PCNSE Deploy and Configure Firewalls — Timed 40 Questions

Question 1

A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?

40 minute time limit — choose an answer to begin.

Accepted Answer

The HA2 link is down or misconfigured.. In active/passive HA, the HA2 link is used for session synchronization and state propagation. If the HA2 link is down or misconfigured, the active firewall cannot synchronize session state to the passive unit, causing it to report 'non-functional' even though the passive unit sees itself as 'passive'. The HA1 link handles heartbeats and configuration sync, which may still be operational, but without a functional HA2 link, the HA pair cannot maintain proper state synchronization, leading to the active firewall's non-functional state.

Answer

The HA1 link is down or misconfigured.

Answer

The HA2 link is being used for management traffic.

Answer

The preemptive setting is enabled on both firewalls.

Question 2

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Accepted Answer

The static route in VR1 does not point to an interface or next hop that is reachable via VR2.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Answer

The firewall does not support multiple virtual routers.

Answer

The virtual routers are not connected to each other.

Answer

NAT is not configured on VR2.

Question 3

Which THREE of the following are valid methods to enable traffic logging when configuring a security rule?

Accepted Answer

Set 'Log at Session End' in the rule.. Setting 'Log at Session End' in a security rule explicitly instructs the firewall to generate a traffic log entry when the session terminates, capturing the complete session details including bytes transferred and duration. This is a direct method to enable logging for the rule's traffic.

Answer

Enable 'Logging' under the rule's 'Actions' tab.

Answer

Configure 'Log at Rule Match' under the rule's 'Advanced' settings.

Question 4

You are deploying a pair of PA-5250 firewalls in active/passive HA mode for a large enterprise. The firewalls are configured with multiple virtual routers (VRs) to segment traffic: VR-A for internal corporate network, VR-B for DMZ, and VR-C for Internet edge. Each VR is associated with a separate Vsys. The HA pair uses IPsec tunnel monitoring to determine failover. The customer reports that after a recent configuration change, failover does not occur when the primary firewall's Internet-facing interface (ethernet1/1) goes down. You verify that the primary firewall detects the interface failure, but the secondary does not take over. The HA configuration shows: 'monitor failure only' set to 'link-status', 'monitor hold time' 1000ms, 'promotion hold time' 2000ms, and 'monitor failure condition' is 'any'. The IPsec tunnel monitoring is configured for tunnel to a remote site. The path monitoring includes the Internet-facing interface under VR-C. What is the most likely reason for the failover failure?

Accepted Answer

The IPsec tunnel monitoring is configured, but it is not a valid HA monitoring method; only path, interface, and route monitoring are supported.. The failover failure occurs because the 'monitor failure only' setting is set to 'link-status', which means only interface monitoring link status changes can trigger failover. The Internet-facing interface is included only in path monitoring, not in interface monitoring, so its link-down event is not detected by interface monitoring. Path monitoring is configured but its failures are ignored for failover due to the 'link-status' setting. IPsec tunnel monitoring is not a supported HA monitoring method on Palo Alto Networks firewalls. Therefore, no valid monitoring method is able to trigger failover when the interface goes down, explaining why the secondary does not take over.

Answer

The use of multiple virtual routers prevents HA from monitoring interfaces across VRs.

Answer

The 'monitor hold time' is too short, causing flapping to be ignored.

Answer

The 'monitor failure only' is set to 'link-status' instead of 'path-monitoring'.

Question 5

A company has deployed two PA-5250 firewalls in an active/passive high-availability pair. The passive firewall shows the status 'non-functional' after a reboot. The active firewall is still passing traffic. The administrator checks the HA configuration and sees that the preemptive setting is enabled on both firewalls. What is the most likely cause of the passive firewall showing 'non-functional'?

Accepted Answer

The hello interval on the passive firewall is set to a different value than on the active firewall.. The passive firewall reports 'non-functional' after a reboot if it cannot establish an HA1 control link with the active firewall. The most likely cause in this scenario is a mismatch in the hello interval between the two firewalls, which prevents the HA pair from forming. The preemptive setting does not affect the initial functional status; it only influences role preemption after a failover. The management port (MGT) is not used for HA1 in default deployments and its status would not impact HA functionality unless explicitly configured as an HA1 backup.

Answer

The preemptive setting is causing the passive firewall to remain in non-functional state until a failover occurs.

Answer

The HA2 keepalive timer has expired.

Answer

The management port (MGT) on the passive firewall is down or unplugged.

