PCNSE Hard Questions — 25 Difficult Questions

Question 1

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 2

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 3

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 4

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 5

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 6

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

Accepted Answer

The URL category for banking is not correctly identified.. The decryption policy rules are evaluated top-down. The administrator placed the 'No Decrypt' rule first for banking URLs, which is the correct order. However, if the banking URLs do not match the URL category defined in the rule (e.g., the category is not correctly identified or updated), the 'No Decrypt' rule will not apply. Traffic then falls through to the second 'Decrypt' rule, which decrypts all remaining traffic, including banking. Therefore, the most likely issue is that the URL category for banking is not correctly identified (Option D).

Answer

The SSL Forward Proxy profile is set to ignore the decryption policy.

Answer

The firewall is using a different decryption port than 443.

Answer

The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.

Question 7

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 8

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 9

Based on the exhibit, which THREE conclusions can be drawn?

Accepted Answer

The session was matched by the security rule 'allow-ssl'.. The exhibit shows the session matched the security rule 'allow-ssl', which is explicitly listed in the session details. This indicates that the firewall applied this rule to permit the traffic, confirming the session was matched by that specific security rule.

Answer

The source NAT is not translating the source IP.

Answer

The traffic is using UDP protocol.

Question 10

A financial institution operates a pair of PA-5260 firewalls in active/active HA using Virtual Wire mode. They are experiencing intermittent asymmetric traffic flows causing session setup failures. The firewall logs show sessions being created with a one-sided flow. Which configuration change is most likely to resolve this issue?

Accepted Answer

Configure session distribution to use IP hash instead of round-robin.. In an active/active HA pair using Virtual Wire mode, asymmetric traffic flows can cause session setup failures because each firewall may see only one direction of the traffic. Configuring session distribution to use IP hash (e.g., based on source and destination IP addresses) ensures that all packets belonging to the same flow are consistently forwarded to the same firewall, preventing one-sided sessions. This resolves the issue by guaranteeing session affinity across the HA pair.

Answer

Enable symmetric return on the virtual wire interfaces.

Answer

Disable session offloading between the HA peers.

Answer

Set the HA timer to asymmetric routing active/passive mode.

Question 11

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Accepted Answer

Application signatures and decrypted content. App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Answer

Destination IP address of the packet

Answer

Source IP address of the packet

Question 12

A security engineer is investigating a potential data exfiltration incident. The firewall logs show that a host in the DMZ made outbound connections to multiple external IPs on port 443, but the traffic was allowed. The engineer wants to review detailed session information including the amount of data transferred and the application used. Which three log types or tools should the engineer use? (Choose three.)

Accepted Answer

App-ID logs.. App-ID logs (option A) are correct because they provide detailed information about the application associated with each session, which is critical for identifying the specific application used in the outbound connections. Traffic logs (option E) are correct because they record session-level details including source/destination IPs, ports, and the amount of data transferred (bytes sent/received). The packet capture feature (option B) is correct because it allows the engineer to capture and inspect the actual packets for forensic analysis, revealing the exact data payload and application behavior.

Answer

System logs.

Answer

URL filtering logs.

Question 13

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

Accepted Answer

Resource profiles. Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.

Answer

Packet filtering rules

Answer

Session limit rules

Answer

QoS profiles

Question 14

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Accepted Answer

Log forwarding supports sending logs to multiple destinations. Log Forwarding in Panorama supports sending logs to multiple destinations, including syslog servers, email, SNMP traps, and Panorama collectors. This flexibility allows administrators to distribute logs for redundancy, compliance, or analysis across different systems. Option C is correct because Panorama can forward logs to multiple destinations simultaneously, not just one.

Answer

Log forwarding must use TLS encryption

Answer

Log forwarding requires an external syslog server

Answer

Log forwarding can only send logs to a single Panorama collector

Question 15

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Accepted Answer

The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.. When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Answer

The route lookup for the destination requires a larger MTU.

Answer

The firewall is not performing TCP MSS clamping on the traffic.

Answer

The firewall is using jumbo frames on the internal interface.

Question 16

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Accepted Answer

The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.. In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Answer

Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

Answer

The HA configuration is set to active/active mode instead of active/passive.

Answer

The heartbeat interfaces are not configured on each firewall.

Question 17

A security architect needs to enforce authentication for all application-based policies using an external authentication source with MFA. Which combination of features best achieves this?

Accepted Answer

SAML authentication with an identity provider that supports MFA. B is correct because SAML authentication with an identity provider (IdP) that supports MFA allows the firewall to offload authentication to an external IdP, which can enforce multi-factor authentication (MFA) before granting access. This meets the requirement for application-based policies to use an external authentication source with MFA, as SAML provides a standards-based (SAML 2.0) mechanism for the firewall to trust the IdP's authentication assertions, including MFA status.

Answer

Local user database with password policies

Answer

Kerberos authentication with Active Directory

Answer

RADIUS authentication with one-time passwords via token

Question 18

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

Accepted Answer

The firewall and IdP system clocks are out of sync. The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock. If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Answer

The IdP does not support IdP-initiated SAML flow

Answer

The user mapping agent is not configured

Answer

The SAML identity provider certificate is expired

Question 19

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 20

A large enterprise has deployed two Palo Alto Networks PA-5250 firewalls in active/passive HA mode with Panorama for centralized management. The network contains over 10,000 users across multiple sites. Recently, the security team deployed a new security policy rule to block a set of high-risk applications. After the commit, the firewall's CPU utilization spiked to 95% and sessions started to drop intermittently. The firewall logs show a high number of session setup failures and timeouts. The existing security policy contains over 5,000 rules. The new rule uses application-based filtering and is placed near the top of the rulebase. What is the most effective course of action to reduce CPU load while maintaining security?

Accepted Answer

Remove the new rule and implement the blocking via a Threat Prevention profile instead.. The CPU spike is caused by the firewall having to perform application identification (App-ID) on every packet matching the new rule, which is placed near the top of a 5,000-rule policy. By moving the blocking logic to a Threat Prevention profile, the firewall can block the applications at the security profile stage after a faster initial match, reducing the per-session processing overhead. This approach offloads the heavy App-ID processing from the rulebase to a profile that is applied only to relevant traffic, thus lowering CPU utilization while still blocking the high-risk applications.

Answer

Move the new rule to the bottom of the rulebase to reduce matching frequency.

Answer

Convert the new rule to use a simplified service-based filter instead of application-based to reduce processing overhead.

Answer

Increase the session table size and adjust the TCP timewait timeout to reduce session setup overhead.