PCNSE Deploy and Configure Firewalls Practice Test 3 — 15 Questions

Question 1

A network security engineer is deploying a PA-3220 firewall at a branch office. The branch uses a single /29 subnet assigned by the ISP, and the engineer must configure the untrust interface with the first usable host IP. The ISP gateway is 203.0.113.1, and the assigned block is 203.0.113.0/29. Which interface configuration should the engineer apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static IP 203.0.113.2/29 with default gateway 203.0.113.1. A /29 subnet contains eight addresses: one network, one broadcast, and six usable. Because the ISP gateway occupies the first usable address (203.0.113.1), the firewall must take the next available host address, 203.0.113.2, and use the ISP as its default gateway. This satisfies the requirement of using the first usable host IP for the firewall interface.

Answer

Static IP 203.0.113.1/29 with default gateway 203.0.113.2

Answer

DHCP client on the untrust interface with default gateway learned automatically

Answer

Static IP 203.0.113.6/29 with default gateway 203.0.113.1

Question 2

An administrator is configuring a new security zone named 'DMZ-Web' on a PA-5220. The DMZ hosts must be reachable from the internet on TCP 443, and the firewall must perform Destination NAT to translate the public IP 198.51.100.10 to the internal web server 10.10.10.50. The administrator has already created the security policy allowing untrust to DMZ-Web on TCP 443. Which additional configuration is required to complete the deployment?

Accepted Answer

A NAT policy with source zone untrust, destination zone DMZ-Web, destination address 198.51.100.10, and translated destination 10.10.10.50. Inbound access to an internal server requires destination NAT that maps the public IP to the private server IP. The NAT policy must reference the original destination zone (where the packet arrives), the translated destination zone (where the server resides), and the specific addresses. The pre-existing security policy then permits the translated flow.

Answer

A NAT policy with source zone DMZ-Web, destination zone untrust, source address 10.10.10.50, and translated source 198.51.100.10

Answer

A policy-based forwarding rule that redirects traffic destined to 198.51.100.10 to the DMZ-Web interface

Answer

A static route for 198.51.100.10/32 pointing to the DMZ-Web interface

Question 3

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal segments. The requirement is to decrypt outbound SSL traffic to inspect for threats, but certain financial websites must be excluded from decryption due to privacy regulations. The engineer has created a decryption policy with a rule to decrypt all SSL traffic and a rule to exclude the financial sites. However, users report that they can still access the financial sites without decryption. What is the most likely cause?

Accepted Answer

The decryption exclusion rule is placed after the decryption rule, so it is never matched.. Decryption policies are processed in order, and the first matching rule determines the action. Placing the no-decrypt rule for financial sites below the decrypt-all rule means the decrypt rule matches first, so those sites are decrypted instead of excluded. The correct configuration requires the no-decrypt rule to be above the decrypt rule to ensure financial traffic is excluded from decryption.

Answer

The forward proxy certificate is not trusted by the client browsers, causing decryption to fail silently.

Answer

The SSL decryption profile is not attached to the decryption rule, so decryption is bypassed.

Answer

The financial sites use certificate pinning, which prevents decryption and causes the firewall to bypass decryption automatically.

Question 4

A security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The requirement is to send only threat logs and traffic logs, and to ensure that logs are sent in a reliable manner. Which configuration should the administrator use?

Accepted Answer

Configure a Syslog server profile with the desired log types and select TCP as the transport protocol.. To reliably send specific log types to an external syslog server, the administrator must configure a Syslog server profile that includes only threat and traffic logs, and select TCP as the transport protocol. TCP provides reliable, connection-oriented delivery, ensuring logs are not lost. Other options do not address reliability or describe non-existent features.

Answer

Configure a Syslog server profile with the desired log types and enable SSL/TLS for encryption.

Answer

Configure a Syslog server profile with the desired log types and set the log format to CSV for reliability.

Answer

Configure a Syslog server profile with the desired log types and enable the 'Reliable' checkbox.

Question 5

A security engineer is deploying a pair of PA-3260 firewalls in active/passive high availability at a data center. The firewalls are directly connected via dedicated HA1 and HA2 links. The engineer wants the passive firewall to take over immediately if the active firewall fails, and also wants the passive device to monitor link state on the untrust interface so it can fail over if the upstream switch port goes down. Which combination of settings should the engineer configure?

Accepted Answer

Enable HA1 and HA2, set HA1 to a dedicated link, configure Link Monitoring on the untrust interface with a failure condition, and set preemption disabled. HA1 handles control and heartbeat, while HA2 handles session synchronization; they should use separate links. Link Monitoring tracks the physical state of a specified interface and triggers failover if that link goes down. Disabling preemption keeps the currently active firewall in the active role after recovery, which matches the requirement for immediate takeover without flapping.

