PCNSE Hard Questions — 25 Difficult Questions

Question 1

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Microsoft Entra ID response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 2

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

Accepted Answer

The session was idle for longer than the timeout threshold.. The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Answer

The session was terminated by a firewall policy.

Answer

The session was forcibly closed by an administrator.

Answer

The session ended due to a TCP FIN/RST from the client.

Question 3

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 4

A large enterprise uses an active/passive HA pair of PA-5250 firewalls to secure their data center. The network team recently migrated from a flat network to a VXLAN-based overlay. After the migration, they notice that during failover tests, the new active firewall does not forward traffic for VXLAN-terminated VLANs, even though the physical interfaces are up and the HA state transitions correctly. The configuration uses subinterfaces on Ethernet1/1 for each VLAN, with VXLAN tunnel termination on the firewall. The passive firewall receives the configuration sync, but show vxlan tunnel shows no VXLAN tunnels on the new active firewall after failover. The sessions are synced via HA2. The ARP table is correct. Which course of action should the engineer take to resolve the issue?

Accepted Answer

Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.. VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.

Answer

Add static routes for the VXLAN tunnel endpoints on the passive firewall.

Answer

Enable VXLAN tunnel synchronization under HA setup.

Answer

Reboot the new active firewall to reload the VXLAN configuration.

Question 5

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 6

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

Accepted Answer

The gateway's 'Allow Access' list does not include the user. After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Answer

The user's GlobalProtect client software is outdated

Answer

The gateway's interface is not in the same zone as the portal

Answer

The portal's 'Access' list does not include the user

Question 7

A GlobalProtect user behind the tunnel is unable to browse HTTPS websites. What is the issue?

Accepted Answer

The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped. When a GlobalProtect tunnel is established, the firewall applies tunnel inspection to decrypt and inspect traffic inside the tunnel. If a no-decrypt rule exists (e.g., for certain traffic or users), it conflicts with the tunnel inspection requirement, causing the firewall to drop SSL sessions because it cannot both inspect and bypass decryption. This results in HTTPS websites being unreachable for the user behind the tunnel.

Answer

The firewall's decryption policy is not applied to the tunnel

Answer

The decryption policy rule blocks traffic from 10.0.0.0/8

Answer

The user's SSL certificate is not trusted

Question 8

A security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The requirement is to send only threat logs and traffic logs, and to ensure that logs are sent in a reliable manner. Which configuration should the administrator use?

Accepted Answer

Configure a Syslog server profile with the desired log types and select TCP as the transport protocol.. To reliably send specific log types to an external syslog server, the administrator must configure a Syslog server profile that includes only threat and traffic logs, and select TCP as the transport protocol. TCP provides reliable, connection-oriented delivery, ensuring logs are not lost. Other options do not address reliability or describe non-existent features.

Answer

Configure a Syslog server profile with the desired log types and enable SSL/TLS for encryption.

Answer

Configure a Syslog server profile with the desired log types and set the log format to CSV for reliability.

Answer

Configure a Syslog server profile with the desired log types and enable the 'Reliable' checkbox.

Question 9

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

Accepted Answer

The URL category for banking is not correctly identified.. The most likely issue is that the URL category for banking is not correctly identified, so the 'No Decrypt' rule does not match the banking traffic. If the firewall fails to categorize the banking URLs correctly (e.g., due to outdated URL database, custom categories, or SSL decryption bypass), the traffic falls through to the second rule ('Decrypt all other traffic') and gets decrypted. The rule order is correct (No Decrypt first, then Decrypt), so the problem is matching.

Answer

The SSL Forward Proxy profile is set to ignore the decryption policy.

Answer

The firewall is using a different decryption port than 443.

Answer

The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.

Question 10

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Accepted Answer

The traffic matched a security rule that explicitly denies it. The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Answer

A threat prevention profile detected and blocked the session

Answer

The traffic was blocked because the application is not allowed

Answer

The destination URL is categorized as prohibited

Question 11

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 12

A network security engineer is configuring a Palo Alto Networks firewall to perform URL filtering. The company requires that all HTTP and HTTPS traffic from the trust zone to the untrust zone be inspected, and that access to known malware sites be blocked. The firewall is running PAN-OS 10.1. The engineer has already created a URL filtering profile with the appropriate categories set to block. Which additional configuration is required to ensure that HTTPS traffic is filtered based on the full URL?

Accepted Answer

Enable SSL decryption for the trust zone and apply a decryption policy for HTTPS traffic.. To filter HTTPS based on the full URL, the firewall must decrypt the traffic to inspect the HTTP Host header and path. SSL decryption, configured via a decryption policy, allows the firewall to act as a forward proxy. Without decryption, URL filtering for HTTPS is limited to server name indication or certificate information, which may not cover the full URL. Therefore, enabling SSL decryption is the necessary step.

Answer

Configure a security policy rule with application 'ssl' and attach the URL filtering profile.

Answer

Enable 'HTTP Header Logging' in the URL filtering profile and commit.

Answer

Create a custom URL category with the malware sites and apply it to a security policy rule.

Question 13

An administrator has applied the above configuration on a firewall. What will happen to traffic destined to TCP port 2525?

Accepted Answer

All traffic on TCP port 2525 will be classified as the application 'smtp'.. The firewall's application override configuration explicitly maps TCP port 2525 to the application 'smtp'. When an application override is applied, the firewall bypasses App-ID and classifies all traffic matching the specified port and protocol as the defined application, regardless of the actual payload. This means any traffic on TCP port 2525 will be treated as SMTP traffic for policy enforcement and inspection purposes.

