PCNSE Deploy and Configure Firewalls Practice Test 4 — 15 Questions

Question 1

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rule with a 'deny' action appears earlier in the security policy.. The most likely reason the inter-zone rule is not matched is that a preceding rule with a 'deny' action is matching the traffic first. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom, and the first matching rule determines the action. If an earlier rule denies the traffic, the later allow rule will never be evaluated, even if it would otherwise match.

Answer

The source address 10.0.0.0/8 is not included in the source zone.

Answer

The destination address is set to 'any', which is not valid.

Answer

The traffic is intra-zone, not inter-zone.

Question 2

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Two physical or subinterfaces assigned to the vwire.. A virtual wire (vwire) requires exactly two interfaces to function as a transparent bridge between two network segments. These interfaces can be physical or subinterfaces, and they must be assigned to the vwire to pass traffic without Layer 3 processing. Without two interfaces, the vwire cannot forward frames between the connected devices.

Answer

A management profile must be applied to the vwire.

Answer

A zone must be assigned to the vwire.

Answer

The interfaces must be of type 'aggregate'.

Question 3

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Accepted Answer

The VLAN ID is misconfigured as 20 instead of 10.. The exhibit shows the sub-interface is configured with VLAN ID 20, but the administrator intended VLAN 10. In Palo Alto Networks firewalls, sub-interfaces use 802.1Q VLAN tagging, and the VLAN ID must match the tag on incoming frames. Mismatched VLAN IDs cause the firewall to drop or ignore traffic because the sub-interface only processes frames with the configured tag.

Answer

The IP netmask is /24 but should be /16.

Answer

The zone is incorrectly named 'VLAN10'.

Answer

The virtual router is not correctly set.

Question 4

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 5

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Accepted Answer

Source NAT with IP and port translation (PAT). Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Answer

Dynamic NAT (1:1 pool)

Answer

Static NAT (1:1)

Answer

Destination NAT

Question 6

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

Accepted Answer

The security rule 'Allow-SSL' has 'service' set to 'application-default' but the website uses port 8443.. The security rule 'Allow-SSL' is configured with 'service' set to 'application-default', which means it only permits traffic on the default port for SSL (TCP 443). Since the website uses port 8443, the traffic is denied because the rule does not match the non-standard port. The firewall's application identification still correctly identifies the traffic as 'ssl', but the service constraint prevents the rule from applying, resulting in a deny action.

Answer

The destination IP is in a blacklist.

Answer

The security rule is placed too low in the rulebase.

Answer

The SSL certificate is expired.

Question 7

By default, what is the action on traffic between two different zones without any security rule?

Accepted Answer

deny. By default, Palo Alto Networks firewalls implement an implicit deny rule for inter-zone traffic. This means that if no security rule explicitly matches traffic between two different zones, the firewall drops the packet and logs it as a deny action. This default behavior ensures that all cross-zone traffic must be explicitly allowed by a security policy, enforcing a zero-trust model.

Answer

allow

Answer

depends on the application

Answer

prompt

Question 8

An administrator adds a new security rule to allow outbound 'web-browsing' and 'ssl' traffic. After committing, users report that some HTTPS sites are still blocked. Traffic logs show that the traffic matches the new rule but is denied. What is the most likely cause?

Accepted Answer

The service 'application-default' does not match the port used by the site.. When a security rule uses the 'application-default' service, the firewall only allows traffic that matches the default port for the specified application. For 'web-browsing' (HTTP), the default port is TCP 80, and for 'ssl' (HTTPS), the default port is TCP 443. If an HTTPS site uses a non-standard port (e.g., TCP 8443), the traffic matches the rule based on the application but is denied because the service 'application-default' does not recognize that port as valid for the application.

Answer

A decryption policy is required for HTTPS traffic.

Answer

The application filter does not include 'ssl'.

Answer

The rule is placed too low in the rulebase.

Question 9

In an Active/Passive HA pair, which statement is true regarding configuration synchronization?

Accepted Answer

Only committed changes on the active are synced to the passive.. In an Active/Passive HA pair, configuration synchronization occurs only after changes are committed on the active firewall. The passive peer then receives the committed configuration via the HA control link (using TCP port 2928 by default). This ensures that only validated, committed changes are propagated, preventing the passive from receiving uncommitted or partial configurations that could cause instability.

Answer

Configuration is not synced automatically; the administrator must export and import.

Answer

All configuration changes on the active peer are automatically synced to the passive.

Answer

The passive peer initiates the sync.

Question 10

A company uses a custom application definition for a proprietary application that runs on UDP port 12345. The security rule allowing the application is configured, but traffic logs show the application as 'unknown' instead of matching the custom app. What is the most likely cause?

Accepted Answer

The traffic is not matching the app's protocol or port in the signature.. The custom application definition specifies UDP port 12345, but if the actual traffic uses a different port or does not match the protocol (UDP) defined in the signature, the firewall will classify it as 'unknown'. The security rule allows the application, but the traffic must first be identified by the App-ID engine based on the signature's protocol and port criteria; a mismatch here prevents proper classification.

Answer

The custom application signature is not associated with the security rule.

Answer

The firewall is running in L2 mode.

Answer

The application timeout is too short.

Question 11

An administrator wants to ensure that all traffic from the 'Trust' zone to the 'Untrust' zone is inspected by WildFire. Which configuration is required?

Accepted Answer

Configure a WildFire profile and attach it to the security rule.. WildFire inspection is applied via a security rule using a WildFire Analysis profile. The profile defines the file types and verdict actions (e.g., alert, block) for files submitted to WildFire. Attaching this profile to the security rule that governs Trust-to-Untrust traffic ensures all matching traffic is inspected by WildFire.

Answer

Create a separate WildFire rule.

Answer

Enable WildFire on the security rule.

Answer

Enable WildFire globally under Device > Setup.

Question 12

Which THREE of the following are mandatory components for GlobalProtect client connectivity?

Accepted Answer

Authentication profile.. Option A (Authentication profile) is correct because the GlobalProtect portal and/or gateway must reference an authentication profile to authenticate users before granting access, making it a mandatory component for client connectivity. Option D (Gateway configuration) is correct because the GlobalProtect gateway is the actual security enforcement point that terminates the client tunnel and provides access to protected resources; without it, clients cannot establish connectivity. Option E (Portal configuration) is correct because the portal is the initial connection point that delivers client configuration and gateway information to the GlobalProtect agent, and it is required for the client to discover and connect to gateways. Option B (Client certificate) is not mandatory because certificate-based authentication is only one possible method; username/password or other authentication methods can be used instead. Option C (DNS suffix) is not mandatory because it is an optional configuration setting used for split-DNS or internal name resolution, not a requirement for establishing GlobalProtect connectivity.

Answer

Client certificate.

Answer

DNS suffix.

Question 13

A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?

Accepted Answer

The user's IP is not in the User-ID mapping table. When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.

Answer

The security policy order is incorrect

Answer

The firewall is not configured to use the User-ID agent

Answer

The User-ID agent is not running

Question 14

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 15

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards