PCNSE Manage, Monitor and Operate — 15 Questions

Question 1

A firewall is configured with User-ID using the 'Server Monitoring' method via LDAP. The administrator notices that user-to-IP mappings are only being updated every 60 minutes instead of the configured 15-minute polling interval. The LDAP server is reachable and responds quickly. What configuration parameter is most likely causing the delayed update?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'User-ID' mapping aging time is set to 60 minutes.. The User-ID mapping aging time determines how long a user-to-IP mapping remains in the firewall's table before it is removed. When a mapping exists, the firewall will not overwrite it with a new mapping for the same user, even if a newer mapping is received from the LDAP server during a poll. Instead, the existing mapping must first age out (after the aging time expires) before a new mapping can be created. Therefore, even though the polling interval is 15 minutes, changes in user-to-IP mappings (such as a new IP address) will only appear after the mapping aging time of 60 minutes has elapsed. This explains why updates are only seen every 60 minutes.

Answer

The firewall's 'Log Forwarding' profile is slowing down the User-ID process.

Answer

The 'User-ID Agent' is configured with a 'Timeout' of 60 minutes.

Answer

The 'Server Monitoring' profile has a 'Retry Interval' set to 60 minutes.

Question 2

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

Accepted Answer

(addr.src eq user@domain.com) and (eventid eq auth-fail). The filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.

Answer

(addr.src eq user@domain.com) or (eventid eq auth-fail)

Answer

(addr.src eq user@domain.com) and (severity ge medium)

Answer

(src eq user@domain.com) and (eventid eq auth)

Question 3

An administrator wants to generate a report that shows the top applications by bandwidth usage over the last week. Which report type should be used to accomplish this?

Accepted Answer

Application Report. The Application Report is designed to provide visibility into application usage, including bandwidth consumption, top applications, and application-level trends over a specified time period. This report type leverages the App-ID engine to classify traffic by application, regardless of port or protocol, making it the correct choice for identifying top applications by bandwidth usage.

Answer

URL Filtering Report

Answer

Traffic Report

Answer

Threat Report

Question 4

A firewall administrator needs to troubleshoot a connectivity issue where users in the 10.0.1.0/24 subnet cannot reach the internet. The administrator suspects a missing policy. Which tool within the firewall's web interface can be used to test which security policy will be matched for a given traffic flow?

Accepted Answer

Policy Optimizer > Test Policy Match. The 'Test Policy Match' tool under Policy Optimizer allows an administrator to simulate a specific traffic flow (source/destination IP, port, protocol) and see which security policy rule it matches. This directly addresses the need to verify whether a missing or misconfigured policy is blocking internet access for the 10.0.1.0/24 subnet.

Answer

Network > Virtual Routers

Answer

Monitor > Logs > Traffic

Answer

Device > Setup > Management

Question 5

A company has a firewall with multiple virtual systems (vsys). The administrator wants to delegate management of one vsys to a junior administrator, allowing them to configure security policies but not access system settings or other vsys. Which administrative role should be assigned?

Accepted Answer

Virtual System Admin. A Virtual System Admin role is specifically designed to delegate administrative access to a single virtual system (vsys) within a Palo Alto Networks firewall. This role allows the junior administrator to configure security policies and objects within their assigned vsys, while explicitly preventing access to system settings, device-level configurations, or other virtual systems. This matches the requirement exactly.

Answer

Superuser

Answer

Device Admin

Answer

Role-Based Admin

Question 6

An administrator is troubleshooting high CPU usage on a PA-5250 firewall. The CPU usage spikes every 5 minutes. Which CLI command should be used to identify the process causing the spike?

Accepted Answer

show running resource-monitor. The 'show running resource-monitor' command displays real-time CPU and memory usage per process on Palo Alto Networks firewalls. Since the CPU spikes every 5 minutes, this command can identify which specific process (e.g., management-plane daemon, dataplane task) is consuming the most CPU during those intervals, enabling targeted troubleshooting.

Answer

show session all

Answer

show dataplane

Answer

show system resources

Question 7

A firewall is configured with two ISPs for redundancy. The administrator wants to ensure that traffic from internal users is load-balanced across both links based on source IP. Which configuration method should be used?

