PCNSE Manage, Monitor and Operate Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. The firewall is active in an HA pair, but the peer is non-functional. The HA2 link is down. What is the most likely cause of the peer being non-functional?

Accepted Answer

The peer firewall is running a different PAN-OS version. When an HA pair detects a version mismatch between peers, the firewall with the higher PAN-OS version will not form an active/passive HA state and will remain non-functional (or in a 'non-functional' state) to prevent configuration or session incompatibilities. The HA2 link being down is a separate issue that affects session synchronization but does not cause the peer to be completely non-functional; the peer can still operate with reduced HA capabilities. A version mismatch is a critical condition that prevents HA peering entirely, leading to one peer appearing non-functional.

Answer

The HA3 link is down

Answer

The HA2 link is down, preventing session synchronization

Answer

The HA1 link is down

Question 2

A medium-sized enterprise has a PA-3220 firewall deployed in a data center with two ISPs (ISP-A and ISP-B) for redundancy. The firewall is configured with two virtual routers: VR-Trust for internal networks and VR-Untrust for external connections. Each ISP is connected to a separate physical interface (ethernet1/1 for ISP-A, ethernet1/2 for ISP-B) and both are placed in VR-Untrust with static default routes. The internal network uses 10.0.0.0/16. The firewall has a security policy that allows all outbound traffic from internal to external. Recently, users have reported that internet access is slow during peak hours. The administrator checks the dataplane CPU and sees it averaging 80-90%. The session count is 200,000 out of a maximum of 500,000. The administrator also notices that the firewall is using only ISP-A for all outbound traffic, even though both ISPs have equal bandwidth. The administrator wants to reduce CPU usage and utilize both ISP links. Which action should the administrator take?

Accepted Answer

Configure ECMP on VR-Untrust with source IP hash load balancing. The administrator needs to reduce CPU usage and utilize both ISP links. Configuring ECMP (Equal-Cost Multi-Path) on VR-Untrust with source IP hash load balancing allows the firewall to distribute outbound traffic across both ISP links based on the source IP hash, which spreads sessions across multiple paths without requiring policy-based forwarding. This reduces the load on a single link and can help lower CPU utilization by balancing the session processing load across both interfaces, as the firewall can use multiple next hops for the same destination.

Answer

Increase the maximum session limit to 1,000,000

Answer

Disable logging for all security policies

Answer

Configure the firewall to use active/passive ISP failover

Question 3

A large organization has a PA-5250 firewall pair in active/passive HA mode. The firewalls are managed by Panorama. The security team recently created a new security policy rule to block a specific application (app-block-rule) and pushed the configuration from Panorama. After the push, the active firewall shows the new rule in the security policy list, but traffic matching the rule is not being blocked. The administrator checks the traffic logs and sees that the traffic is being allowed by a different rule with a higher priority. The administrator also notices that the 'app-block-rule' has an 'any' source and destination zone, but the allowed rule has specific zones. The administrator runs 'show session info' and sees that the sessions are being created before the policy push. The administrator wants to ensure that existing sessions are subject to the new policy. Which action should the administrator take?

Accepted Answer

Enable session re-aging and set a short timeout for the application. Session re-aging forces the firewall to re-evaluate existing sessions against the current security policy. When a new policy is pushed, sessions established before the push continue to match the old policy until they expire. By enabling session re-aging and setting a short timeout, the firewall will age out those sessions sooner, causing them to be re-matched against the new 'app-block-rule' and thus be blocked.

Answer

Disable session re-aging on the firewall

Answer

Commit the configuration on the active firewall

Answer

Move the new rule to the top of the security policy

Question 4

Arrange the steps to configure a new zone on a Palo Alto Networks firewall in the correct order.

Accepted Answer

Navigate to Network > Zones, then click Add, then enter the zone name and select the zone type, then click OK.. The correct sequence to configure a new zone on a Palo Alto Networks firewall is: first, navigate to Network > Zones; second, click Add to create a new zone object; third, enter the zone name and select the zone type (e.g., Layer3); finally, click OK to save the configuration. This order ensures that the zone is properly created and configured before committing changes.

Answer

Click Add, then navigate to Network > Zones, then enter the zone name and select the zone type, then click OK.

Answer

Navigate to Network > Zones, then enter the zone name and select the zone type, then click Add, then click OK.

Answer

Navigate to Network > Zones, then click Add, then click OK, then enter the zone name and select the zone type.

Question 5

Arrange the steps to configure a new administrator account with role-based access.

Accepted Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Select the role. Step 4: Commit.. To configure a new administrator with role-based access on a Palo Alto firewall, you must first create the administrator account by navigating to Device > Administrators and clicking Add. Then enter the username and password. Next, assign a role (e.g., Superuser, Read‑Only, or a custom role) to define the access level. Finally, commit the changes to apply the configuration. This sequence ensures the account is fully defined before committing.

Answer

Step 1: Enter username and password. Step 2: Navigate to Device > Administrators and click Add. Step 3: Select the role. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Select the role. Step 3: Enter username and password. Step 4: Commit.

Answer

Step 1: Navigate to Device > Administrators and click Add. Step 2: Enter username and password. Step 3: Commit. Step 4: Select the role.

Question 6

Match each Palo Alto Networks feature to its primary function.

