PCNSE Deploy and Configure Firewalls — 10 Questions

Question 1

A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?

Accepted Answer

The HA2 link is down or misconfigured.. In active/passive HA, the HA2 link is used for session synchronization and state propagation. If the HA2 link is down or misconfigured, the active firewall cannot synchronize session state to the passive unit, causing it to report 'non-functional' even though the passive unit sees itself as 'passive'. The HA1 link handles heartbeats and configuration sync, which may still be operational, but without a functional HA2 link, the HA pair cannot maintain proper state synchronization, leading to the active firewall's non-functional state.

Answer

The HA1 link is down or misconfigured.

Answer

The HA2 link is being used for management traffic.

Answer

The preemptive setting is enabled on both firewalls.

Question 2

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Accepted Answer

Another rule earlier in the policy matches the traffic and allows it before reaching this rule.. Option A is correct because in a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.

Answer

The firewall is configured to not log interzone traffic.

Answer

The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

Answer

The logging profile is not applied to the rule.

Question 3

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Accepted Answer

allow. The correct action is 'allow' because the security engineer needs to permit inbound HTTPS traffic from the Untrust zone to the DMZ web server. In Palo Alto Networks firewalls, the security policy action 'allow' explicitly permits the traffic to pass through the firewall, which is required for legitimate inbound web traffic.

Answer

reset-both

Answer

deny

Answer

drop

Question 4

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Accepted Answer

The static route in VR1 does not point to an interface or next hop that is reachable via VR2.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Answer

The firewall does not support multiple virtual routers.

Answer

The virtual routers are not connected to each other.

Answer

NAT is not configured on VR2.

Question 5

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Accepted Answer

A rule with a 'deny' action appears earlier in the security policy.. The most likely reason the inter-zone rule is not matched is that a preceding rule with a 'deny' action is matching the traffic first. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom, and the first matching rule determines the action. If an earlier rule denies the traffic, the later allow rule will never be evaluated, even if it would otherwise match.

Answer

The source address 10.0.0.0/8 is not included in the source zone.

Answer

The destination address is set to 'any', which is not valid.

Answer

The traffic is intra-zone, not inter-zone.

Question 6

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Two physical or subinterfaces assigned to the vwire.. Option A is correct because a virtual wire (vwire) requires exactly two interfaces to function as a transparent bridge between two network segments. These interfaces can be physical or subinterfaces, and they must be assigned to the vwire to pass traffic without Layer 3 processing. Without two interfaces, the vwire cannot forward frames between the connected devices.

Answer

A management profile must be applied to the vwire.

Answer

A zone must be assigned to the vwire.

Answer

The interfaces must be of type 'aggregate'.

Question 7

Which THREE of the following are valid methods to enable traffic logging when configuring a security rule?

Accepted Answer

Set 'Log at Session End' in the rule.. Option A is correct because setting 'Log at Session End' in a security rule explicitly instructs the firewall to generate a traffic log entry when the session terminates, capturing the complete session details including bytes transferred and duration. This is a direct method to enable logging for the rule's traffic.

Answer

Enable 'Logging' under the rule's 'Actions' tab.

Answer

Configure 'Log at Rule Match' under the rule's 'Advanced' settings.

Question 8

You are deploying a pair of PA-5250 firewalls in active/passive HA mode for a large enterprise. The firewalls are configured with multiple virtual routers (VRs) to segment traffic: VR-A for internal corporate network, VR-B for DMZ, and VR-C for Internet edge. Each VR is associated with a separate Vsys. The HA pair uses IPsec tunnel monitoring to determine failover. The customer reports that after a recent configuration change, failover does not occur when the primary firewall's Internet-facing interface (ethernet1/1) goes down. You verify that the primary firewall detects the interface failure, but the secondary does not take over. The HA configuration shows: 'monitor failure only' set to 'link-status', 'monitor hold time' 1000ms, 'promotion hold time' 2000ms, and 'monitor failure condition' is 'any'. The IPsec tunnel monitoring is configured for tunnel to a remote site. The path monitoring includes the Internet-facing interface under VR-C. What is the most likely reason for the failover failure?

Accepted Answer

The IPsec tunnel monitoring is configured, but it is not a valid HA monitoring method; only path, interface, and route monitoring are supported.. Option B is correct because IPsec tunnel monitoring is not a supported HA monitoring method on Palo Alto Networks firewalls. The supported methods are path monitoring, interface monitoring, and route monitoring. Since the configuration relies on IPsec tunnel monitoring to trigger failover, the secondary firewall will not take over when the primary's interface goes down, regardless of other settings.

Answer

The use of multiple virtual routers prevents HA from monitoring interfaces across VRs.

Answer

The 'monitor hold time' is too short, causing flapping to be ignored.

Answer

The 'monitor failure only' is set to 'link-status' instead of 'path-monitoring'.

Question 9

A company has deployed two PA-5250 firewalls in an active/passive high-availability pair. The passive firewall shows the status 'non-functional' after a reboot. The active firewall is still passing traffic. The administrator checks the HA configuration and sees that the preemptive setting is enabled on both firewalls. What is the most likely cause of the passive firewall showing 'non-functional'?

Accepted Answer

The management port (MGT) on the passive firewall is down or unplugged.. The PA-5250 uses the MGT port for out-of-band management and, in some HA configurations, for HA1 control link connectivity. If the MGT port on the passive firewall is down or unplugged, the firewall cannot establish or maintain the HA1 heartbeat, causing it to report as 'non-functional' even though the active firewall continues to pass traffic. The preemptive setting only affects role negotiation after a failover, not the initial functional status after a reboot.

Answer

The preemptive setting is causing the passive firewall to remain in non-functional state until a failover occurs.

Answer

The HA2 keepalive timer has expired.

Answer

The hello interval on the passive firewall is set to a different value than on the active firewall.

Question 10

A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)

Accepted Answer

Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.. Option B is correct because it uses the 'ssl' application to match HTTPS traffic, which is the proper application-based method for allowing outbound HTTPS. This rule specifies the source as 'internal-users' and destination as 'any', with the action 'allow', meeting requirement (1) without over-permitting. Option C is correct because it creates a rule from 'external' to 'internal', targeting the mail server IP with application 'smtp' and service 'application-default', which blocks all inbound traffic except SMTP to that specific server, satisfying requirement (2).

Answer

Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.

Answer

Rule: from internal to external, source any, destination any, application any, service any, action allow.

Answer

Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.