PCNSE Hard Questions — 25 Difficult Questions

Question 1

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Option D is correct because resource profiles allow you to allocate CPU, session, and memory limits per vsys. Option A (QoS) manages bandwidth, not CPU. Option B (session limits) only restricts session count, not CPU. Option C (packet filtering) is not a resource allocation feature.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 2

A security engineer is troubleshooting a connectivity issue where traffic from a specific internal host is allowed by security policy but fails to establish a connection to an external server. The firewall logs show the session was created, but no response packets are seen. What is the most likely cause?

Accepted Answer

The source NAT is not configured.. When traffic from an internal host is allowed by security policy and the session is created but no response packets are seen, the most likely cause is that source NAT (also known as outbound NAT or PAT) is not configured. Without source NAT, the firewall forwards the packet with the internal private IP address as the source, and the external server sends responses back to that private address, which is not routable over the public internet. The firewall sees the session as created because it matched the security policy and forwarded the initial packet, but the return traffic never reaches the firewall, so no response packets are logged.

Answer

The destination NAT is configured incorrectly.

Answer

The security policy is missing the return traffic rule.

Answer

The firewall is in FIPS mode.

Question 3

A firewall is using App-ID to identify applications running on non-standard ports. The administrator has configured a custom application with a default port of 8080, but traffic on port 8080 is still not being identified correctly. The application uses multiple connections on different ports. What is the most likely cause?

Accepted Answer

The application is defined with the wrong protocol (TCP vs UDP).. Custom applications require both a default port and a protocol type (TCP/UDP). If the protocol is not specified correctly, App-ID may fail. Option A (timeout setting) affects session termination but not identification. Option B (require URL categorisation) is for HTTP applications. Option D (disabling content-ID) might affect visibility but not basic identification. The issue is likely the protocol definition.

Answer

The application's timeout value is too short.

Answer

Content-ID is disabled on the security policy.

Answer

The application requires URL categorization to be enabled.

Question 4

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. Option B is correct because DNS Security and WildFire are cloud-delivered services that require an active internet connection to the Palo Alto Networks cloud for real-time analysis and signature retrieval. Unlike local threat prevention, these services offload processing to the cloud, enabling detection of unknown threats without consuming firewall resources.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 5

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. Option B is correct because TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 6

Which THREE of the following are mandatory components for GlobalProtect client connectivity?

Accepted Answer

Authentication profile.. The GlobalProtect portal and gateway are the two fundamental server-side components required for client connectivity. The portal provides the initial configuration, including gateway lists and client settings, while the gateway terminates the VPN tunnel and enforces security policies. An authentication profile is mandatory because the portal must verify the user's identity before the client can download the portal configuration and subsequently connect to a gateway.

Answer

Client certificate.

Answer

DNS suffix.

Question 7

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

Accepted Answer

It drops the traffic. By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Answer

It forwards the traffic normally

Answer

It logs and alerts

Answer

It strips the IP options and forwards

Question 8

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 9

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

Accepted Answer

The HA3 link is not configured or is misconfigured.. In an active/passive HA configuration, session synchronization occurs over the HA2 link (control link) and HA3 link (packet forwarding link). The HA3 link is specifically responsible for synchronizing session tables between the peers. If the HA3 link is not configured or is misconfigured, session synchronization will fail even though the HA state shows 'active' and 'passive' correctly. The HA2 link handles keepalives and configuration sync, not session sync, so its status being up does not guarantee session synchronization.

Answer

The HA2 link is down.

Answer

The passive firewall does not have management API access.

Answer

The logging settings on both firewalls are different.

Question 10

A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?

Accepted Answer

TCP sessions are being terminated due to MSS clamping issues.. The 'flow_aged_error_tcp_mss' counter increments when the firewall ages out TCP sessions due to TCP MSS (Maximum Segment Size) clamping issues. This occurs when the firewall modifies the MSS value in SYN packets to avoid fragmentation, but the actual path MTU is smaller than the clamped MSS, causing the session to be terminated prematurely. The rapid increment indicates that MSS clamping is misconfigured or the path MTU is inconsistent, leading to session failures.

Answer

The firewall is experiencing a SYN flood attack.

Answer

There is a routing loop causing packet retransmission.

Answer

The firewall's hardware acceleration is failing.

