PCNSE Core Concepts and Architecture Practice Test 6 — 15 Questions

Question 1

An organization is implementing SSL Forward Proxy decryption to inspect outbound HTTPS traffic. They want to exclude traffic to specific internal applications that cannot handle decryption due to certificate pinning. The firewall is configured with a decryption policy that decrypts all traffic from the internal network to the internet. To exclude the pinned applications, which approach is best practice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom URL category for the applications and add it to a decryption policy rule with action 'no-decrypt'.. Creating a custom URL category for the pinned applications and referencing it in a decryption policy rule with action 'no-decrypt' is the best practice for excluding specific traffic from SSL Forward Proxy decryption. This approach allows the firewall to selectively bypass decryption based on the destination URL, which is more granular and manageable than IP-based exceptions, and it aligns with the decryption policy's ability to match traffic by URL category.

Answer

Configure an SSL/TLS Service Profile with an exception list for the destination IPs.

Answer

Use GlobalProtect client settings to bypass decryption for the pinned applications.

Answer

Reduce the SSL/TLS protocol version on the decryption policy to cause fail-closed for those applications.

Question 2

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

Accepted Answer

A security policy allowing traffic between the zones associated with the virtual routers. In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Answer

Redistribution of routes between the virtual routers

Answer

Enabling packet forwarding on the virtual router interfaces

Answer

A static route on both virtual routers pointing to each other's subnets

Question 3

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 4

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

Accepted Answer

The User-ID agent is not configured with the correct domain credentials or domain name.. The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Answer

Panorama must be used to distribute User-ID configurations.

Answer

The firewall's DNS settings are incorrect, preventing user lookup.

Answer

The user-id mapping timeout is set too low.

Question 5

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

Accepted Answer

Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.. When internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Answer

Create a policy-based forwarding (PBF) rule to send the traffic to the server.

Answer

Add a security policy allowing traffic from internal zone to the public IP.

Answer

Add a static route on the firewall for the public IP pointing to the internal server.

Question 6

A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?

Accepted Answer

Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.. The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.

Answer

Enable IKE on the management interface.

Answer

Enable User-ID on the management interface.

Answer

Configure a service route to redirect management traffic to a dataplane interface.

Question 7

Which TWO of the following are true regarding Panorama's templates and device groups?

Accepted Answer

Templates are used to push network configurations such as interfaces, virtual routers, and zones.. Option B is correct because Panorama templates are specifically designed to push network-level configuration to managed firewalls, including interfaces, virtual routers, zones, and other network settings, which is their primary purpose. Option E is correct because Panorama includes a predefined 'Shared' device group at the top of the device group hierarchy, and policies defined there are inherited by all other device groups below it. Option A is incorrect because device groups can contain firewalls of different models, as long as they run compatible PAN-OS versions; model homogeneity is not required. Option C is incorrect because templates and device groups operate on different configuration scopes (network vs. policy/objects) and do not override each other in that manner. Option D is incorrect because Panorama can manage firewalls across different geographic locations, which is one of its key centralized-management benefits.

Answer

Device groups can only contain firewalls of the same model.

Answer

Templates override device group settings when both are applied.

Answer

Panorama cannot manage firewalls in different geographic locations.

Question 8

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. Option B is correct because CDSS subscriptions such as DNS Security and WildFire are cloud-hosted services that the firewall must reach over the internet to submit files/URLs and retrieve verdicts, unlike purely on-box inspection. Option C is correct because the architectural split is that CDSS performs cloud-based threat analysis and delivers dynamic signature/content updates, while the NGFW remains the inline enforcement point that applies policy and blocks traffic. Option E is correct because CDSS aggregates telemetry from all subscribed firewalls and pushes newly derived threat intelligence back out globally, giving every firewall protection from threats seen anywhere. Option A is not correct because full application-level packet inspection is done by the NGFW's App-ID engine on the firewall itself, not by CDSS. Option D is not correct because CDSS augments rather than replaces the firewall's local threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) capabilities.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 9

