PCNSE Core Concepts and Architecture Practice Test 4 — 15 Questions

Question 1

A security administrator is configuring a Palo Alto Networks firewall to protect a web server farm. The administrator wants to ensure that the firewall can detect and prevent attacks that exploit vulnerabilities in web applications, such as SQL injection and cross-site scripting. Which Palo Alto Networks security service provides this protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Prevention. Threat Prevention includes vulnerability signatures that detect and block web application attacks such as SQL injection and XSS. URL Filtering, WildFire, and DNS Security serve different purposes and do not provide the deep packet inspection needed for these exploits. Enabling Threat Prevention ensures that the firewall can protect the web server farm from application-layer attacks.

Answer

URL Filtering

Answer

DNS Security

Answer

WildFire

Question 2

A network security engineer is deploying a PA-5220 firewall in a data center. The design requires that the management plane and data plane use separate physical interfaces, and that management traffic cannot be reached through any data plane interface. Which configuration on the PA-5220 achieves this requirement?

Accepted Answer

Use a dedicated out-of-band management port (MGT) and keep the management plane separate from the data plane by not configuring any data plane interface as a management interface.. The dedicated MGT interface on PA-5200 Series firewalls is physically separate from data plane interfaces and is not part of any security zone. Management plane services such as HTTPS, SSH, and SNMP are bound to the MGT interface, and data plane interfaces cannot be used for management access. Using the MGT port therefore satisfies the requirement for separate management and data plane paths.

Answer

Configure a loopback interface with a management profile and use it for all management access, while leaving the MGT interface unconfigured.

Answer

Assign the management interface to a dedicated management zone and configure a security policy to deny traffic from any data plane zone to that zone.

Answer

Enable the Management Interface Permitted IPs list to include only the data center management subnet, and connect the MGT interface to that subnet.

Question 3

A network engineer is reviewing the packet processing path on a PA-5220 running PAN-OS 11.1. A TCP SYN packet arrives on the untrust zone and is destined for a web server in the DMZ zone. No session currently exists. Which single lookup occurs FIRST in the packet processing pipeline for this packet?

Accepted Answer

Session table lookup based on the packet's 5-tuple. PAN-OS processes every packet by first performing a session table lookup using the packet's 5-tuple. If no session exists, the firewall creates a new session and then evaluates zone-based policies, App-ID, and the security rulebase. Session lookup is the foundational first step because stateful inspection requires the firewall to track flows and apply consistent policy to all packets in a session.

Answer

Application identification (App-ID) and Content-ID decoders

Answer

Security policy rulebase lookup

Answer

Zone-based protection profile evaluation

Question 4

A security administrator is configuring a Palo Alto Networks firewall to protect a web server farm. The administrator wants to ensure that the firewall can detect and prevent attacks that exploit vulnerabilities in web applications, such as SQL injection and cross-site scripting. Which Palo Alto Networks security service provides this protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security policy rule needs to allow the 'ssl' application because 'web-browsing' depends on it for HTTPS traffic.. The 'web-browsing' application depends on 'ssl' for HTTPS traffic. When a user initiates an HTTPS connection, the firewall must first allow the 'ssl' application to complete the SSL handshake. If only 'web-browsing' is allowed, the connection fails. Therefore, the policy must include both applications to permit HTTPS web browsing. This dependency is a key concept in Palo Alto Networks application identification and policy enforcement.

Answer

The security policy rule must include the 'quic' application to allow modern web traffic.

Answer

The security policy rule does not include the 'ssl' application.

Answer

The security policy rule must be configured with a URL filtering profile to allow HTTPS sites.

Question 5

An administrator is configuring a Palo Alto Networks firewall to perform user identification. The administrator wants to map IP addresses to usernames without installing an agent on the domain controllers. Which method should be used?

Accepted Answer

Configure the firewall to receive syslog messages from domain controllers that include login events.. To map IP addresses to usernames without installing an agent on domain controllers, the firewall can be configured to receive syslog messages from domain controllers. These syslog messages contain login events, and the firewall parses them to create User-ID mappings. This method is agentless on the domain controllers and is supported by PAN-OS.

Answer

Use the User-ID Agent installed on a server that reads Windows Security event logs.

Answer

Enable the User-ID feature on the firewall and point it to the Active Directory server using the PAN-OS XML API.

Answer

Configure the firewall to query the Global Catalog server using LDAP.

