PCNSE Deploy and Configure Firewalls Practice Test 2 — 15 Questions

Question 1

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VLAN ID is misconfigured as 20 instead of 10.. The exhibit shows the sub-interface is configured with VLAN ID 20, but the administrator intended VLAN 10. In Palo Alto Networks firewalls, sub-interfaces use 802.1Q VLAN tagging, and the VLAN ID must match the tag on incoming frames. Mismatched VLAN IDs cause the firewall to drop or ignore traffic because the sub-interface only processes frames with the configured tag.

Answer

The IP netmask is /24 but should be /16.

Answer

The zone is incorrectly named 'VLAN10'.

Answer

The virtual router is not correctly set.

Question 2

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 3

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT

Question 4

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

Accepted Answer

The security rule 'Allow-SSL' has 'service' set to 'application-default' but the website uses port 8443.. The security rule 'Allow-SSL' is configured with 'service' set to 'application-default', which means it only permits traffic on the default port for SSL (TCP 443). Since the website uses port 8443, the traffic is denied because the rule does not match the non-standard port. The firewall's application identification still correctly identifies the traffic as 'ssl', but the service constraint prevents the rule from applying, resulting in a deny action.

Answer

The destination IP is in a blacklist.

Answer

The security rule is placed too low in the rulebase.

Answer

The SSL certificate is expired.

Question 5

By default, what is the action on traffic between two different zones without any security rule?

Accepted Answer

deny. By default, Palo Alto Networks firewalls implement an implicit deny rule for inter-zone traffic. This means that if no security rule explicitly matches traffic between two different zones, the firewall drops the packet and logs it as a deny action. This default behavior ensures that all cross-zone traffic must be explicitly allowed by a security policy, enforcing a zero-trust model.

Answer

allow

Answer

depends on the application

Answer

prompt

Question 6

An administrator adds a new security rule to allow outbound 'web-browsing' and 'ssl' traffic. After committing, users report that some HTTPS sites are still blocked. Traffic logs show that the traffic matches the new rule but is denied. What is the most likely cause?

Accepted Answer

The service 'application-default' does not match the port used by the site.. When a security rule uses the 'application-default' service, the firewall only allows traffic that matches the default port for the specified application. For 'web-browsing' (HTTP), the default port is TCP 80, and for 'ssl' (HTTPS), the default port is TCP 443. If an HTTPS site uses a non-standard port (e.g., TCP 8443), the traffic matches the rule based on the application but is denied because the service 'application-default' does not recognize that port as valid for the application.

Answer

A decryption policy is required for HTTPS traffic.

Answer

The application filter does not include 'ssl'.

Answer

The rule is placed too low in the rulebase.

Question 7

Which of the following is NOT a valid method to identify users for User-ID on a Palo Alto Networks firewall?

Accepted Answer

XML API. The XML API is not a method for identifying users for User-ID; it is a management interface used to configure, monitor, and retrieve data from the firewall programmatically. User-ID relies on mechanisms that actively map IP addresses to usernames, such as LDAP sync, Terminal Services Agent, and Captive Portal, none of which involve the XML API.

Answer

LDAP sync

Answer

Terminal Services Agent (TS Agent)

Answer

Captive Portal

Question 8

In an Active/Passive HA pair, which statement is true regarding configuration synchronization?

Accepted Answer

Only committed changes on the active are synced to the passive.. In an Active/Passive HA pair, configuration synchronization occurs only after changes are committed on the active firewall. The passive peer then receives the committed configuration via the HA control link (using TCP port 2928 by default). This ensures that only validated, committed changes are propagated, preventing the passive from receiving uncommitted or partial configurations that could cause instability.

Answer

Configuration is not synced automatically; the administrator must export and import.

Answer

All configuration changes on the active peer are automatically synced to the passive.

Answer

The passive peer initiates the sync.

Question 9

A company uses a custom application definition for a proprietary application that runs on UDP port 12345. The security rule allowing the application is configured, but traffic logs show the application as 'unknown' instead of matching the custom app. What is the most likely cause?

Accepted Answer

The traffic is not matching the app's protocol or port in the signature.. The custom application definition specifies UDP port 12345, but if the actual traffic uses a different port or does not match the protocol (UDP) defined in the signature, the firewall will classify it as 'unknown'. The security rule allows the application, but the traffic must first be identified by the App-ID engine based on the signature's protocol and port criteria; a mismatch here prevents proper classification.

