PCNSE Core Concepts and Architecture — Timed 15 Questions

Question 1

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Accepted Answer

Create separate virtual systems (VSYS) for each tenant on the same firewall.. Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Answer

Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

Answer

Use active/active HA mode to assign each tenant to a different firewall.

Answer

Configure multiple virtual routers (VRFs) within the same virtual system.

Question 2

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 3

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

Accepted Answer

Security policy rule groups. Security policy rule groups allow administrators to organize related firewall rules into logical units, which can then be applied to specific users or devices via policy-based forwarding or rule placement. This feature simplifies management by grouping rules that share a common purpose, such as those for a particular department or application, and enables targeted application without manual rule reordering. It directly addresses the requirement for logical grouping and selective application to users or devices.

Answer

Security profiles

Answer

Security zones

Answer

Application groups

Question 4

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

Accepted Answer

Increased packet drops due to buffer exhaustion.. When dataplane packet buffer usage exceeds 90% during a traffic spike, the firewall's packet buffers are nearly exhausted, leading to a condition where incoming packets cannot be stored temporarily for processing. This directly causes packet drops because the dataplane has no available buffers to enqueue new packets, even though CPU utilization remains low. Option D correctly identifies this as the primary impact, as buffer exhaustion results in tail-drop behavior for new packets.

Answer

Reduced new session setup rate.

Answer

Reduced committed information rate (CIR) on QoS policies.

Answer

Increased latency for management access.

Question 5

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Accepted Answer

The firewall will perform a reverse path forwarding (RPF) check on the source IP.. Option B is correct because when a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Answer

The firewall will automatically redistribute the route to VR-B if needed.

Answer

The packet will be dropped because the destination is not in the same VR as the ingress interface.

Answer

The firewall will use the zone of the egress interface to determine the security policy.

Question 6

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Accepted Answer

Define a custom application with the appropriate protocol, port, and optionally a signature.. Option B is correct because when a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Answer

Create a security policy rule with an application override to match the port.

Answer

Enable SSL decryption on the traffic to inspect encrypted payloads.

Answer

Add the port to the default application's 'port' field in the application object.

Question 7

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

Accepted Answer

Panorama without Log Collectors. Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Answer

Panorama with Dedicated Log Collectors

Answer

Panorama with Log Collectors

Answer

Panorama in High Availability mode

Question 8

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Accepted Answer

10.0.0.0/24 via 10.0.0.2 ethernet1/2. The firewall performs a longest-prefix match on the routing table. The destination IP 10.0.0.100 matches the 10.0.0.0/24 route (prefix length 24) more specifically than the 10.0.0.0/8 route (prefix length 8) or the default route. Since the packet arrived on ethernet1/2 and the matching route points to the same interface, the route via 10.0.0.2 ethernet1/2 is selected.

Answer

10.0.1.0/24 via 10.0.0.3 ethernet1/3

Answer

10.0.0.0/8 via 10.0.0.1 ethernet1/1

Answer

0.0.0.0/0 via 10.0.0.1 ethernet1/1

Question 9

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Accepted Answer

Define a custom application object with the correct protocol signature and protocol type.. Option D is correct because the firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer

Disable SSL inspection on the security policy for this traffic.

Answer

Create an application override policy for this traffic to mark it as the custom application.

Answer

Enable SSL decryption on the traffic to inspect the payload.

Question 10

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Session Table. The Session Table is a core dataplane component because it stores stateful session information for all active traffic flows. The dataplane uses this table to perform fast-path forwarding, applying security policies and NAT translations without involving the management plane. Without the session table, the firewall would be unable to maintain stateful inspection, which is fundamental to its operation.

Answer

Management Plane

Answer

Threat Prevention Engine

Answer

Log Database

Question 11

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 12

A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?

Accepted Answer

Add a security policy rule to allow the 'quic' application.. The correct action is to add a security policy rule allowing the 'quic' application because QUIC is a distinct protocol (UDP 443) with its own App-ID in PAN-OS 10.1. The firewall logs showing 'application: incomplete' indicate that App-ID is failing to identify the traffic, often due to a missing rule for the specific application. Allowing 'ssl' does not work because SSL/TLS operates over TCP, while QUIC uses UDP, and the firewall's App-ID engine treats them separately.

Answer

Upgrade Panorama to the latest version to add QUIC support.

Answer

Enable SSL decryption on the policy to inspect QUIC traffic.

Answer

Disable App-ID for the QUIC traffic and use a port-based rule.

Question 13

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering

Question 14

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Accepted Answer

Configure a virtual router and assign interfaces. Option A is correct because in Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 15

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets