PCNSE Deploy and Configure Firewalls — 25 Questions

Question 1

You are deploying a pair of PA-5250 firewalls in active/passive HA mode for a large enterprise. The firewalls are configured with multiple virtual routers (VRs) to segment traffic: VR-A for internal corporate network, VR-B for DMZ, and VR-C for Internet edge. Each VR is associated with a separate Vsys. The HA pair uses IPsec tunnel monitoring to determine failover. The customer reports that after a recent configuration change, failover does not occur when the primary firewall's Internet-facing interface (ethernet1/1) goes down. You verify that the primary firewall detects the interface failure, but the secondary does not take over. The HA configuration shows: 'monitor failure only' set to 'link-status', 'monitor hold time' 1000ms, 'promotion hold time' 2000ms, and 'monitor failure condition' is 'any'. The IPsec tunnel monitoring is configured for tunnel to a remote site. The path monitoring includes the Internet-facing interface under VR-C. What is the most likely reason for the failover failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IPsec tunnel monitoring is configured, but it is not a valid HA monitoring method; only path, interface, and route monitoring are supported.. The failover failure occurs because the 'monitor failure only' setting is set to 'link-status', which means only interface monitoring link status changes can trigger failover. The Internet-facing interface is included only in path monitoring, not in interface monitoring, so its link-down event is not detected by interface monitoring. Path monitoring is configured but its failures are ignored for failover due to the 'link-status' setting. IPsec tunnel monitoring is not a supported HA monitoring method on Palo Alto Networks firewalls. Therefore, no valid monitoring method is able to trigger failover when the interface goes down, explaining why the secondary does not take over.

Answer

The use of multiple virtual routers prevents HA from monitoring interfaces across VRs.

Answer

The 'monitor hold time' is too short, causing flapping to be ignored.

Answer

The 'monitor failure only' is set to 'link-status' instead of 'path-monitoring'.

Question 2

Refer to the exhibit. A user in the 10.0.0.0/8 network is unable to access a web server at 172.16.1.10 which is in the DMZ zone. The firewall's security policy is shown. What is the most likely reason for the failure?

Accepted Answer

The policy specifies the 'untrust' zone instead of the 'dmz' zone.. The policy's destination zone is 'untrust', but the server is in the 'dmz' zone, so the traffic does not match this policy. Option A is incorrect because the source IP range 10.0.0.0/8 includes the user's IP, so it is not misconfigured. Option C is incorrect because the policy has an 'allow' action, so it is not missing a permit. Option D is incorrect because 'web-browsing' is the correct application for HTTP traffic.

Answer

The source IP range 10.0.0.0/8 is misconfigured.

Answer

The policy is missing a 'permit' action.

Answer

The application 'web-browsing' is not the correct application for the traffic.

Question 3

A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?

Accepted Answer

The HA2 link is down or misconfigured.. In active/passive HA, the HA2 link is used for session synchronization and state propagation. If the HA2 link is down or misconfigured, the active firewall cannot synchronize session state to the passive unit, causing it to report 'non-functional' even though the passive unit sees itself as 'passive'. The HA1 link handles heartbeats and configuration sync, which may still be operational, but without a functional HA2 link, the HA pair cannot maintain proper state synchronization, leading to the active firewall's non-functional state.

Answer

The HA1 link is down or misconfigured.

Answer

The HA2 link is being used for management traffic.

Answer

The preemptive setting is enabled on both firewalls.

Question 4

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Accepted Answer

Another rule earlier in the policy matches the traffic and allows it before reaching this rule.. In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.

Answer

The firewall is configured to not log interzone traffic.

Answer

The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

Answer

The logging profile is not applied to the rule.

Question 5

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Accepted Answer

allow. The correct action is 'allow' because the security engineer needs to permit inbound HTTPS traffic from the Untrust zone to the DMZ web server. In Palo Alto Networks firewalls, the security policy action 'allow' explicitly permits the traffic to pass through the firewall, which is required for legitimate inbound web traffic.

Answer

reset-both

Answer

deny

Answer

drop

Question 6

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Accepted Answer

The static route in VR1 does not point to an interface or next hop that is reachable via VR2.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Answer

The firewall does not support multiple virtual routers.

Answer

The virtual routers are not connected to each other.

Answer

NAT is not configured on VR2.

Question 7

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Accepted Answer

A rule with a 'deny' action appears earlier in the security policy.. The most likely reason the inter-zone rule is not matched is that a preceding rule with a 'deny' action is matching the traffic first. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom, and the first matching rule determines the action. If an earlier rule denies the traffic, the later allow rule will never be evaluated, even if it would otherwise match.

Answer

The source address 10.0.0.0/8 is not included in the source zone.

Answer

The destination address is set to 'any', which is not valid.

Answer

The traffic is intra-zone, not inter-zone.

Question 8

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Two physical or subinterfaces assigned to the vwire.. A virtual wire (vwire) requires exactly two interfaces to function as a transparent bridge between two network segments. These interfaces can be physical or subinterfaces, and they must be assigned to the vwire to pass traffic without Layer 3 processing. Without two interfaces, the vwire cannot forward frames between the connected devices.

Answer

A management profile must be applied to the vwire.

Answer

A zone must be assigned to the vwire.

Answer

The interfaces must be of type 'aggregate'.

Question 9

Which THREE of the following are valid methods to enable traffic logging when configuring a security rule?

Accepted Answer

Set 'Log at Session End' in the rule.. Setting 'Log at Session End' in a security rule explicitly instructs the firewall to generate a traffic log entry when the session terminates, capturing the complete session details including bytes transferred and duration. This is a direct method to enable logging for the rule's traffic.