Question 6

A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)

Accepted Answer

Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.. Option B is correct because it allows outbound HTTPS traffic by using the Palo Alto Networks application 'ssl' with service 'application-default', which permits TCP/443 for SSL/TLS traffic from the internal-users zone to the external zone, satisfying requirement (1). Option C is correct because it permits inbound SMTP from the external zone to the internal mail server by matching application 'smtp' with service 'application-default' (TCP/25), satisfying the exception in requirement (2). Option A is not correct because it uses a port-based service tcp/443 instead of the application-based 'ssl' and does not restrict the source to internal users, which is less precise and not the intended application-default rule. Option D is not correct because allowing any application and any service from internal to external would permit all outbound traffic, violating the least-privilege intent and not specifically enforcing HTTPS. Option E is not correct because 'web-browsing' is HTTP (TCP/80), not HTTPS, so it would not satisfy the outbound HTTPS requirement.

Answer

Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.

Answer

Rule: from internal to external, source any, destination any, application any, service any, action allow.

Answer

Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.

Question 7

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Accepted Answer

The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.. The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.

Answer

The destination network 10.3.3.0/24 is not in the routing table.

Answer

The source network 10.2.2.0/24 is not in the routing table.

Answer

The default route 0.0.0.0/0 is missing.

Question 8

Order the steps to configure an IPsec VPN tunnel between two Palo Alto firewalls.

Accepted Answer

Configure IKE Gateway, then IPsec Crypto Profile, then Tunnel Interface, then Security Policy. The correct order for configuring an IPsec VPN tunnel on Palo Alto firewalls is: first configure the IKE gateway (Phase 1 authentication), then the IPsec crypto profile (Phase 2 encryption and authentication), then create the tunnel interface (which binds the IPsec parameters), and finally configure security policies to permit the desired traffic through the tunnel. This sequence ensures all dependencies are met and avoids configuration errors.

Answer

Configure Tunnel Interface, then IKE Gateway, then IPsec Crypto Profile, then Security Policy

Answer

Configure Security Policy, then IKE Gateway, then IPsec Crypto Profile, then Tunnel Interface

Answer

Configure IKE Gateway, then Tunnel Interface, then IPsec Crypto Profile, then Security Policy

Question 9

Match each type of route to its description.

Accepted Answer

Static route: A route manually configured by an administrator.. Correct matches: A (Static: manual), C (OSPF: OSPF-learned), D (BGP: BGP-learned), F (Floating static: backup with higher distance). Distractors swap definitions for connected (B) and default (E).

Answer

Connected route: A route learned via the OSPF routing protocol.

Answer

Default route: A static route with a next-hop of 0.0.0.0.

Question 10

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Accepted Answer

The application 'ssl' is not allowed in any security rule.. The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Answer

The session ended with TCP FIN, causing the firewall to deny.

Answer

The destination IP is blacklisted.

Answer

The security rule 'default-deny' explicitly blocks this traffic.

Question 11

Which of the following is NOT a valid method to identify users for User-ID on a Palo Alto Networks firewall?

Accepted Answer

XML API. The XML API is not a method for identifying users for User-ID; it is a management interface used to configure, monitor, and retrieve data from the firewall programmatically. User-ID relies on mechanisms that actively map IP addresses to usernames, such as LDAP sync, Terminal Services Agent, and Captive Portal, none of which involve the XML API.

Answer

LDAP sync

Answer

Terminal Services Agent (TS Agent)

Answer

Captive Portal

Question 12

In a Panorama-managed deployment, the device group has a rule called 'Allow-Web' that allows 'web-browsing'. The local firewall also has a rule with the same name and content. After Panorama pushes the device group configuration, what happens to the local rule?

Accepted Answer

Both rules are present; the device group rule takes precedence and the local rule is not installed.. In a Panorama-managed deployment, when a device group rule and a local firewall rule share the same name, Panorama does not overwrite or delete the local rule. Instead, the device group rule is installed and takes precedence, while the local rule remains on the firewall but is not active in the rulebase. This is because Panorama manages the device group configuration as a separate administrative domain, and local rules are preserved to allow for local override scenarios.

Answer

The local rule is overwritten by the device group rule.

Answer

The local rule is deleted.

Answer

The rules are merged into a single rule.

Question 13

Which TWO of the following are prerequisites for configuring User-ID on an interface?

Accepted Answer

A User-ID agent must be installed.. Option C is correct because configuring User-ID on an interface requires that a User-ID agent (or an equivalent source of user mapping information, such as a User-ID agent, Terminal Services agent, or integrated agent) be installed and configured so the firewall can receive IP-to-user mappings. Option D is correct because User-ID must be enabled on the zone that contains the interface; enabling User-ID at the zone level is the prerequisite that allows the interface to participate in User-ID processing. Option A is incorrect because FIPS mode is a compliance setting unrelated to User-ID interface prerequisites. Option B is incorrect because while an interface must belong to a zone for normal policy enforcement, zone membership alone is not the specific User-ID prerequisite being tested. Option E is incorrect because an authentication profile is used for Captive Portal or authentication policy, not as a prerequisite for enabling User-ID on an interface.

Answer

The firewall must be in FIPS mode.

Answer

The interface must be in a zone.

Answer

An authentication profile must be configured.

Question 14

Which TWO of the following are required for stateful failover in an Active/Passive HA pair?

