reachable and the GlobalProtect mapping method is enabled, the firewall never receives the user-to-IP mapping. This is a common misconfiguration where the gateway authenticates users but fails to propagate the identity information.

Answer

The firewall's security policies are not configured to use User-ID.

Answer

The GlobalProtect portal is not distributing the correct gateway list.

Answer

The authentication server profile is not configured with the correct bind password.

Question 12

A company has a security policy rule that allows application 'ssl' from the internal zone to the external zone. Users report that they cannot access certain HTTPS websites. Logs show that the traffic is being matched by a later rule that denies application 'web-browsing'. The administrator verifies that the target websites are using standard HTTPS (port 443). The firewall's application identification has correctly identified the traffic as 'web-browsing' instead of 'ssl'. What is the most likely reason?

Accepted Answer

The firewall's SSL decryption is enabled and re-identifies the application after decryption.. When SSL decryption is enabled, the firewall initially identifies the traffic as 'ssl' based on the SSL handshake. After decrypting the traffic, it re-inspects the HTTP payload and re-identifies the application as 'web-browsing'. This post-decryption re-identification causes the traffic to match a later rule that denies 'web-browsing', even though the initial rule allowed 'ssl'.

Answer

The application 'ssl' is only used for SSL control traffic, not encrypted payload.

Answer

The security rule is misconfigured with the source zone incorrect.

Answer

The firewall needs to have App-ID updated to recognize the websites.

Question 13

A company uses Policy-Based Forwarding (PBF) to route specific traffic from internal users to a partner network through an MPLS connection. The PBF rule is configured to match source addresses 10.1.1.0/24 and forward to a next-hop of 10.2.1.1. The administrator verifies that the MPLS router is reachable from the firewall. Traffic from the 10.1.1.0/24 network does not go through the MPLS link; instead, it takes the default route out the internet connection. Logs show that the traffic hits the PBF rule. What is the most likely issue?

Accepted Answer

The PBF rule is missing the egress interface configuration; it only specifies the next-hop IP.. A PBF rule in PAN-OS requires both a next-hop IP and an egress interface to be explicitly configured. Without the egress interface, the firewall cannot determine which physical or logical interface to use for forwarding the matched traffic, so it falls back to the default route. Even though the traffic hits the PBF rule, the missing interface configuration prevents the policy-based forwarding from taking effect.

Answer

The PBF rule's source zone is misconfigured.

Answer

The firewall's routing table does not have a route to the partner network via the MPLS router.

Answer

The PBF rule does not include a security policy to allow the traffic.

Question 14

A network security engineer is deploying a high-availability (HA) pair of Palo Alto Networks firewalls in active/passive mode. The engineer must ensure that the HA pair meets the requirements for session synchronization and failover. Which two statements are correct regarding HA configuration and operation? (Choose two.)

Accepted Answer

A floating IP address is used to provide a virtual IP that moves between HA peers during failover.. The HA2 link synchronizes session and forwarding tables, ensuring session continuity during failover. A floating IP address provides a virtual IP that moves to the active peer, allowing seamless access. The HA1 link handles control plane synchronization, not session data. Active/passive mode does not load-balance traffic; only the active firewall processes traffic. Using the management interface for HA1 backup is possible but not a primary function.

Answer

The HA1 link can be configured to use the management interface for backup synchronization.

Answer

In active/passive mode, both firewalls actively process traffic simultaneously to load-balance sessions.

Answer

The HA1 link is used for synchronization of configuration and state information between peers.

Question 15

A firewall administrator needs to control traffic destined to the firewall itself, such as SSH management access and GlobalProtect portal connections, while still allowing transit traffic between the trust and untrust zones. Which two settings must be configured to achieve this? (Choose two.)

Accepted Answer

Apply a Security policy rule with the destination zone set to the firewall's management interface zone.. Traffic destined to the firewall itself is terminated on a firewall interface, so the destination zone in the Security policy rule must be the zone assigned to that interface. For management access, that is the management interface's zone; for GlobalProtect portal connections, it is the zone of the interface where the portal is enabled. Using transit zones such as trust or untrust as the destination would not correctly match traffic that terminates on the firewall, leaving management and portal access uncontrolled or blocked.

Answer

Apply a Security policy rule with the destination zone set to the untrust zone for GlobalProtect portal connections.

Answer

Apply a Security policy rule with the destination zone set to the untrust zone for management traffic.

Answer

Apply a Security policy rule with the destination zone set to the trust zone for management traffic.