Answer

Enable HA1 and HA2, set both to the same dedicated link, configure Link Monitoring on the untrust interface, and enable preemption

Answer

Enable HA1 and HA2, set HA2 to a dedicated link, configure Path Monitoring with a source IP of the management interface, and enable preemption

Answer

Enable HA1 and HA2, set HA1 to a dedicated link, configure Path Monitoring with a destination IP of the ISP gateway, and set preemption disabled

Question 6

An administrator is configuring a Palo Alto Networks firewall to use LDAP for User-ID. The environment includes an Active Directory domain controller at 10.1.1.10 and a firewall management interface at 10.1.1.1. Which TWO configurations are required to enable User-ID to map users to IP addresses via LDAP? (Choose two.)

Accepted Answer

Configure a User-ID group mapping in the LDAP server profile to retrieve group information.. To enable User-ID via LDAP, the firewall needs an LDAP server profile to connect to the directory and retrieve user and group information. Group mapping is also required to resolve group memberships for policy enforcement. User-ID is enabled on zones, not through security rules or Interface Management profiles. The combination of LDAP server profile and group mapping provides the necessary data for user-based policies.

Answer

Create a User-ID agent on the firewall and configure it to connect to the LDAP server.

Answer

Enable User-ID on the trust zone by assigning an Interface Management profile with User-ID enabled.

Answer

Enable User-ID in the security policy rule to allow user-based enforcement.

Question 7

A security administrator is configuring a Palo Alto Networks firewall to enforce a Security policy for guest wireless traffic. The requirement is that the firewall must be able to identify the application in use even when it is running on non-standard ports. Which setting in the Security policy rule must be configured to accomplish this?

Accepted Answer

Application. To identify applications on non-standard ports, the firewall uses App-ID, which is configured in the Application field of the Security policy rule. By specifying the application (or selecting 'any' and relying on App-ID), the firewall can detect the application even if it runs on a non-standard port. The Service field should be set to 'application-default' or 'any' to allow App-ID to inspect traffic on any port. The Application Override is used to force identification, not to enable it. The Action field is irrelevant to identification.

Answer

Service

Answer

Application Override

Answer

Action

Question 8

A network engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server at 192.0.2.100. The engineer wants to ensure that traffic logs, threat logs, and system logs are all forwarded to the syslog server. The syslog server is reachable from the firewall's management interface. Which configuration should the engineer perform?

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog, then apply it to the log forwarding settings for traffic, threat, and system logs. To forward logs to an external syslog server, you must first create a syslog server profile that defines the server address and port. Then you apply that profile in the log forwarding settings for each log type. This is the standard method for sending traffic, threat, and system logs to an external syslog server.

Answer

Enable syslog forwarding under Device > Setup > Operations > Syslog, then select the log types to forward

Answer

Create a log forwarding profile under Objects > Log Forwarding, then attach it to the security policies for traffic and threat logs, and to the system log settings for system logs

Answer

Configure a syslog server under Device > Setup > Management > Logging and Reporting Settings, then enable log forwarding for all log types

Question 9

An administrator is setting up a new Palo Alto Networks firewall and needs to configure the management interface with a static IP address. The management interface is currently set to DHCP. Which steps should the administrator take to assign a static IP address of 192.168.1.100/24 with a default gateway of 192.168.1.1?

Accepted Answer

Navigate to Device > Setup > Management > Management Interface Settings, edit the MGT interface, and set the IP type to Static with the desired address and gateway.. The management interface IP is configured under Device > Setup > Management > Management Interface Settings. This allows changing from DHCP to Static and specifying the IP, netmask, and default gateway. Other locations like Network > Interfaces are for dataplane interfaces, and the setup wizard is for initial setup. The CLI can also be used, but the GUI path is the standard method.

Answer

Connect to the firewall's console port and use the setup wizard to change the management IP address.

Answer

Use the CLI command 'set deviceconfig system ip-address 192.168.1.100 netmask 255.255.255.0 default-gateway 192.168.1.1'.

Answer

Navigate to Network > Interfaces > Ethernet, select the MGT interface, and configure the static IP address and default gateway.

Question 10

A network engineer is configuring a Palo Alto Networks firewall to perform source NAT for outbound traffic from the internal network 192.168.1.0/24 to the internet. The firewall has an external interface with IP 203.0.113.5. The requirement is that all outbound traffic must be translated to the external interface IP, but the source port must be preserved when possible. Which NAT configuration should be used?

