PCNSE Manage, Monitor and Operate — 30 Questions

Question 1

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

Accepted Answer

(addr.src eq user@domain.com) and (eventid eq auth-fail). Option C is correct because the filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.

Answer

(addr.src eq user@domain.com) or (eventid eq auth-fail)

Answer

(addr.src eq user@domain.com) and (severity ge medium)

Answer

(src eq user@domain.com) and (eventid eq auth)

Question 2

An administrator wants to generate a report that shows the top applications by bandwidth usage over the last week. Which report type should be used to accomplish this?

Accepted Answer

Application Report. The Application Report is designed to provide visibility into application usage, including bandwidth consumption, top applications, and application-level trends over a specified time period. This report type leverages the App-ID engine to classify traffic by application, regardless of port or protocol, making it the correct choice for identifying top applications by bandwidth usage.

Answer

URL Filtering Report

Answer

Traffic Report

Answer

Threat Report

Question 3

A firewall administrator needs to troubleshoot a connectivity issue where users in the 10.0.1.0/24 subnet cannot reach the internet. The administrator suspects a missing policy. Which tool within the firewall's web interface can be used to test which security policy will be matched for a given traffic flow?

Accepted Answer

Policy Optimizer > Test Policy Match. Option B is correct because the 'Test Policy Match' tool under Policy Optimizer allows an administrator to simulate a specific traffic flow (source/destination IP, port, protocol) and see which security policy rule it matches. This directly addresses the need to verify whether a missing or misconfigured policy is blocking internet access for the 10.0.1.0/24 subnet.

Answer

Network > Virtual Routers

Answer

Monitor > Logs > Traffic

Answer

Device > Setup > Management

Question 4

A company has a firewall with multiple virtual systems (vsys). The administrator wants to delegate management of one vsys to a junior administrator, allowing them to configure security policies but not access system settings or other vsys. Which administrative role should be assigned?

Accepted Answer

Virtual System Admin. A Virtual System Admin role is specifically designed to delegate administrative access to a single virtual system (vsys) within a Palo Alto Networks firewall. This role allows the junior administrator to configure security policies and objects within their assigned vsys, while explicitly preventing access to system settings, device-level configurations, or other virtual systems. This matches the requirement exactly.

Answer

Superuser

Answer

Device Admin

Answer

Role-Based Admin

Question 5

An administrator is troubleshooting high CPU usage on a PA-5250 firewall. The CPU usage spikes every 5 minutes. Which CLI command should be used to identify the process causing the spike?

Accepted Answer

show running resource-monitor. The 'show running resource-monitor' command displays real-time CPU and memory usage per process on Palo Alto Networks firewalls. Since the CPU spikes every 5 minutes, this command can identify which specific process (e.g., management-plane daemon, dataplane task) is consuming the most CPU during those intervals, enabling targeted troubleshooting.

Answer

show session all

Answer

show dataplane

Answer

show system resources

Question 6

A firewall is configured with two ISPs for redundancy. The administrator wants to ensure that traffic from internal users is load-balanced across both links based on source IP. Which configuration method should be used?

Accepted Answer

ECMP with source IP hash. D is correct because ECMP (Equal-Cost Multi-Path) with source IP hash enables the firewall to load-balance traffic across multiple equal-cost routes by hashing the source IP address, ensuring that all packets from the same source IP consistently use the same link. This method provides per-source-IP stickiness while distributing traffic across both ISPs, meeting the requirement for load balancing based on source IP.

Answer

Static routes with different metrics

Answer

Policy-Based Forwarding (PBF)

Answer

Path monitoring

Question 7

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

Accepted Answer

Configure log export and auto-deletion in Log Settings. Option B is correct because the firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Answer

Add an external disk to the firewall

Answer

Disable logging for non-critical traffic

Answer

Manually delete logs from the CLI

Question 8

A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?

Accepted Answer

The passive firewall is running a different PAN-OS version. The passive firewall showing a 'non-functional' state in an Active/Passive HA pair most likely indicates a version mismatch. PAN-OS requires both firewalls in an HA pair to run the exact same software version for configuration synchronization to work. If the passive firewall is running a different PAN-OS version, it cannot properly interpret or apply the configuration from the active firewall, causing it to enter a non-functional state.

Answer

The HA2 link is down but HA1 is up

Answer

The session sync is disabled

Answer

The passive firewall has link monitoring enabled

Question 9

A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?

Accepted Answer

Configure a PCAP filter in the firewall's packet capture feature. The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.

Answer

Set up a port mirror on the upstream switch

Answer

Create an application override policy

Answer

Use tcpdump on the management interface

Question 10

Which TWO of the following are valid methods to upgrade the PAN-OS software on a firewall? (Choose two.)

Accepted Answer

Download from the Palo Alto Networks support site and install via the web interface. Option B is correct because the PAN-OS web interface provides a built-in method to upload and install software images downloaded from the Palo Alto Networks support site. This is a standard, supported upgrade path that uses HTTPS to transfer the image to the firewall.

Answer

Insert a USB drive with the image into the firewall's USB port

Answer

Use FTP to transfer the image to the firewall

Answer

Email the image to the firewall's email-to-PAN-OS feature

Question 11

Which THREE of the following are valid actions that can be taken on a dynamic block list entry? (Choose three.)

Accepted Answer

Remove an IP address. Option A is correct because the dynamic block list in PAN-OS allows administrators to remove an IP address from the list using the 'delete' action via the CLI or API. This is a standard operation for managing entries that were automatically added by automated threat prevention features like WildFire or AutoFocus.

Answer

Add a username to block

Answer

Convert a dynamic entry to a static entry

Question 12

Which TWO of the following are valid considerations when configuring Log Forwarding for Panorama? (Choose two.)

