PCNSE Core Concepts and Architecture — Timed 30 Questions

Question 1

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

30 minute time limit — choose an answer to begin.

Accepted Answer

Security policy rule groups. Security policy rule groups allow administrators to organize related firewall rules into logical units, which can then be applied to specific users or devices via policy-based forwarding or rule placement. This feature simplifies management by grouping rules that share a common purpose, such as those for a particular department or application, and enables targeted application without manual rule reordering. It directly addresses the requirement for logical grouping and selective application to users or devices.

Answer

Security profiles

Answer

Security zones

Answer

Application groups

Question 2

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Accepted Answer

The firewall will perform a reverse path forwarding (RPF) check on the source IP.. When a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Answer

The firewall will automatically redistribute the route to VR-B if needed.

Answer

The packet will be dropped because the destination is not in the same VR as the ingress interface.

Answer

The firewall will use the zone of the egress interface to determine the security policy.

Question 3

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Accepted Answer

10.0.0.0/24 via 10.0.0.2 ethernet1/2. The firewall performs a longest-prefix match on the routing table. The destination IP 10.0.0.100 matches the 10.0.0.0/24 route (prefix length 24) more specifically than the 10.0.0.0/8 route (prefix length 8) or the default route. Since the packet arrived on ethernet1/2 and the matching route points to the same interface, the route via 10.0.0.2 ethernet1/2 is selected.

Answer

10.0.1.0/24 via 10.0.0.3 ethernet1/3

Answer

10.0.0.0/8 via 10.0.0.1 ethernet1/1

Answer

0.0.0.0/0 via 10.0.0.1 ethernet1/1

Question 4

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Accepted Answer

Define a custom application object with the correct protocol signature and protocol type.. The firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer

Disable SSL inspection on the security policy for this traffic.

Answer

Create an application override policy for this traffic to mark it as the custom application.

Answer

Enable SSL decryption on the traffic to inspect the payload.

Question 5

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Session Table. The Session Table (B) is a valid dataplane component because it resides in the dataplane and tracks the state of all network sessions, enabling stateful inspection, NAT, and security policy enforcement for traffic passing through the firewall. The Packet Buffer (E) is also a valid dataplane component since it temporarily stores packets in the dataplane while they are being processed, reassembled, or queued for inspection and forwarding. The Management Plane (A) is incorrect because it is a separate functional plane responsible for configuration, administration, and management services, not for forwarding or inspecting traffic. The Threat Prevention Engine (C) is not a dataplane component in the strict architectural sense; threat inspection is performed by dataplane processing using content and threat signatures, but the named engine is not one of the dataplane components. The Log Database (D) is incorrect because it resides on the management plane and stores logs generated by the system, rather than participating in dataplane packet processing.

Answer

Management Plane

Answer

Threat Prevention Engine

Answer

Log Database

Question 6

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID identifies the application by combining several session attributes rather than relying on a single field. Option A is correct because the firewall uses application signatures and, when decryption is configured, inspects the decrypted content to accurately identify applications that would otherwise be hidden inside TLS/SSL. Option B is correct because the transport protocol (TCP or UDP) is part of the session key and helps determine which decoder and signature set applies. Option C is correct because source and destination port numbers are used as part of the session matching and can indicate the expected application, though App-ID does not rely on ports alone. Options D and E are not correct because the destination and source IP addresses are used for routing, zone, and policy matching, but they are not the factors App-ID uses to identify the application itself.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 7

A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?

Accepted Answer

Add a security policy rule to allow the 'quic' application.. The correct action is to add a security policy rule allowing the 'quic' application because QUIC is a distinct protocol (UDP 443) with its own App-ID in PAN-OS 10.1. The firewall logs showing 'application: incomplete' indicate that App-ID is failing to identify the traffic, often due to a missing rule for the specific application. Allowing 'ssl' does not work because SSL/TLS operates over TCP, while QUIC uses UDP, and the firewall's App-ID engine treats them separately.

Answer

Upgrade Panorama to the latest version to add QUIC support.

Answer

Enable SSL decryption on the policy to inspect QUIC traffic.

Answer

Disable App-ID for the QUIC traffic and use a port-based rule.

Question 8

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Accepted Answer

Asymmetric routing causing out-of-state packets. The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.

Answer

Incorrect NAT rule configuration

Answer

Security policy denying the traffic

Answer

Zone Protection Profile dropping SYN packets

Question 9

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Accepted Answer

Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object. The DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.

Answer

Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server

Answer

Change the security policy to use the IP address instead of the FQDN

Answer

Configure a static route for the FQDN's IP address pointing to the MPLS interface

Question 10

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Accepted Answer

The application override is incorrectly configured for the traffic.. When an application override is incorrectly configured, the firewall terminates the session with a 'tcp-fin' reason because it cannot match the expected application signature. The 'web-browsing' application expects HTTP traffic, but the actual payload may be non-HTTP (e.g., SSH or custom protocol), causing the firewall to send a TCP FIN to close the session gracefully. This is distinct from a reset (RST) or drop, as the firewall completes the TCP handshake but then terminates due to application mismatch.

Answer

The security policy has a deny action for the traffic.

Answer

The traffic is being asymmetrically routed.

Answer

The zone protection profile is dropping the session.

Question 11

An organization is deploying a pair of PA-5250 firewalls in active/passive high availability. The network team notices that the passive firewall is not receiving synchronization updates. Both devices have the same software version and licenses. The HA1 control link is connected and shows 'up' in 'show high-availability state'. What is the most likely reason for the synchronization failure?

Accepted Answer

The HA2 link is not configured or is down.. The HA2 link is used for session synchronization in active/passive HA configurations. Even if the HA1 control link is up and passing heartbeats, without a functioning HA2 link, the passive firewall will not receive session state updates. The 'show high-availability state' command only confirms HA1 status, not HA2.