Question 6

A firewall administrator needs to ensure that a specific application is allowed only for a group of users in the marketing department, while all other users are denied access to that application. The marketing users are already mapped by User-ID. Which type of policy object should the administrator use to identify the marketing users in the security rule?

Accepted Answer

An LDAP group that is imported into the firewall and referenced in the security policy source user field.. User-ID enables policies based on users and groups rather than just IP addresses. When an LDAP group is imported or discovered through User-ID, it can be referenced directly in the source user field of a security policy. This allows the firewall to allow the application only for members of the marketing group and deny it for everyone else, with group membership maintained automatically through the directory integration.

Answer

A static user group object that is manually populated with the marketing users and referenced in the security policy source user field.

Answer

A dynamic user group that is populated by an LDAP group mapping and referenced in the security policy source user field.

Answer

A local user group created on the firewall and referenced in the security policy source user field.

Question 7

A security administrator is configuring a Palo Alto Networks firewall to protect a web server farm. The administrator wants to ensure that the firewall can detect and prevent attacks that exploit vulnerabilities in web applications, such as SQL injection and cross-site scripting. Which Palo Alto Networks security service provides this protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server Monitoring. User-ID can be collected through several methods: Server Monitoring, which parses directory server logs; GlobalProtect, which maps VPN users; User-ID agents (both Windows-based and firewall-based); and Terminal Services agents. Server Monitoring and GlobalProtect are two valid methods. Syslog Forwarding, SNMP Traps, and XML API are not collection methods; they serve other purposes such as logging, monitoring, and management.

Answer

XML API

Answer

Syslog Forwarding

Answer

SNMP Traps

Question 8

A network security engineer is designing a security policy for a Palo Alto Networks firewall. The engineer wants to allow only specific applications while blocking all others, and also wants to log all traffic that matches the rule. Which of the following security policy actions should the engineer use to achieve this?

Accepted Answer

Allow with Application and a subsequent Deny rule. To allow only specific applications and block all others, the engineer needs an Allow rule for the desired applications and a Deny rule for everything else. The Allow rule permits the specific applications, and the Deny rule blocks the rest. Both rules can log traffic. Application Filters could be used but might allow more than intended. The Allow action alone does not block other applications, and Deny alone does not allow. Therefore, the combination of Allow and Deny rules is required.

Answer

Deny

Answer

Allow

Answer

Allow with Application Filters

Question 9

A company has a Palo Alto Networks firewall deployed at the perimeter. The security team wants to enforce a policy that allows users to access social media sites but only for business purposes. They want to ensure that personal use of social media is blocked. Which Palo Alto Networks feature allows the firewall to differentiate between business and personal use of social media applications?

Accepted Answer

Content-ID with data filtering. Content-ID with data filtering inspects the content within allowed applications to detect specific data patterns. By applying data filtering to social media applications, the firewall can block posts or messages that contain sensitive data, effectively enforcing business-only use. App-ID, User-ID, and SSL Decryption with URL filtering do not provide this level of content-based control. Thus, Content-ID with data filtering is the correct feature.

Answer

User-ID with user-based policies

Answer

SSL Decryption with URL filtering

Answer

App-ID with application filters

Question 10

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Accepted Answer

Create separate virtual systems (VSYS) for each tenant on the same firewall.. Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Answer

Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

Answer

Use active/active HA mode to assign each tenant to a different firewall.

Answer

Configure multiple virtual routers (VRFs) within the same virtual system.

Question 11

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 12

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

Accepted Answer

Increased packet drops due to buffer exhaustion.. When dataplane packet buffer usage exceeds 90% during a traffic spike, the firewall's packet buffers are nearly exhausted, leading to a condition where incoming packets cannot be stored temporarily for processing. This directly causes packet drops because the dataplane has no available buffers to enqueue new packets, even though CPU utilization remains low. Option D correctly identifies this as the primary impact, as buffer exhaustion results in tail-drop behavior for new packets.

Answer

Reduced new session setup rate.

Answer

Reduced committed information rate (CIR) on QoS policies.

Answer

Increased latency for management access.

Question 13

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Accepted Answer

Define a custom application with the appropriate protocol, port, and optionally a signature.. When a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Answer

Create a security policy rule with an application override to match the port.

Answer

Enable SSL decryption on the traffic to inspect encrypted payloads.

Answer

Add the port to the default application's 'port' field in the application object.

Question 14

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

Accepted Answer

Panorama without Log Collectors. Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Answer

Panorama with Dedicated Log Collectors

Answer

Panorama with Log Collectors

Answer

Panorama in High Availability mode

Question 15

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering