PCNSE Core Concepts and Architecture Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are true regarding Panorama's templates and device groups?

Accepted Answer

Templates are used to push network configurations such as interfaces, virtual routers, and zones.. Templates in Panorama are specifically designed to manage network-level configurations, including interfaces, virtual routers, zones, and other data-plane settings. This separation allows administrators to apply consistent network settings across multiple firewalls while using device groups for policy-based configurations.

Answer

Device groups can only contain firewalls of the same model.

Answer

Templates override device group settings when both are applied.

Answer

Panorama cannot manage firewalls in different geographic locations.

Question 2

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. DNS Security and WildFire are cloud-delivered services that require an active internet connection to the Palo Alto Networks cloud for real-time analysis and signature retrieval. Unlike local threat prevention, these services offload processing to the cloud, enabling detection of unknown threats without consuming firewall resources.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 3

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. The firewall's management plane (MP) includes a local log storage partition that can hold logs (e.g., traffic, threat, system) and allows export via the web interface (Monitor > Logs > Export). This provides a built-in method for log collection without requiring external infrastructure. Option E is correct because syslog (UDP/TCP, RFC 3164 or RFC 5424) is a standard protocol supported by Palo Alto firewalls to forward all log types to an external collector for centralized reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 4

A company is deploying a Palo Alto Networks firewall in an existing Layer 2 switched environment. They need to inspect traffic between VLAN 10 and VLAN 20 without changing the IP addresses of hosts and without performing any routing. Which firewall mode should be used?

Accepted Answer

Transparent (Layer 2). Transparent (Layer 2) mode allows the firewall to operate as a Layer 2 bridge, inspecting traffic between VLAN 10 and VLAN 20 without requiring any IP address changes or routing. The firewall forwards frames based on MAC addresses, preserving the existing IP subnet and host configurations, which is ideal for inserting security into an existing switched environment.

Answer

Virtual Wire

Answer

Tap mode

Answer

Layer 3

Question 5

An organization runs a pair of Palo Alto Networks firewalls in an active/passive HA configuration. During a maintenance window, the active firewall experiences a link down event on one of its data interfaces. The passive firewall does not assume the active role. What is the most likely reason?

Accepted Answer

Path monitoring is not configured on the interfaces.. In an active/passive HA configuration, a link down event on a data interface does not automatically trigger a failover unless path monitoring is configured. Path monitoring allows the firewall to monitor the link state of specific data interfaces and initiate a failover when those interfaces go down. Without path monitoring, the passive firewall remains passive because it only monitors the HA heartbeat and the active firewall's health via the control link, not the data plane link state.

Answer

HA is configured in active/active mode, which does not support failover on link failure.

Answer

The passive firewall has lost its heartbeat connection to the active firewall.

Answer

The active firewall has a higher priority value.

Question 6

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

Accepted Answer

The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.. In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.

Answer

The firewall is using a forward trust certificate that is expired.

Answer

The decryption policy is not applied to the correct security rule.

Answer

The decryption policy is set to 'no-decrypt' for the traffic.

Question 7

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

Accepted Answer

The firewalls that are not receiving the template are not included in the same template stack.. In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Answer

The device group has not been committed.

Answer

The firewalls are not licensed for Panorama management.

Answer

The template is in 'preview' mode.

Question 8

Which TWO of the following are minimum required configurations to enable User-ID on a Palo Alto Networks firewall? (Choose exactly two.)

Accepted Answer

Configure a server profile for LDAP or other authentication protocol.. A is correct because User-ID requires a server profile (e.g., LDAP, Kerberos, or a WMI-based agent) to query the directory service for user-to-IP mappings. Without this profile, the firewall cannot resolve usernames from authentication events or directory lookups, which is the foundational step for User-ID functionality.

Answer

Deploy a User-ID agent on every domain controller.

Answer

Install a captive portal to authenticate users.

Answer

Configure a security policy rule that uses a user group as a source.

Question 9

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. For an active/passive HA pair, both firewalls must be the same hardware model to ensure identical hardware resources (e.g., CPU, memory, ASICs) and port layouts. This is a mandatory requirement because the HA synchronization process relies on matching hardware capabilities to avoid configuration mismatches and failover failures.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 10

Which THREE of the following are core components of the GlobalProtect solution? (Choose exactly three.)

Accepted Answer

GlobalProtect Gateway. The GlobalProtect solution is built on three core components: the GlobalProtect Portal, GlobalProtect Gateway, and GlobalProtect Client. The Portal manages configuration and authentication, the Gateway provides secure access to internal resources, and the Client is the endpoint software that establishes VPN tunnels. These three work together to enforce security policies and enable remote access.

Answer

GlobalProtect License Server

Answer

GlobalProtect Mobile App

Question 11

A network engineer configures a Source NAT policy on a Palo Alto Networks firewall to translate internal private IP addresses to the public IP of the external interface. The NAT rule is configured with source zone 'internal', destination zone 'external', and uses 'interface address' as the translated address. The associated security rule allows traffic from 'internal' to 'external' with the translated IP as the source. After committing, users cannot access the internet. Traceroute from an internal host to 8.8.8.8 shows: Hop 1: 192.168.1.1 (firewall internal IP), Hop 2: * * * (no response). The firewall's external interface has a public IP and is in the 'external' zone. What is the most likely cause of the issue?

Accepted Answer

The NAT rule's source zone is configured as 'external' instead of 'internal'.. The NAT rule's source zone must match the zone of the incoming traffic. If the source zone is set to 'external' instead of 'internal', the firewall will not apply the NAT rule to traffic arriving from the internal zone. As a result, packets are forwarded without translation, and the security rule expecting the translated IP as the source will not match, causing traffic to be dropped. The traceroute showing no response beyond the firewall's internal IP confirms that packets are not being translated or forwarded correctly.

Answer

The security rule's action is set to 'deny' for the translated IP.

Answer

The firewall's default route is missing.

Answer

The NAT rule is configured with destination zone 'any' but should be 'external'.

Question 12

A company uses a Palo Alto Networks firewall to decrypt all outbound SSL traffic. Recently, users have reported slow internet performance. The network administrator notices that the firewall's CPU utilization is consistently above 90%. The traffic logs show that a large portion of decrypted traffic is from software update services (e.g., Windows Update, Adobe, etc.) that do not require inspection. The firewall is a mid-range model with hardware decryption acceleration. What is the most effective action to reduce CPU usage while maintaining security?

Accepted Answer

Configure a decryption policy exception to exclude high-volume, low-risk services from decryption.. Excluding high-volume, low-risk services like Windows Update and Adobe updates from SSL decryption reduces the CPU load from decrypting traffic that does not require security inspection. This approach maintains security by focusing decryption resources on traffic that poses a genuine risk, while leveraging the firewall's ability to bypass decryption for trusted sources. The mid-range model's hardware deceleration is already in use, so the most effective step is to reduce the volume of decryption itself.

Answer

Increase the decryption session buffer size in the SSL/TLS proxy settings.

Answer

Enable hardware decryption offload on the firewall.

Answer

Add an additional firewall in an active/passive HA pair to distribute the decryption load.

Question 13

An organization uses GlobalProtect to provide VPN access to remote users. After connecting, users can access internal resources, but the firewall's User-ID does not show the usernames in the logs or policy matches. The GlobalProtect gateway is configured to use the authentication server for user mapping. The authentication server (LDAP) is reachable from the firewall. The firewall's User-ID settings have the 'GlobalProtect' mapping method enabled. What is the most likely reason that users are not being identified?

Accepted Answer

The GlobalProtect gateway is not configured to collect User-ID information.. The GlobalProtect gateway must have the 'Collect User-ID Information' option enabled to send user mapping data to the firewall. Without this setting, the gateway does not forward the authenticated username to the firewall's User-ID agent, so even though the authentication server is reachable and the GlobalProtect mapping method is enabled, the firewall never receives the user-to-IP mapping. This is a common misconfiguration where the gateway authenticates users but fails to propagate the identity information.

Answer

The firewall's security policies are not configured to use User-ID.

Answer

The GlobalProtect portal is not distributing the correct gateway list.

Answer

The authentication server profile is not configured with the correct bind password.

Question 14

A company has a security policy rule that allows application 'ssl' from the internal zone to the external zone. Users report that they cannot access certain HTTPS websites. Logs show that the traffic is being matched by a later rule that denies application 'web-browsing'. The administrator verifies that the target websites are using standard HTTPS (port 443). The firewall's application identification has correctly identified the traffic as 'web-browsing' instead of 'ssl'. What is the most likely reason?

Accepted Answer

The firewall's SSL decryption is enabled and re-identifies the application after decryption.. When SSL decryption is enabled, the firewall initially identifies the traffic as 'ssl' based on the SSL handshake. After decrypting the traffic, it re-inspects the HTTP payload and re-identifies the application as 'web-browsing'. This post-decryption re-identification causes the traffic to match a later rule that denies 'web-browsing', even though the initial rule allowed 'ssl'.

Answer

The application 'ssl' is only used for SSL control traffic, not encrypted payload.

Answer

The security rule is misconfigured with the source zone incorrect.

Answer

The firewall needs to have App-ID updated to recognize the websites.

Question 15

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.