Answer

The firewall will perform deeper inspection to identify the application.

Answer

The traffic will be blocked because the application is unknown.

Answer

The traffic will be treated as generic TCP and passed without inspection.

Question 14

A firewall is configured with User-ID using the 'Server Monitoring' method via LDAP. The administrator notices that user-to-IP mappings are only being updated every 60 minutes instead of the configured 15-minute polling interval. The LDAP server is reachable and responds quickly. What configuration parameter is most likely causing the delayed update?

Accepted Answer

The 'User-ID' mapping aging time is set to 60 minutes.. The User-ID mapping aging time determines how long a user-to-IP mapping remains in the firewall's table before it is removed. When a mapping exists, the firewall will not overwrite it with a new mapping for the same user, even if a newer mapping is received from the LDAP server during a poll. Instead, the existing mapping must first age out (after the aging time expires) before a new mapping can be created. Therefore, even though the polling interval is 15 minutes, changes in user-to-IP mappings (such as a new IP address) will only appear after the mapping aging time of 60 minutes has elapsed. This explains why updates are only seen every 60 minutes.

Answer

The firewall's 'Log Forwarding' profile is slowing down the User-ID process.

Answer

The 'User-ID Agent' is configured with a 'Timeout' of 60 minutes.

Answer

The 'Server Monitoring' profile has a 'Retry Interval' set to 60 minutes.

Question 15

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 16

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Accepted Answer

The rule is missing a 'from' zone specification.. A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer

The 'interface-address' option requires a specific translated address.

Answer

The rule should be under 'destination-nat' instead of 'source-nat'.

Answer

The 'to-interface' should be 'any'.

Question 17

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Accepted Answer

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.. The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer

The service 'application-default' does not allow TCP port 443.

Answer

The packet is not logged properly.

Answer

The destination IP is not routable in the virtual router.

Question 18

A security engineer is deploying a new PA-5220 firewall to replace an existing legacy firewall. The environment has complex routing with OSPF and BGP. The engineer configures the firewall with multiple virtual routers: one for the internal network, one for the DMZ, and one for the external connection to two ISPs. The firewall is placed in Layer 3 mode. After the cutover, users report that they can access the internet but internal traffic between two different subnets that are both in the internal virtual router fails to route properly. The engineer checks the routing table on the internal virtual router and sees correct OSPF learned routes. The security policies allow all traffic between those subnets. What is the most likely cause of the routing failure?

Accepted Answer

The internal interfaces are assigned to different virtual routers. The most likely cause is that the internal interfaces are assigned to different virtual routers. In a Palo Alto Networks firewall, Layer 3 interfaces belong to a specific virtual router, and routing between subnets in different virtual routers requires either a route leak or a shared virtual router. Since the engineer placed both subnets in the same internal virtual router but the interfaces are in different virtual routers, the firewall cannot route traffic between them even if the routing table and security policies are correct.

Answer

The firewall does not have a loopback interface for OSPF router-id

Answer

The security policy is not correctly identifying the traffic due to asymmetric routing

Answer

The OSPF metric is too high, causing route preference issues

Question 19

A medium-sized enterprise has a PA-3220 firewall deployed in a data center with two ISPs (ISP-A and ISP-B) for redundancy. The firewall is configured with two virtual routers: VR-Trust for internal networks and VR-Untrust for external connections. Each ISP is connected to a separate physical interface (ethernet1/1 for ISP-A, ethernet1/2 for ISP-B) and both are placed in VR-Untrust with static default routes. The internal network uses 10.0.0.0/16. The firewall has a security policy that allows all outbound traffic from internal to external. Recently, users have reported that internet access is slow during peak hours. The administrator checks the dataplane CPU and sees it averaging 80-90%. The session count is 200,000 out of a maximum of 500,000. The administrator also notices that the firewall is using only ISP-A for all outbound traffic, even though both ISPs have equal bandwidth. The administrator wants to reduce CPU usage and utilize both ISP links. Which action should the administrator take?

Accepted Answer

Configure ECMP on VR-Untrust with source IP hash load balancing. The administrator needs to reduce CPU usage and utilize both ISP links. Configuring ECMP (Equal-Cost Multi-Path) on VR-Untrust with source IP hash load balancing allows the firewall to distribute outbound traffic across both ISP links based on the source IP hash, which spreads sessions across multiple paths without requiring policy-based forwarding. This reduces the load on a single link and can help lower CPU utilization by balancing the session processing load across both interfaces, as the firewall can use multiple next hops for the same destination.

Answer

Increase the maximum session limit to 1,000,000

Answer

Disable logging for all security policies

Answer

Configure the firewall to use active/passive ISP failover

Question 20

An organization uses GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show that the traffic from the GlobalProtect IP pool to internal servers is allowed. What is the most likely cause?

Accepted Answer

The internal server's default gateway does not point to the firewall.. The most likely cause is that the internal server's default gateway does not point to the firewall. When GlobalProtect clients receive an IP from the VPN IP pool and send traffic to internal servers, the servers must send return traffic back through the firewall to maintain stateful session symmetry. If the server's default gateway points elsewhere (e.g., a core switch), the firewall drops the return traffic because it does not match an existing session, causing connectivity failure despite the firewall logs showing allowed outbound traffic.

Answer

The GlobalProtect gateway is not configured with a route to internal network.

Answer

The client's VPN adapter is not set to use the default gateway on the remote network.

Answer

The security policy for internal traffic is misconfigured.