Accepted Answer

Log forwarding supports sending logs to multiple destinations. Log Forwarding in Panorama supports sending logs to multiple destinations, including syslog servers, email, SNMP traps, and Panorama collectors. This flexibility allows administrators to distribute logs for redundancy, compliance, or analysis across different systems. Option C is correct because Panorama can forward logs to multiple destinations simultaneously, not just one.

Answer

Log forwarding must use TLS encryption

Answer

Log forwarding requires an external syslog server

Answer

Log forwarding can only send logs to a single Panorama collector

Question 13

Refer to the exhibit. The firewall's disk usage is at 85% overall, and the /opt/panlogs partition is at 92%. The administrator wants to free up space without losing important log data. Which action should be taken first?

Accepted Answer

Configure log auto-deletion in the Log Settings to purge logs older than a specified period. Option A is correct because configuring log auto-deletion in the Log Settings allows the administrator to automatically purge older logs based on a specified retention period, freeing up disk space on the /opt/panlogs partition without manually deleting important log data. This is the safest and most controlled method, as it respects the firewall's log management policies and ensures compliance with data retention requirements.

Answer

Add an external storage device to the firewall

Answer

Delete configuration files from /opt/pancfg

Answer

Delete the /opt/panlogs directory and recreate it

Question 14

Refer to the exhibit. The firewall is experiencing high dataplane CPU usage (85%) with 45,000 active sessions out of a maximum of 100,000. Which of the following is the most likely cause of the high CPU?

Accepted Answer

SSL decryption is enabled and processing many sessions. SSL decryption is a highly CPU-intensive operation because it requires the firewall to terminate and re-encrypt TLS connections, performing asymmetric and symmetric cryptographic operations for each session. With 45,000 active sessions, even if the session count is below the 100,000 limit, the per-session processing overhead of SSL decryption can drive dataplane CPU to 85%.

Answer

The firewall is reaching its maximum session limit

Answer

The firewall is under a DDoS attack

Answer

There is a high rate of UDP sessions

Question 15

Refer to the exhibit. The firewall is active in an HA pair, but the peer is non-functional. The HA2 link is down. What is the most likely cause of the peer being non-functional?

Accepted Answer

The peer firewall is running a different PAN-OS version. Option C is correct because when an HA pair detects a version mismatch between peers, the firewall with the higher PAN-OS version will not form an active/passive HA state and will remain non-functional (or in a 'non-functional' state) to prevent configuration or session incompatibilities. The HA2 link being down is a separate issue that affects session synchronization but does not cause the peer to be completely non-functional; the peer can still operate with reduced HA capabilities. A version mismatch is a critical condition that prevents HA peering entirely, leading to one peer appearing non-functional.

Answer

The HA3 link is down

Answer

The HA2 link is down, preventing session synchronization

Answer

The HA1 link is down

Question 16

A medium-sized enterprise has a PA-3220 firewall deployed in a data center with two ISPs (ISP-A and ISP-B) for redundancy. The firewall is configured with two virtual routers: VR-Trust for internal networks and VR-Untrust for external connections. Each ISP is connected to a separate physical interface (ethernet1/1 for ISP-A, ethernet1/2 for ISP-B) and both are placed in VR-Untrust with static default routes. The internal network uses 10.0.0.0/16. The firewall has a security policy that allows all outbound traffic from internal to external. Recently, users have reported that internet access is slow during peak hours. The administrator checks the dataplane CPU and sees it averaging 80-90%. The session count is 200,000 out of a maximum of 500,000. The administrator also notices that the firewall is using only ISP-A for all outbound traffic, even though both ISPs have equal bandwidth. The administrator wants to reduce CPU usage and utilize both ISP links. Which action should the administrator take?

Accepted Answer

Configure ECMP on VR-Untrust with source IP hash load balancing. The administrator needs to reduce CPU usage and utilize both ISP links. Configuring ECMP (Equal-Cost Multi-Path) on VR-Untrust with source IP hash load balancing allows the firewall to distribute outbound traffic across both ISP links based on the source IP hash, which spreads sessions across multiple paths without requiring policy-based forwarding. This reduces the load on a single link and can help lower CPU utilization by balancing the session processing load across both interfaces, as the firewall can use multiple next hops for the same destination.

Answer

Increase the maximum session limit to 1,000,000

Answer

Disable logging for all security policies

Answer

Configure the firewall to use active/passive ISP failover

Question 17

A large organization has a PA-5250 firewall pair in active/passive HA mode. The firewalls are managed by Panorama. The security team recently created a new security policy rule to block a specific application (app-block-rule) and pushed the configuration from Panorama. After the push, the active firewall shows the new rule in the security policy list, but traffic matching the rule is not being blocked. The administrator checks the traffic logs and sees that the traffic is being allowed by a different rule with a higher priority. The administrator also notices that the 'app-block-rule' has an 'any' source and destination zone, but the allowed rule has specific zones. The administrator runs 'show session info' and sees that the sessions are being created before the policy push. The administrator wants to ensure that existing sessions are subject to the new policy. Which action should the administrator take?

Accepted Answer

Enable session re-aging and set a short timeout for the application. Option D is correct because session re-aging forces the firewall to re-evaluate existing sessions against the current security policy. When a new policy is pushed, sessions established before the push continue to match the old policy until they expire. By enabling session re-aging and setting a short timeout, the firewall will age out those sessions sooner, causing them to be re-matched against the new 'app-block-rule' and thus be blocked.

Answer

Disable session re-aging on the firewall

Answer

Commit the configuration on the active firewall

Answer

Move the new rule to the top of the security policy

Question 18

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Question 19

Arrange the steps to configure a new administrator account with role-based access.

Question 20

Match each Palo Alto Networks feature to its primary function.