Question 11

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. Option A is correct because the Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 12

A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?

Accepted Answer

Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet. This is the standard method for inter-virtual-router routing without dynamic redistribution.

Answer

Create a security policy rule allowing the traffic between the zones.

Answer

Configure route redistribution between VR-A and VR-B using a routing protocol.

Answer

Place all interfaces in the same virtual router.

Question 13

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 14

A GlobalProtect gateway is configured as shown. Remote users report that they can connect to the gateway but cannot authenticate. The users are using the GlobalProtect client with certificate authentication. What is the most likely cause?

Accepted Answer

The gateway does not have a root CA certificate imported for validating client certificates.. Option C is correct because for client certificate authentication, the firewall must have the root CA certificate that issued the client certificates imported; otherwise, it cannot validate the client certificate. Option A is wrong as DNS is only for client DNS server assignment. Option B (IP pool exhaustion) would prevent IP assignment, not authentication. Option D (crypto profile) affects tunnel establishment, not authentication.

Answer

The IPSec crypto profile is too strong for the clients.

Answer

The IP pool is exhausted.

Answer

The DNS server is misconfigured, causing authentication failure.

Question 15

A firewall is configured with two virtual routers in an active/passive HA pair. The active firewall fails over, and after failover, traffic is not passing through the new active firewall. The interface IP addresses are configured as virtual IPs. What is the most likely cause?

Accepted Answer

The session table is not synchronized between HA peers.. Option D is correct because after failover, the session table on the new active firewall may not be synchronized if session synchronization is not enabled or if the session table was not fully synced before failover. This causes the new active firewall to not have active sessions, leading to traffic drops. Options A, B, and C are incorrect because virtual router configuration, HA synchronization, and ARP tables are typically handled automatically in HA.

Answer

The passive firewall's routing table is not synchronized.

Answer

The virtual router is not configured to use the virtual IPs.

Answer

The HA configuration does not include the virtual router.

Question 16

A firewall is part of a Panorama-managed environment. The administrator needs to ensure that only specific administrators can commit changes to devices. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure role-based access on Panorama.. Options A and B are correct. Creating an admin role with commit scope limited to specific device groups (A) and configuring role-based access on Panorama (B) are necessary to restrict commit permissions to specific administrators. Option C is incorrect because Multi-Factor Authentication is for authentication, not commit restriction. Option D is incorrect because template stacks are for template management. Option E is incorrect because Panorama does not have a built-in commit approval workflow.

Answer

Enable Multi-Factor Authentication for all admins.

Answer

Use template stacks to restrict commit permissions.

Answer

Set the firewall to require approval for commits.

Question 17

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. Options C and D are correct. C: Check session sync parameters like timeout or encryption mismatch. D: Verify that the session synchronization setting is enabled on both firewalls, as it may be disabled. A is wrong because HA1 is for control, not session data; but it's used for control messages, so if HA1 is up, that's not the issue. B is wrong because restarting HA process is disruptive and not first step. E is wrong because packet buffer protection does not affect sync.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 18

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. Option C is correct because 'request high-availability sync-to-remote' pushes the active config to the passive, resolving the mismatch. Option A is wrong because that would clear state but not sync config. Option B is wrong because it would disrupt traffic. Option D is wrong because it's not a software upgrade issue.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 19

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. Option B is correct because Active/Active uses a distribution function (like IP hash) to assign sessions to a firewall; optimizing the hash algorithm for traffic profile reduces asymmetry. Option A is wrong because session syncing all sessions would increase load. Option C is wrong because passive mode defeats purpose. Option D is wrong because link aggregation does not solve session distribution.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions

Question 20

After a power failure, both firewalls in an HA pair come up and report 'active' state. The network team confirms that the two firewalls are connected via HA1 and HA2. What is the most likely cause of the split-brain condition?

Accepted Answer

The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state. Option A is correct because the HA keepalive hold timer on HA1 is too short, causing each firewall to assume the other is dead during power-up. Option B is wrong because HA2 is for data sync. Option C is wrong because preempt is about becoming active. Option D is wrong because version mismatch would show configuration mismatch, not dual active.

Answer

The active firewall has a higher software version

Answer

Preemption is enabled on both firewalls

Answer

HA2 link is configured but not used for election