PCNSE Core Concepts and Architecture Practice Test 4 — 15 Questions

Question 1

Which three are valid security policy rule actions on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Deny. (Deny) is correct because security policy rules on Palo Alto Networks firewalls use 'Deny' as a valid action to silently discard traffic without sending a TCP RST or ICMP unreachable message. This action is used when you want to block traffic while providing no feedback to the sender, which is common for stealth or compliance policies.

Answer

Log

Answer

Forward

Question 2

An administrator needs to allow FTP traffic from the internal network to an external server. The firewall is configured with a security policy that has the application 'ftp' and service 'service-http'. What is the most likely cause of the traffic being denied?

Accepted Answer

The service object in the rule is set to service-http, which does not match FTP traffic.. The security policy's service object is set to 'service-http' (TCP port 80), but FTP traffic uses TCP port 21 for control and TCP port 20 for data. In Palo Alto Networks firewalls, the service object defines the destination port for the traffic; if it does not match the actual port used by the application, the firewall will deny the session even if the application is correctly identified. The mismatch between the service and the application's expected port causes the traffic to be blocked.

Answer

The source address is wrong.

Answer

The application is incorrectly set to ftp.

Answer

The rule is not enabled.

Question 3

A company uses Panorama to manage multiple firewalls. They want to push a security policy that applies to all firewalls but with a specific exception for one firewall in a different region. Which Panorama method should be used?

Accepted Answer

Use a shared policy and override the rule on the specific device group.. Panorama allows a shared policy to be pushed to all firewalls, and you can override a specific rule for a particular device group. By placing the exception rule in the device group that contains the firewall in the different region, you can override the shared policy for that firewall while the rest continue to use the shared policy. This maintains centralized management while accommodating regional exceptions.

Answer

Use a post-rule in the device group.

Answer

Use a device-specific pre-rule.

Answer

Use a template variable.

Question 4

A security engineer is troubleshooting a connectivity issue where traffic from a specific internal host is allowed by security policy but fails to establish a connection to an external server. The firewall logs show the session was created, but no response packets are seen. What is the most likely cause?

Accepted Answer

The source NAT is not configured.. When traffic from an internal host is allowed by security policy and the session is created but no response packets are seen, the most likely cause is that source NAT (also known as outbound NAT or PAT) is not configured. Without source NAT, the firewall forwards the packet with the internal private IP address as the source, and the external server sends responses back to that private address, which is not routable over the public internet. The firewall sees the session as created because it matched the security policy and forwarded the initial packet, but the return traffic never reaches the firewall, so no response packets are logged.

Answer

The destination NAT is configured incorrectly.

Answer

The security policy is missing the return traffic rule.

Answer

The firewall is in FIPS mode.

Question 5

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 6

A Palo Alto Networks firewall is configured with multiple virtual routers. Traffic between two different virtual routers is not being forwarded. What is required to enable routing between them?

Accepted Answer

Enable inter-VR routing with a security policy.. By default, Palo Alto Networks firewalls isolate traffic between virtual routers (VRs) to enforce segmentation. To allow inter-VR routing, you must explicitly enable it by creating a security policy that permits the traffic between the zones associated with each VR. This policy acts as the routing decision point, allowing the firewall to forward packets from one VR to another.

Answer

Configure a zone protection profile.

Answer

Configure a static route between the virtual routers.

Answer

Use a virtual wire to connect them.

Question 7

An organization uses GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show that the traffic from the GlobalProtect IP pool to internal servers is allowed. What is the most likely cause?

Accepted Answer

The internal server's default gateway does not point to the firewall.. The most likely cause is that the internal server's default gateway does not point to the firewall. When GlobalProtect clients receive an IP from the VPN IP pool and send traffic to internal servers, the servers must send return traffic back through the firewall to maintain stateful session symmetry. If the server's default gateway points elsewhere (e.g., a core switch), the firewall drops the return traffic because it does not match an existing session, causing connectivity failure despite the firewall logs showing allowed outbound traffic.

Answer

The GlobalProtect gateway is not configured with a route to internal network.

Answer

The client's VPN adapter is not set to use the default gateway on the remote network.

Answer

The security policy for internal traffic is misconfigured.

Question 8

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. Traffic fails over correctly, but after a failover, existing sessions from external users to internal servers are broken. The security team wants to prevent this disruption. Which feature must be enabled?

Accepted Answer

Session State Synchronization. Session State Synchronization (option C) is required because it ensures that session table entries—including TCP state, sequence numbers, and application-layer metadata—are replicated from the active firewall to the passive firewall in real time. Without this, after a failover, the newly active firewall has no knowledge of existing sessions, causing it to drop packets and forcing clients to re-establish connections. This feature is specifically designed to maintain stateful session continuity during HA failovers.

Answer

Link Monitoring

Answer

Virtual Router Redundancy

Answer

Path Monitoring

Question 9

An organization is implementing SSL Forward Proxy decryption to inspect outbound HTTPS traffic. They want to exclude traffic to specific internal applications that cannot handle decryption due to certificate pinning. The firewall is configured with a decryption policy that decrypts all traffic from the internal network to the internet. To exclude the pinned applications, which approach is best practice?

Accepted Answer

Create a custom URL category for the applications and add it to a decryption policy rule with action 'no-decrypt'.. Creating a custom URL category for the pinned applications and referencing it in a decryption policy rule with action 'no-decrypt' is the best practice for excluding specific traffic from SSL Forward Proxy decryption. This approach allows the firewall to selectively bypass decryption based on the destination URL, which is more granular and manageable than IP-based exceptions, and it aligns with the decryption policy's ability to match traffic by URL category.

Answer

Configure an SSL/TLS Service Profile with an exception list for the destination IPs.

Answer

Use GlobalProtect client settings to bypass decryption for the pinned applications.

Answer

Reduce the SSL/TLS protocol version on the decryption policy to cause fail-closed for those applications.

Question 10

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

Accepted Answer

A security policy allowing traffic between the zones associated with the virtual routers. In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Answer

Redistribution of routes between the virtual routers

Answer

Enabling packet forwarding on the virtual router interfaces

Answer

A static route on both virtual routers pointing to each other's subnets

Question 11

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 12

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 13

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

Accepted Answer

Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.. When internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Answer

Create a policy-based forwarding (PBF) rule to send the traffic to the server.

Answer

Add a security policy allowing traffic from internal zone to the public IP.

Answer

Add a static route on the firewall for the public IP pointing to the internal server.

Question 14

A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?

Accepted Answer

Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.. The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.

Answer

Enable IKE on the management interface.

Answer

Enable User-ID on the management interface.

Answer

Configure a service route to redirect management traffic to a dataplane interface.

Question 15

A firewall is using App-ID to identify applications running on non-standard ports. The administrator has configured a custom application with a default port of 8080, but traffic on port 8080 is still not being identified correctly. The application uses multiple connections on different ports. What is the most likely cause?

Accepted Answer

The application is defined with the wrong protocol (TCP vs UDP).. Custom applications require both a default port and a protocol type (TCP/UDP). If the protocol is not specified correctly (e.g., TCP instead of UDP or vice versa), App-ID may fail to identify the traffic even if the port matches. Option A (timeout setting) affects session termination but not identification. Option C (Content-ID disabled) affects file analysis and threat detection, not basic App-ID identification. Option D (URL categorization required) is only relevant for HTTP-based applications and not for general application identification. Therefore, the most likely cause is that the application is defined with the wrong protocol.

Answer

The application's timeout value is too short.

Answer

Content-ID is disabled on the security policy.

Answer

The application requires URL categorization to be enabled.