Accepted Answer

Create a NAT policy with source translation type 'Dynamic IP and Port' and enable the 'Preserve Source Port' option.. The requirement is to translate all outbound traffic to the external interface IP 203.0.113.5 while preserving the source port when possible. In PAN-OS, the 'Dynamic IP and Port' source translation type has a 'Preserve Source Port' option that attempts to keep the original source port if it is available, otherwise it assigns a new port. This meets the requirement. Dynamic IP without port translation does not exist as a separate type; it is actually 'Dynamic IP and Port' with the preserve option. Static IP is one-to-one and not suitable for a subnet. Therefore, the correct configuration is Dynamic IP and Port with Preserve Source Port enabled.

Answer

Create a NAT policy with source translation type 'Static IP' and set the translated address to 203.0.113.5.

Answer

Create a NAT policy with source translation type 'Dynamic IP' and set the translated address to 203.0.113.5.

Answer

Create a NAT policy with source translation type 'Dynamic IP and Port' and set the translated address to 203.0.113.5.

Question 11

An administrator is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) to route traffic from a specific subnet (192.168.1.0/24) through a dedicated ISP link (ISP-A) while all other traffic uses ISP-B. The administrator creates a PBF policy with source 192.168.1.0/24, destination any, and egress interface as the ISP-A next-hop. However, traffic from that subnet is still going out ISP-B. The administrator verifies that the PBF policy is enabled and placed at the top of the policy list. Which TWO additional configurations are required to ensure PBF works correctly? (Choose two.)

Accepted Answer

Verify that the PBF policy's next-hop is reachable via a route in the virtual router's routing table.. For PBF to work with private IP addresses, source NAT is needed to translate the source IP to the egress interface's public IP. Additionally, the PBF next-hop must be reachable via a route in the virtual router. Without these, traffic may not be forwarded correctly. The other options are incorrect: PBF is evaluated after security policy, a static route for the source subnet is unnecessary, and symmetric return is optional.

Answer

Configure a static route for 192.168.1.0/24 pointing to the ISP-A next-hop.

Answer

Enable 'Symmetric Return' in the PBF policy to ensure return traffic uses the same path.

Answer

Ensure that the PBF policy is evaluated before the security policy that allows the traffic.

Question 12

A network administrator is setting up a new Palo Alto Networks firewall and wants to ensure that the firewall can resolve domain names for its own management traffic, such as for updates and DNS lookups. Which configuration should be used?

Accepted Answer

Configure DNS servers in Device > Setup > Management > DNS.. The firewall's management plane uses its own DNS settings, which are configured under Device > Setup > Management > DNS. This allows the firewall to resolve hostnames for management traffic, such as for updates, licensing, and logging. The dataplane DNS settings under Device > Setup > Services > DNS are for traffic passing through the firewall. A DNS proxy is for client DNS requests. Therefore, the correct configuration is in the management section.

Answer

Configure DNS servers in Device > Setup > Services > DNS.

Answer

Configure DNS servers in the management interface's IP configuration.

Answer

Configure a DNS proxy on the firewall.

Question 13

An administrator is deploying a Palo Alto Networks firewall in a high-availability active/passive configuration. The two firewalls are connected via dedicated HA interfaces. The administrator wants to ensure that if the active firewall fails, the passive firewall takes over with minimal disruption. The administrator has configured HA1 and HA2 interfaces and set up the HA peers. However, during a test failover, the passive firewall did not become active, and both firewalls remained in a non-functional state. The administrator checks the HA status and sees that the passive firewall is in a 'tentative' state. What is the most likely cause?

Accepted Answer

Link monitoring or path monitoring is enabled and detecting a failure on the passive firewall, preventing it from becoming active.. A 'tentative' HA state on the passive firewall often indicates that link monitoring or path monitoring is detecting a failure, preventing it from becoming active. This is a safety mechanism to avoid taking over with a failed link. Other options are less likely: HA1 IP misconfiguration would cause a disconnected state, preemption hold time is not relevant during a failover test, and waiting for heartbeat timeout would eventually resolve. The administrator should verify link and path monitoring settings.

Answer

The HA1 interface is not configured with a dedicated IP address for each firewall.

Answer

The passive firewall has not received a heartbeat from the active firewall and is waiting for the HA1 heartbeat to time out.

Answer

The passive firewall is configured with a preemption hold time that has not yet expired.

Question 14

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Accepted Answer

Another rule earlier in the policy matches the traffic and allows it before reaching this rule.. In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.

Answer

The firewall is configured to not log interzone traffic.

Answer

The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

Answer

The logging profile is not applied to the rule.

Question 15

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Accepted Answer

allow. The correct action is 'allow' because the security engineer needs to permit inbound HTTPS traffic from the Untrust zone to the DMZ web server. In Palo Alto Networks firewalls, the security policy action 'allow' explicitly permits the traffic to pass through the firewall, which is required for legitimate inbound web traffic.

Answer

reset-both

Answer

deny

Answer

drop