Answer

Enable 'Logging' under the rule's 'Actions' tab.

Answer

Configure 'Log at Rule Match' under the rule's 'Advanced' settings.

Question 10

A company has deployed two PA-5250 firewalls in an active/passive high-availability pair. The passive firewall shows the status 'non-functional' after a reboot. The active firewall is still passing traffic. The administrator checks the HA configuration and sees that the preemptive setting is enabled on both firewalls. What is the most likely cause of the passive firewall showing 'non-functional'?

Accepted Answer

The hello interval on the passive firewall is set to a different value than on the active firewall.. The passive firewall reports 'non-functional' after a reboot if it cannot establish an HA1 control link with the active firewall. The most likely cause in this scenario is a mismatch in the hello interval between the two firewalls, which prevents the HA pair from forming. The preemptive setting does not affect the initial functional status; it only influences role preemption after a failover. The management port (MGT) is not used for HA1 in default deployments and its status would not impact HA functionality unless explicitly configured as an HA1 backup.

Answer

The preemptive setting is causing the passive firewall to remain in non-functional state until a failover occurs.

Answer

The HA2 keepalive timer has expired.

Answer

The management port (MGT) on the passive firewall is down or unplugged.

Question 11

A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)

Accepted Answer

Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.. It uses the 'ssl' application to match HTTPS traffic, which is the proper application-based method for allowing outbound HTTPS. This rule specifies the source as 'internal-users' and destination as 'any', with the action 'allow', meeting requirement (1) without over-permitting. Option C is correct because it creates a rule from 'external' to 'internal', targeting the mail server IP with application 'smtp' and service 'application-default', which blocks all inbound traffic except SMTP to that specific server, satisfying requirement (2).

Answer

Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.

Answer

Rule: from internal to external, source any, destination any, application any, service any, action allow.

Answer

Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.

Question 12

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Accepted Answer

The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.. The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.

Answer

The destination network 10.3.3.0/24 is not in the routing table.

Answer

The source network 10.2.2.0/24 is not in the routing table.

Answer

The default route 0.0.0.0/0 is missing.

Question 13

Order the steps to configure an IPsec VPN tunnel between two Palo Alto firewalls.

Accepted Answer

Configure IKE Gateway, then IPsec Crypto Profile, then Tunnel Interface, then Security Policy. The correct order for configuring an IPsec VPN tunnel on Palo Alto firewalls is: first configure the IKE gateway (Phase 1 authentication), then the IPsec crypto profile (Phase 2 encryption and authentication), then create the tunnel interface (which binds the IPsec parameters), and finally configure security policies to permit the desired traffic through the tunnel. This sequence ensures all dependencies are met and avoids configuration errors.

Answer

Configure Tunnel Interface, then IKE Gateway, then IPsec Crypto Profile, then Security Policy

Answer

Configure Security Policy, then IKE Gateway, then IPsec Crypto Profile, then Tunnel Interface

Answer

Configure IKE Gateway, then Tunnel Interface, then IPsec Crypto Profile, then Security Policy

Question 14

Match each type of route to its description.

Accepted Answer

Static route: A route manually configured by an administrator.. Correct matches: A (Static: manual), C (OSPF: OSPF-learned), D (BGP: BGP-learned), F (Floating static: backup with higher distance). Distractors swap definitions for connected (B) and default (E).

Answer

Connected route: A route learned via the OSPF routing protocol.

Answer

Default route: A static route with a next-hop of 0.0.0.0.

Question 15

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Accepted Answer

The application 'ssl' is not allowed in any security rule.. The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Answer

The session ended with TCP FIN, causing the firewall to deny.

Answer

The destination IP is blacklisted.

Answer

The security rule 'default-deny' explicitly blocks this traffic.

Question 16

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Accepted Answer

The VLAN ID is misconfigured as 20 instead of 10.. The exhibit shows the sub-interface is configured with VLAN ID 20, but the administrator intended VLAN 10. In Palo Alto Networks firewalls, sub-interfaces use 802.1Q VLAN tagging, and the VLAN ID must match the tag on incoming frames. Mismatched VLAN IDs cause the firewall to drop or ignore traffic because the sub-interface only processes frames with the configured tag.

Answer

The IP netmask is /24 but should be /16.

Answer

The zone is incorrectly named 'VLAN10'.

Answer

The virtual router is not correctly set.

Question 17

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 18

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT

Question 19

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

Accepted Answer

The security rule 'Allow-SSL' has 'service' set to 'application-default' but the website uses port 8443.. The security rule 'Allow-SSL' is configured with 'service' set to 'application-default', which means it only permits traffic on the default port for SSL (TCP 443). Since the website uses port 8443, the traffic is denied because the rule does not match the non-standard port. The firewall's application identification still correctly identifies the traffic as 'ssl', but the service constraint prevents the rule from applying, resulting in a deny action.

Answer

The destination IP is in a blacklist.

Answer

The security rule is placed too low in the rulebase.

Answer

The SSL certificate is expired.

Question 20

By default, what is the action on traffic between two different zones without any security rule?

Accepted Answer

deny. By default, Palo Alto Networks firewalls implement an implicit deny rule for inter-zone traffic. This means that if no security rule explicitly matches traffic between two different zones, the firewall drops the packet and logs it as a deny action. This default behavior ensures that all cross-zone traffic must be explicitly allowed by a security policy, enforcing a zero-trust model.

Answer

allow

Answer

depends on the application

Answer

prompt