Accepted Answer

ECMP with source IP hash. D is correct because ECMP (Equal-Cost Multi-Path) with source IP hash enables the firewall to load-balance traffic across multiple equal-cost routes by hashing the source IP address, ensuring that all packets from the same source IP consistently use the same link. This method provides per-source-IP stickiness while distributing traffic across both ISPs, meeting the requirement for load balancing based on source IP.

Answer

Static routes with different metrics

Answer

Policy-Based Forwarding (PBF)

Answer

Path monitoring

Question 8

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

Accepted Answer

Configure log export and auto-deletion in Log Settings. The firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Answer

Add an external disk to the firewall

Answer

Disable logging for non-critical traffic

Answer

Manually delete logs from the CLI

Question 9

A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?

Accepted Answer

The passive firewall is running a different PAN-OS version. The passive firewall showing a 'non-functional' state in an Active/Passive HA pair most likely indicates a version mismatch. PAN-OS requires both firewalls in an HA pair to run the exact same software version for configuration synchronization to work. If the passive firewall is running a different PAN-OS version, it cannot properly interpret or apply the configuration from the active firewall, causing it to enter a non-functional state.

Answer

The HA2 link is down but HA1 is up

Answer

The session sync is disabled

Answer

The passive firewall has link monitoring enabled

Question 10

A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?

Accepted Answer

Configure a PCAP filter in the firewall's packet capture feature. The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.

Answer

Set up a port mirror on the upstream switch

Answer

Create an application override policy

Answer

Use tcpdump on the management interface

Question 11

Which TWO of the following are valid methods to upgrade the PAN-OS software on a firewall? (Choose two.)

Accepted Answer

Download from the Palo Alto Networks support site and install via the web interface. The PAN-OS web interface provides a built-in method to upload and install software images downloaded from the Palo Alto Networks support site. This is a standard, supported upgrade path that uses HTTPS to transfer the image to the firewall.

Answer

Insert a USB drive with the image into the firewall's USB port

Answer

Use FTP to transfer the image to the firewall

Answer

Email the image to the firewall's email-to-PAN-OS feature

Question 12

Which THREE of the following are valid actions that can be taken on a dynamic block list entry? (Choose three.)

Accepted Answer

Remove an IP address. The dynamic block list in PAN-OS allows administrators to remove an IP address from the list using the 'delete' action via the CLI or API. This is a standard operation for managing entries that were automatically added by automated threat prevention features like WildFire or AutoFocus.

Answer

Add a username to block

Answer

Convert a dynamic entry to a static entry

Question 13

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Accepted Answer

Log forwarding supports sending logs to multiple destinations. Log Forwarding in Panorama supports sending logs to multiple destinations, including syslog servers, email, SNMP traps, and Panorama collectors. This flexibility allows administrators to distribute logs for redundancy, compliance, or analysis across different systems. Option C is correct because Panorama can forward logs to multiple destinations simultaneously, not just one.

Answer

Log forwarding must use TLS encryption

Answer

Log forwarding requires an external syslog server

Answer

Log forwarding can only send logs to a single Panorama collector

Question 14

Refer to the exhibit. The firewall's disk usage is at 85% overall, and the /opt/panlogs partition is at 92%. The administrator wants to free up space without losing important log data. Which action should be taken first?

Accepted Answer

Configure log auto-deletion in the Log Settings to purge logs older than a specified period. Configuring log auto-deletion in the Log Settings allows the administrator to automatically purge older logs based on a specified retention period, freeing up disk space on the /opt/panlogs partition without manually deleting important log data. This is the safest and most controlled method, as it respects the firewall's log management policies and ensures compliance with data retention requirements.

Answer

Add an external storage device to the firewall

Answer

Delete configuration files from /opt/pancfg

Answer

Delete the /opt/panlogs directory and recreate it

Question 15

Refer to the exhibit. The firewall is experiencing high dataplane CPU usage (85%) with 45,000 active sessions out of a maximum of 100,000. Which of the following is the most likely cause of the high CPU?

Accepted Answer

SSL decryption is enabled and processing many sessions. SSL decryption is a highly CPU-intensive operation because it requires the firewall to terminate and re-encrypt TLS connections, performing asymmetric and symmetric cryptographic operations for each session. With 45,000 active sessions, even if the session count is below the 100,000 limit, the per-session processing overhead of SSL decryption can drive dataplane CPU to 85%.

Answer

The firewall is reaching its maximum session limit

Answer

The firewall is under a DDoS attack

Answer

There is a high rate of UDP sessions