PCNSE Core Concepts and Architecture Practice Test 3 — 15 Questions

Question 1

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use link monitoring instead of path monitoring. Link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described. Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.

Answer

Decrease the path monitoring interval

Answer

HA1 backup link

Answer

Enable pre-emptive mode

Question 2

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 3

Which TWO components are part of the PAN-OS management plane?

Accepted Answer

Log collection and reporting. Log collection and reporting is a function of the management plane in PAN-OS. The management plane handles all non-traffic-forwarding tasks, including logging, configuration management, and reporting. This is distinct from the data plane, which processes actual network traffic.

Answer

SSL decryption engine

Answer

Packet buffer

Answer

App-ID engine

Question 4

Which THREE are valid methods for User-ID mapping in PAN-OS?

Accepted Answer

DHCP snooping. DHCP snooping is a valid User-ID mapping method because the PAN-OS firewall can act as a DHCP snooping device, listening to DHCPACK messages from the DHCP server. By extracting the client IP address and MAC address from these packets, the firewall can map the IP to a username if the MAC is known via other means (e.g., Active Directory). This method is agentless and works well in environments where DHCP is used for IP address assignment.

Answer

Netflow collection

Answer

SNMP traps

Question 5

Which TWO statements correctly describe the role of the data plane in PAN-OS architecture?

Accepted Answer

It performs content inspection.. The data plane performs content inspection, including threat prevention, URL filtering, and application identification, using the single-pass software architecture to scan traffic in real time. This is a core function of the data plane, separate from the control and management planes.

Answer

It runs routing protocols like OSPF.

Answer

It stores log files.

Answer

It manages the web interface and CLI.

Question 6

Refer to the exhibit. What does the serial number '0123456789' indicate?

Accepted Answer

The unique hardware identifier for licensing and support. The serial number '0123456789' is a unique hardware identifier assigned to each Palo Alto Networks firewall during manufacturing. It is used for licensing, support entitlement, and device identification in the Palo Alto Networks support portal, not for network-level addressing or software versioning.

Answer

The MAC address of the management interface

Answer

The model number of the firewall

Answer

The firmware version installed

Question 7

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Accepted Answer

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.. The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer

The service 'application-default' does not allow TCP port 443.

Answer

The packet is not logged properly.

Answer

The destination IP is not routable in the virtual router.

Question 8

A company has configured a security policy that allows HTTP traffic from the internal network 10.0.0.0/8 to the internet. However, users from subnet 10.2.0.0/24 are unable to access external websites. The firewall logs show that traffic from 10.2.0.100 to 203.0.113.1 on port 80 is being denied. Which action should the administrator take to resolve the issue?

Accepted Answer

Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.. In a stateful firewall like Palo Alto Networks, security rules are evaluated in order from top to bottom, and the first matching rule is applied. If a deny rule exists above any allow rule for the 10.2.0.0/24 subnet, traffic from that subnet will be denied. Adding a new allow rule for 10.2.0.0/24 and placing it above the existing deny rule ensures that HTTP traffic from that subnet is permitted before reaching the deny rule.

Answer

Modify the existing allow rule to include the entire 10.2.0.0/24 subnet in the source.

Answer

Change the destination zone of the allow rule to 'any'.

Answer

Delete the deny rule that is blocking the traffic.

Question 9

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

Accepted Answer

Exclude known high-traffic sites from decryption.. Excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Answer

Increase the SSL session cache to 1024.

Answer

Upgrade the firewall to a higher model.

Answer

Enable SSL session re-use.

Question 10

A multinational organization uses a pair of PA-5250 firewalls in an active/passive high-availability configuration across two data centers. They need to ensure that all management traffic (SSH, HTTPS) to the firewalls is encrypted and sourced only from a dedicated management network (10.10.0.0/24). Which configuration meets these requirements?

Accepted Answer

Configure an interface management profile allowing SSH and HTTPS only from 10.10.0.0/24 and apply it to the management interface.. An interface management profile restricts allowed management services (SSH, HTTPS) to specific source IP addresses or subnets, and applying it to the management interface ensures only traffic from 10.10.0.0/24 can reach the firewall for encrypted management. This directly meets the requirement for encryption (SSH/HTTPS are inherently encrypted) and source restriction without relying on security policies, which do not control management-plane access.

Answer

Configure the firewall to use a dedicated management port and enable IP whitelisting in device settings.

Answer

Use a loopback interface with an IP from the management subnet and attach an interface management profile.

Answer

Create a security policy allowing management access from 10.10.0.0/24 to the firewall's IP addresses.

Question 11

Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?

Accepted Answer

Deny the traffic because rule 1 matches first.. The firewall processes security rules in top-down order. Rule 1 explicitly denies traffic from the internal zone to the destination zone 'untrust-L3' for destination IP 203.0.113.1, which matches the user's traffic. Since rule 1 is matched first, the firewall denies the traffic and does not evaluate subsequent rules.

Answer

Drop the traffic because no rule matches.

Answer

Allow the traffic because rule 2 matches.

Answer

Reset the traffic because of rule 1.

Question 12

Refer to the exhibit. A user attempts to access a banking site (category: finance) over HTTPS. What will happen?

Accepted Answer

The traffic is not decrypted because the second rule matches and overrides the first.. The firewall processes security rules from top to bottom, and the second rule explicitly matches HTTPS traffic to the finance category with an action of 'No Decrypt'. Since the second rule matches before any decryption rule, it overrides the first rule's decrypt action, and the traffic is not decrypted.

Answer

The traffic is decrypted because the first rule matches.

Answer

The traffic is dropped because no rule matches.

Answer

The traffic is decrypted only if the SSL certificate is installed.

Question 13

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

Accepted Answer

The session was idle for longer than the timeout threshold.. The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Answer

The session was terminated by a firewall policy.

Answer

The session was forcibly closed by an administrator.

Answer

The session ended due to a TCP FIN/RST from the client.

Question 14

Which two are valid methods for collecting User-ID information on a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Active Directory agent. The Active Directory agent is a dedicated software component that integrates with Microsoft Active Directory to map user logon events to IP addresses, providing real-time User-ID information to the firewall. Option E is correct because Captive Portal actively authenticates users via browser-based or agent-based authentication, associating their IP address with a username upon successful login, which is a direct method for collecting User-ID data.

Answer

Syslog parsing

Answer

Email gateway

Answer

SNMP trap

Question 15

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Accepted Answer

Both firewalls must be the same hardware model.. Palo Alto Networks high-availability (HA) active/passive pairs require both firewalls to be the same hardware model to ensure identical processing capabilities and interface configurations. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration synchronization and stateful failover compatibility; version mismatches can cause HA session sync failures or unexpected behavior.

Answer

Both firewalls must have identical licenses.

Answer

Both firewalls must be in the same data center.

Answer

The firewalls must be directly connected via a crossover cable for HA1.