Answer

The HA1 link is using a crossover cable instead of a straight-through cable.

Answer

The link speeds on the active and passive firewalls do not match.

Answer

The passive firewall is not in a 'passive' state.

Question 12

A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?

Accepted Answer

The destination IP is not reachable from the firewall.. The packet capture shows the SYN packet is received by the firewall but no SYN-ACK is sent. This indicates the firewall is not completing the TCP three-way handshake. The most common cause is that the destination IP is not reachable from the firewall, meaning the firewall cannot route the SYN packet to the next hop or the destination host is down. In this scenario, the firewall drops the SYN packet silently without generating a SYN-ACK because it cannot establish a session.

Answer

There is no NAT policy to translate the source IP.

Answer

The firewall is not configured to inspect HTTP traffic.

Answer

The security policy does not have an allow rule for HTTP.

Question 13

Match each log type to its content.

Accepted Answer

Traffic: Contains information about network traffic sessions, including source, destination, ports, and action.. The correct matches are: Traffic log tracks session details; Threat log records security threats; URL Filtering log logs web browsing activity; WildFire Submissions log documents file samples sent for analysis. Common confusions include swapping Traffic with URL Filtering definitions or Threat with WildFire Submissions.

Answer

Traffic: Contains information about URL categories and user access attempts.

Answer

Threat: Contains information about files submitted to WildFire for analysis.

Question 14

An administrator notices that traffic from zone A to zone B is being dropped silently. Security rules are in place. Troubleshooting shows that the session does not appear in the session table. What is the most likely cause?

Accepted Answer

The traffic is taking an asymmetric path and the firewall sees only one direction.. When traffic is silently dropped and the session does not appear in the session table, it indicates that the firewall never saw the complete three-way TCP handshake or the first packet of the flow. Asymmetric routing causes the firewall to see only one direction of traffic (e.g., only the SYN from zone A to zone B but not the SYN-ACK return), so the firewall cannot create a session entry because it requires both directions to validate the state. This results in a silent drop without any session table entry or log entry.

Answer

The traffic is being decrypted by an SSL Forward Proxy rule.

Answer

The traffic is matched by a rule with action 'deny' and logging is disabled.

Answer

The interzone default rule is set to deny.

Question 15

An organization wants to map user identity from Active Directory for traffic coming from internal LAN users without installing any agent on domain controllers. Which User-ID mapping method should be used?

Accepted Answer

Active Directory polling. Active Directory polling is the correct method because it allows the Palo Alto Networks firewall to retrieve user-to-IP mappings directly from Active Directory domain controllers using LDAP queries, without requiring any agent installation. This method polls the security event logs on domain controllers to map authenticated users to their IP addresses, making it ideal for environments where agentless user identification is desired for internal LAN traffic.

Answer

XML API

Answer

Terminal Services Agent

Answer

Captive Portal

Question 16

A firewall's dataplane CPU is consistently at 95% utilization even though session count is normal. Analysis shows that a large number of small packets are being processed. Which feature could be causing excessive dataplane processing?

Accepted Answer

Fragmented packet reassembly. Fragmented packet reassembly forces the dataplane to buffer and reassemble IP fragments before performing security policy checks. This process is CPU-intensive, especially when handling a high volume of small fragments, and can drive dataplane utilization to 95% even when the session count is normal. The firewall must allocate resources to track and reassemble each fragmented datagram, which explains the excessive processing.

Answer

Log forwarding to Panorama

Answer

User-ID agent polling

Answer

SSL Decryption with Forward Proxy

Question 17

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

Accepted Answer

Use link monitoring instead of path monitoring. Link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described. Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.

Answer

Decrease the path monitoring interval

Answer

HA1 backup link

Answer

Enable pre-emptive mode

Question 18

Which THREE are valid methods for User-ID mapping in PAN-OS?

Accepted Answer

DHCP snooping. Option A (DHCP snooping) is correct because PAN-OS can learn IP-to-username mappings by parsing DHCP transactions, either via the firewall acting as a DHCP server/relay or through DHCP snooping on a Layer 2 interface, tying the leased IP to the requesting host. Option D (Active Directory polling) is correct because the User-ID Agent or firewall can poll AD domain controllers' security event logs (e.g., 4624 logon events) to map users to IP addresses. Option E (Captive Portal) is correct because PAN-OS Captive Portal authenticates users via a web login page and then creates a User-ID mapping between the authenticated user and their source IP. Option B (Netflow collection) is not a User-ID mapping method in PAN-OS; Netflow provides traffic flow metadata, not username-to-IP bindings. Option C (SNMP traps) is not used for User-ID mapping; SNMP is for monitoring/management, not user identity resolution.

Answer

Netflow collection

Answer

SNMP traps

Question 19

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Accepted Answer

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.. The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer

The service 'application-default' does not allow TCP port 443.

Answer

The packet is not logged properly.

Answer

The destination IP is not routable in the virtual router.

Question 20

Refer to the exhibit. An administrator sees this log entry. What does it indicate?

Accepted Answer

The traffic did not match any security rule.. The log entry shows a session with action 'deny' and a reason indicating that no security rule matched (e.g., reason 'policy-deny'). In PAN-OS, when traffic does not match any security rule, it is denied by the implicit deny rule at the end of the rulebase, and the log records this as a 'deny' action with reason 'policy-deny'. This is not a buffer overflow or a rule with explicit deny action; it is the default behavior when no rule matches.

Answer

The traffic was dropped due to buffer overflow.

Answer

The traffic was allowed but not logged.

Answer

The traffic matched a rule with action 'deny'.