Accepted Answer

HA1 link configured with a dedicated interface.. In an Active/Passive HA pair, stateful failover requires the HA1 link (management/control plane synchronization) and the HA2 link (data plane session synchronization) to be configured with dedicated interfaces. The HA1 link ensures heartbeat and configuration sync, while the HA2 link synchronizes session tables so that the passive firewall can seamlessly take over active sessions without disruption.

Answer

HA3 link configured with a dedicated interface.

Answer

Heartbeat backup link configured.

Answer

Session table synchronization enabled.

Question 15

A company has a firewall with multiple virtual routers. They need to ensure that traffic from a specific subnet (10.1.1.0/24) can reach the internet but not other internal subnets. What is the best way to achieve this?

Accepted Answer

Implement security policies with source zone and destination zone. Security policies in Palo Alto Networks firewalls control traffic based on source and destination zones, enabling you to restrict traffic from the 10.1.1.0/24 subnet (assigned to a specific zone) to only the internet zone while blocking access to other internal subnets. This is achieved by creating a security policy that allows traffic from the source zone (e.g., 'Internal') to the destination zone (e.g., 'Internet') and explicitly denying traffic to other internal zones, without relying on routing or NAT.

Answer

Use NAT policies

Answer

Configure static routes in the virtual router

Answer

Configure path monitoring

Question 16

An administrator notices that URL filtering is not blocking a specific category as configured. What is the first troubleshooting step?

Accepted Answer

Verify the security policy order. The most common reason URL filtering fails to block a specific category is that a security policy with a lower priority (higher order number) is matching the traffic before the policy with the correct URL filtering profile. Since security policies are evaluated top-down, the first match is applied, and if an earlier policy allows the traffic without URL filtering, the configured block action is never reached. Therefore, verifying the security policy order is the first and most logical troubleshooting step.

Answer

Review the URL filtering profile

Answer

Check the URL filtering license

Answer

Check the PAN-DB version

Question 17

A firewall's management interface becomes unresponsive. The administrator can still ping the management IP. What is the most likely cause?

Accepted Answer

HTTP/HTTPS service disabled. When the management interface is unresponsive to HTTPS/SSH but still responds to ICMP (ping), it typically indicates that the management services (HTTP/HTTPS) are disabled on the interface. Ping operates at the network layer (ICMP) and does not require the management daemon to be running, while HTTPS requires the web server process to be enabled and bound to the management interface. This is a common misconfiguration in Palo Alto Networks firewalls where the 'HTTP' or 'HTTPS' service is unchecked under the Management Interface Settings.

Answer

Management interface IP conflict

Answer

CPU overload

Answer

Management profile misconfiguration

Question 18

An administrator wants to ensure that all traffic from the internal network to the internet uses a specific public IP address for source NAT. There are multiple public IP addresses available. What is the best way to achieve this?

Accepted Answer

Create a dynamic IP and port (DIPP) NAT policy with the specific IP as translated address. A Dynamic IP and Port (DIPP) NAT policy allows you to specify a single translated address (the specific public IP) while still performing port address translation (PAT) to handle multiple internal sessions. This ensures all outbound traffic uses that exact public IP, unlike a pool which would distribute across multiple IPs. DIPP is the standard method for source NAT with a single IP when many internal hosts need concurrent internet access.

Answer

Configure a NAT IP pool

Answer

Use a static NAT policy

Answer

Use a PAT pool

Question 19

A firewall is configured with multiple virtual wire interfaces. Traffic passes through but the firewall cannot enforce security policies based on source/destination IP addresses. What is the reason?

Accepted Answer

Virtual wire mode does not support IP-based policies. In virtual wire mode, the firewall operates as a transparent Layer 2 bridge, forwarding frames based on MAC addresses without performing any IP routing or inspection of Layer 3 headers. Because the firewall does not see the source or destination IP addresses in the traffic, it cannot enforce security policies that rely on IP-based criteria. Option D correctly identifies that virtual wire mode inherently does not support IP-based policies.

Answer

The virtual wire is not configured with zones

Answer

The virtual wire requires a VLAN tag

Answer

The security policy is in layer 3 mode

Question 20

Which TWO statements are true about Palo Alto Networks firewall management access?

Accepted Answer

Management profiles control access to the firewall. Management profiles control which management services (e.g., HTTPS, SSH, ping) are allowed on a given interface. Without an applied management profile, no management services are permitted on that interface. Option B is incorrect: HTTPS is enabled by default only on the MGT port, not on all interfaces. Option C is correct: Management access can be allowed from any zone by configuring a management profile on an interface in that zone. Option D is incorrect: The MGT port is dedicated, but management access can also be configured on data interfaces. Option E is incorrect: SSH access is not always enabled; it depends on the management profile. Therefore, A and C are correct.

Answer

HTTPS is enabled by default on all interfaces

Answer

The management interface can be configured for MGT port only

Answer

SSH access is always enabled