Answer

The custom application signature is not associated with the security rule.

Answer

The firewall is running in L2 mode.

Answer

The application timeout is too short.

Question 10

An administrator wants to ensure that all traffic from the 'Trust' zone to the 'Untrust' zone is inspected by WildFire. Which configuration is required?

Accepted Answer

Configure a WildFire profile and attach it to the security rule.. WildFire inspection is applied via a security rule using a WildFire Analysis profile. The profile defines the file types and verdict actions (e.g., alert, block) for files submitted to WildFire. Attaching this profile to the security rule that governs Trust-to-Untrust traffic ensures all matching traffic is inspected by WildFire.

Answer

Create a separate WildFire rule.

Answer

Enable WildFire on the security rule.

Answer

Enable WildFire globally under Device > Setup.

Question 11

In a Panorama-managed deployment, the device group has a rule called 'Allow-Web' that allows 'web-browsing'. The local firewall also has a rule with the same name and content. After Panorama pushes the device group configuration, what happens to the local rule?

Accepted Answer

Both rules are present; the device group rule takes precedence and the local rule is not installed.. In a Panorama-managed deployment, when a device group rule and a local firewall rule share the same name, Panorama does not overwrite or delete the local rule. Instead, the device group rule is installed and takes precedence, while the local rule remains on the firewall but is not active in the rulebase. This is because Panorama manages the device group configuration as a separate administrative domain, and local rules are preserved to allow for local override scenarios.

Answer

The local rule is overwritten by the device group rule.

Answer

The local rule is deleted.

Answer

The rules are merged into a single rule.

Question 12

Which TWO of the following are prerequisites for configuring User-ID on an interface?

Accepted Answer

A User-ID agent must be installed.. A User-ID agent (or the built-in User-ID service on the firewall) is required to map IP addresses to usernames. Without an agent—such as the PAN-OS User-ID Agent, Terminal Services Agent, or GlobalProtect—the firewall cannot collect user mapping data from directory services (e.g., Active Directory) or authentication logs. Option D is correct because User-ID must be explicitly enabled on the zone; if the zone does not have User-ID enabled, the firewall will not perform user mapping for traffic traversing that zone, even if the interface is configured correctly.

Answer

The firewall must be in FIPS mode.

Answer

The interface must be in a zone.

Answer

An authentication profile must be configured.

Question 13

Which TWO of the following are required for stateful failover in an Active/Passive HA pair?

Accepted Answer

HA1 link configured with a dedicated interface.. In an Active/Passive HA pair, stateful failover requires the HA1 link (management/control plane synchronization) and the HA2 link (data plane session synchronization) to be configured with dedicated interfaces. The HA1 link ensures heartbeat and configuration sync, while the HA2 link synchronizes session tables so that the passive firewall can seamlessly take over active sessions without disruption.

Answer

HA3 link configured with a dedicated interface.

Answer

Heartbeat backup link configured.

Answer

Session table synchronization enabled.

Question 14

Which THREE of the following are mandatory components for GlobalProtect client connectivity?

Accepted Answer

Authentication profile.. The GlobalProtect portal and gateway are the two fundamental server-side components required for client connectivity. The portal provides the initial configuration, including gateway lists and client settings, while the gateway terminates the VPN tunnel and enforces security policies. An authentication profile is mandatory because the portal must verify the user's identity before the client can download the portal configuration and subsequently connect to a gateway.

Answer

Client certificate.

Answer

DNS suffix.

Question 15

A company has a firewall with multiple virtual routers. They need to ensure that traffic from a specific subnet (10.1.1.0/24) can reach the internet but not other internal subnets. What is the best way to achieve this?

Accepted Answer

Implement security policies with source zone and destination zone. Security policies in Palo Alto Networks firewalls control traffic based on source and destination zones, enabling you to restrict traffic from the 10.1.1.0/24 subnet (assigned to a specific zone) to only the internet zone while blocking access to other internal subnets. This is achieved by creating a security policy that allows traffic from the source zone (e.g., 'Internal') to the destination zone (e.g., 'Internet') and explicitly denying traffic to other internal zones, without relying on routing or NAT.

Answer

Use NAT policies

Answer

Configure static routes in the virtual router

Answer

Configure path monitoring