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. Option B is correct because the firewall's management plane (MP) can retain logs locally on its management disk, and administrators can retrieve them through the web interface (or CLI) for reporting and forensic review. Option E is correct because the firewall natively supports forwarding logs via syslog to external log collectors (e.g., a syslog server or Panorama in log-collector mode), which is a standard method for centralized reporting and forensics. Option A is not valid because Azure Sentinel does not ingest Palo Alto logs directly without an intermediate, such as a syslog forwarder, Log Analytics agent, or CEF connector. Option C is incorrect because SNMPv3 traps are used for monitoring/alerting on MIB objects, not for transporting full log records of all log types. Option D is incorrect because email alerts are notification-only and do not provide a complete, structured log collection mechanism for reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 10

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

Accepted Answer

The firewalls that are not receiving the template are not included in the same template stack.. In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Answer

The device group has not been committed.

Answer

The firewalls are not licensed for Panorama management.

Answer

The template is in 'preview' mode.

Question 11

Which THREE of the following are core components of the GlobalProtect solution? (Choose exactly three.)

Accepted Answer

GlobalProtect Gateway. The three core components of the GlobalProtect solution are the GlobalProtect Portal (E), the GlobalProtect Gateway (B), and the GlobalProtect Client (C). The GlobalProtect Portal (E) is the web-based interface that authenticates end users, distributes the GlobalProtect agent/app and its configuration, and provides the list of available gateways. The GlobalProtect Gateway (B) is the security appliance (firewall or Prisma Access) that terminates the tunnels and enforces security policy, providing access to internal resources. The GlobalProtect Client (C) is the agent software installed on endpoints (Windows, macOS, Linux, iOS, Android) that connects to the portal and gateway to establish the VPN connection. The GlobalProtect License Server (A) is not a core component; licensing is managed through the firewall or Panorama, not a separate license server. The GlobalProtect Mobile App (D) is not a distinct core component — mobile support is delivered via the GlobalProtect Client (the app is simply the client for mobile platforms), so it is not counted separately.

Answer

GlobalProtect License Server

Answer

GlobalProtect Mobile App

Question 12

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.

Question 13

A network security engineer is designing a multi-vsys Palo Alto Networks firewall deployment to provide both advanced security and virtual routing separation for three different departments. Each department requires its own routing table and separate security policy enforcement. The engineer must decide which component is responsible for enforcing security policies and providing threat inspection across all virtual systems. Which component of the Palo Alto Networks Next-Generation Firewall performs this function?

Accepted Answer

The dataplane. The dataplane is the core processing engine that enforces security policies, performs application identification, and inspects traffic for threats. In a multi-vsys configuration, each virtual system has dedicated dataplane resources, ensuring that security policies are applied independently. The management plane, control plane, and User-ID agent support administration, routing, and user mapping but do not enforce security policies or inspect traffic.

Answer

The management plane

Answer

The control plane

Answer

The user-ID agent

Question 14

A security administrator is configuring a new Palo Alto Networks firewall and needs to enable App-ID to identify applications traversing the network. The administrator wants to ensure that App-ID can correctly identify applications even when they use non-standard ports or encryption. Which feature must be enabled to allow App-ID to inspect encrypted traffic?

Accepted Answer

SSL decryption. SSL decryption is required to inspect encrypted traffic, allowing App-ID to identify applications accurately. Without decryption, App-ID relies on heuristics and metadata, which may misidentify applications. User-ID, Content-ID, and application override serve different purposes and do not decrypt traffic. Enabling SSL decryption ensures that App-ID can see inside encrypted sessions and enforce policies based on the true application.

Answer

User-ID

Answer

Content-ID

Answer

Application override

Question 15

A security administrator is configuring a firewall to inspect traffic between two internal zones. The administrator wants to ensure that the firewall performs application identification and content inspection on all allowed traffic. Which configuration is required to achieve this?

Accepted Answer

Create a security policy that allows the traffic and attach a Security Profile Group to the policy.. To perform application identification and content inspection on allowed traffic, a security policy must allow the traffic and have a Security Profile Group attached. The Security Profile Group contains the necessary profiles for antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking. Without these profiles, the firewall only identifies the application but does not inspect the content for threats.

Answer

Configure a Decryption policy to forward traffic to a content inspection engine.

Answer

Create a security policy with the action 'allow' and enable 'Log at Session End'.

Answer

Enable SSL decryption on the firewall for all traffic between the zones.