PCNSE Deploy and Configure Firewalls Practice Test 3 — 15 Questions

Question 1

An administrator notices that URL filtering is not blocking a specific category as configured. What is the first troubleshooting step?

Accepted Answer

Verify the security policy order. The most common reason URL filtering fails to block a specific category is that a security policy with a lower priority (higher order number) is matching the traffic before the policy with the correct URL filtering profile. Since security policies are evaluated top-down, the first match is applied, and if an earlier policy allows the traffic without URL filtering, the configured block action is never reached. Therefore, verifying the security policy order is the first and most logical troubleshooting step.

Answer

Review the URL filtering profile

Answer

Check the URL filtering license

Answer

Check the PAN-DB version

Question 2

A firewall's management interface becomes unresponsive. The administrator can still ping the management IP. What is the most likely cause?

Accepted Answer

HTTP/HTTPS service disabled. When the management interface is unresponsive to HTTPS/SSH but still responds to ICMP (ping), it typically indicates that the management services (HTTP/HTTPS) are disabled on the interface. Ping operates at the network layer (ICMP) and does not require the management daemon to be running, while HTTPS requires the web server process to be enabled and bound to the management interface. This is a common misconfiguration in Palo Alto Networks firewalls where the 'HTTP' or 'HTTPS' service is unchecked under the Management Interface Settings.

Answer

Management interface IP conflict

Answer

CPU overload

Answer

Management profile misconfiguration

Question 3

A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?

Accepted Answer

The user's IP is not in the User-ID mapping table. When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.

Answer

The security policy order is incorrect

Answer

The firewall is not configured to use the User-ID agent

Answer

The User-ID agent is not running

Question 4

An administrator wants to ensure that all traffic from the internal network to the internet uses a specific public IP address for source NAT. There are multiple public IP addresses available. What is the best way to achieve this?

Accepted Answer

Create a dynamic IP and port (DIPP) NAT policy with the specific IP as translated address. A Dynamic IP and Port (DIPP) NAT policy allows you to specify a single translated address (the specific public IP) while still performing port address translation (PAT) to handle multiple internal sessions. This ensures all outbound traffic uses that exact public IP, unlike a pool which would distribute across multiple IPs. DIPP is the standard method for source NAT with a single IP when many internal hosts need concurrent internet access.

Answer

Configure a NAT IP pool

Answer

Use a static NAT policy

Answer

Use a PAT pool

Question 5

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 6

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 7

An organization has a firewall in HA active-passive mode. After a failover, the new active firewall does not have the latest session table. What should be configured to ensure session synchronization?

Accepted Answer

HA session sync. HA session synchronization (session sync) is the feature that replicates active session state from the active firewall to the passive firewall in an active-passive HA pair. Without this configuration, after a failover the new active firewall has no knowledge of existing sessions, causing all active connections to be dropped and requiring clients to re-establish them. Enabling session sync ensures the passive firewall maintains a synchronized session table, allowing seamless traffic continuation after failover.

Answer

Packet capture on active

Answer

Session setup on both peers

Answer

Commit force sync

Question 8

A firewall is configured with multiple virtual wire interfaces. Traffic passes through but the firewall cannot enforce security policies based on source/destination IP addresses. What is the reason?

Accepted Answer

Virtual wire mode does not support IP-based policies. In virtual wire mode, the firewall operates as a transparent Layer 2 bridge, forwarding frames based on MAC addresses without performing any IP routing or inspection of Layer 3 headers. Because the firewall does not see the source or destination IP addresses in the traffic, it cannot enforce security policies that rely on IP-based criteria. Option D correctly identifies that virtual wire mode inherently does not support IP-based policies.

Answer

The virtual wire is not configured with zones

Answer

The virtual wire requires a VLAN tag

Answer

The security policy is in layer 3 mode

Question 9

Which TWO statements are true about Palo Alto Networks firewall management access?

Accepted Answer

Management profiles control access to the firewall. Management profiles control which management services (e.g., HTTPS, SSH, ping) are allowed on a given interface. Without an applied management profile, no management services are permitted on that interface. Option B is incorrect: HTTPS is enabled by default only on the MGT port, not on all interfaces. Option C is correct: Management access can be allowed from any zone by configuring a management profile on an interface in that zone. Option D is incorrect: The MGT port is dedicated, but management access can also be configured on data interfaces. Option E is incorrect: SSH access is not always enabled; it depends on the management profile. Therefore, A and C are correct.

Answer

HTTPS is enabled by default on all interfaces

Answer

The management interface can be configured for MGT port only

Answer

SSH access is always enabled

Question 10

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 11

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 12

Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?

Accepted Answer

rule2. Rule2 is correct because it is the first rule in the security policy that matches the traffic from the trust zone (source zone trust) to the external server (destination zone untrust) for HTTPS (destination port 443). Palo Alto Networks firewalls evaluate rules in top-down order, and rule2 explicitly permits HTTPS traffic from trust to untrust, while rule1 only permits HTTP (port 80). Rule3 and rule4 do not match because they are either for different zones or deny the traffic.

Answer

rule4

Answer

rule3

Answer

rule1

Question 13

Refer to the exhibit. An administrator has configured this decryption policy but users in the 10.1.1.0/24 subnet receive certificate warnings when accessing HTTPS sites. What is the most likely cause?

Accepted Answer

The decryption certificate is not trusted by clients. Certificate warnings occur when the decryption certificate used by the firewall is not trusted by the client machines. In a forward proxy decryption scenario, the firewall generates a new certificate on-the-fly for each HTTPS session, and if that certificate is not installed in the client's trusted root store, the browser will display a security warning. This is the most common cause of certificate warnings in decryption deployments.

Answer

The rule should be at the top of the rulebase

Answer

The destination address should be specific

Answer

The application should be web-browsing

Question 14

A company has a pair of Palo Alto Networks firewalls in active/passive HA. The active firewall manages all traffic. Recently, the network team reconfigured the virtual router by adding a new static route to a remote subnet via a next-hop IP on the same interface. After committing, they noticed that the passive firewall's management IP became unreachable. The active firewall continues to pass traffic normally. What is the most likely cause?

Accepted Answer

The passive firewall has lost its management route. In an active/passive HA pair, the passive firewall synchronizes its configuration from the active firewall, including virtual router settings. However, management IP reachability depends on the management network's routing table, which is separate from the dataplane virtual router. Adding a static route to the virtual router does not automatically add a corresponding management route. The passive firewall's management IP became unreachable because it lost its default gateway or specific management route, likely due to a misconfiguration or failure to synchronize the management plane's routing information, which is not part of the HA config sync.

Answer

The HA link is down

Answer

The static route is causing a routing loop

Answer

The virtual router configuration is not synchronized to the passive peer

Question 15

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. After a recent maintenance window, the passive firewall fails to synchronize its configuration from the active. The active firewall shows the HA1 link as down. Which two configuration settings must be verified to resolve this issue?

Accepted Answer

Verify the HA1 IP address and port settings, and confirm that the HA keepalive timer is identical on both peers. The HA1 link is used for control-plane communication, including configuration synchronization and heartbeats. If the active firewall shows the HA1 link as down, the most likely cause is a mismatch in the HA1 IP address, port settings, or the HA keepalive timer between the two peers. Verifying and correcting these settings ensures the HA1 link can establish and maintain connectivity, allowing the passive firewall to synchronize its configuration.

Answer

Verify that the HA2 link is configured and operational

Answer

Ensure that both firewalls have the same session setup mode (e.g., active-active vs active-passive)

Answer

Check that HA1 encryption is enabled on both devices