Accepted Answer

App-ID: Identifies applications regardless of port, protocol, or encryption.. The correct matches are: App-ID identifies applications; User-ID maps IPs to users; Content-ID scans content; SSL Decryption decrypts traffic. Common confusions include swapping App-ID and User-ID, or confusing Content-ID with SSL Decryption.

Answer

User-ID: Identifies applications regardless of port, protocol, or encryption.

Answer

Content-ID: Inspects encrypted traffic by decrypting it.

Question 7

Match each Palo Alto Networks product to its primary use case.

Accepted Answer

Next-Generation Firewall (NGFW): Network security and traffic inspection. The correct matches are: NGFW for network security, Panorama for central management, Cortex XDR for endpoint detection, and Prisma Cloud for cloud security. Common confusions include mistaking Panorama's management role for NGFW or assigning cloud security to Cortex XDR.

Answer

Next-Generation Firewall (NGFW): Centralized management of multiple firewalls

Answer

Cortex XDR: Cloud workload protection and compliance

Question 8

A network administrator notices that traffic logs are not being sent to the external Syslog server. The log forwarding profile is configured correctly. Which CLI command should be used to verify the Syslog server connectivity from the firewall?

Accepted Answer

test syslog. The 'test syslog' command is specifically designed to verify Syslog server connectivity from the firewall by sending a test message and confirming receipt. Even if the log forwarding profile is correctly configured, network issues or server unavailability can prevent logs from being sent, and this command directly tests the Syslog transport (UDP 514 or TCP 6514) without relying on other services.

Answer

show log forwarding

Answer

show system setting

Answer

ping <syslog_server_ip>

Question 9

A security team is implementing SSL Decryption. They want to ensure that traffic to health-related websites is not decrypted due to privacy concerns. Which method should they use to exclude this traffic?

Accepted Answer

Add the domain names to a custom URL category and create a no-decryption rule matching that category.. Palo Alto Networks firewalls allow you to create custom URL categories containing specific domain names (e.g., health-related sites) and then reference that category in a decryption policy rule set to 'no-decrypt'. This ensures traffic matching those domains is excluded from SSL decryption, addressing privacy concerns without affecting other traffic.

Answer

Use a source IP address exclusion list in the decryption policy.

Answer

Disable decryption for all sites that use certificate pinning.

Answer

Configure a decryption profile to exclude traffic based on App-ID.

Question 10

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

Accepted Answer

The HA2 link is down.. In an active/passive HA configuration on PAN-OS, session synchronization occurs over the HA2 link (control link). If the HA2 link is down, session synchronization will not work even though the HA state shows 'active' and 'passive' correctly. The HA3 link is used for packet forwarding in active/active mode, not for session sync in active/passive mode.

Answer

The HA3 link is not configured or is misconfigured.

Answer

The passive firewall does not have management API access.

Answer

The logging settings on both firewalls are different.

Question 11

An administrator wants to receive SNMP traps from the firewall for critical events such as failed login attempts and high CPU usage. Which configuration step is required?

Accepted Answer

Configure an SNMP trap destination under Device > Setup > SNMP Trap.. To receive SNMP traps from a Palo Alto Networks firewall, you must configure the trap destination under Device > Setup > SNMP Trap. This step defines where the firewall sends SNMP notifications (traps) for events like failed login attempts and high CPU usage. Without a configured trap destination, the firewall will not transmit any SNMP traps, even if other SNMP settings are enabled.

Answer

Enable SNMP monitoring on the interface.

Answer

Set up a log forwarding profile with SNMP action.

Answer

Create an SNMP read-only community string.

Question 12

A team uses the Panorama API to generate custom reports. They need to retrieve a list of all rules that have logging at session end enabled. Which API endpoint should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules. The Panorama API endpoint GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules retrieves the XML configuration of all security rules. Under each rule, the 'log-start' and 'log-end' elements indicate logging settings. To find rules with logging at session end enabled, one would check for the presence of a 'log-end' element with value 'yes'. Option B is incorrect because it attempts to run an operational command to show logs, not retrieve rule configuration. Option C retrieves log forwarding profiles, not rules. Option D runs a predefined report, which is not suitable for retrieving rule-specific logging settings.

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=get&xpath=/config/shared/log-settings

Answer

GET /api/?type=report&reporttype=predefined

Question 13

During a Panorama upgrade from version 9.0 to 9.1, the administrator notices that the commit fails on one of the managed firewalls with the error: 'Mismatched content version'. What is the most likely cause?

Accepted Answer

The firewall has an incompatible version of content updates installed.. The 'Mismatched content version' error occurs when the content (threat/application) version on the firewall is not compatible with the Panorama version being used. During a Panorama upgrade, the content version database format may change, and if the firewall has an older or incompatible content update installed, Panorama cannot validate the commit. This typically requires updating the firewall's content version to match the Panorama version's supported content database.

Answer

The administrator forgot to push dynamic updates before the upgrade.

Answer

The firewall is not licensed for the new Panorama version.

Answer

The firewall's software version is not compatible with Panorama 9.1.

Question 14

An administrator needs to generate a tech support file for TAC. Which CLI command accomplishes this?

Accepted Answer

generate tech-support. The correct command to generate a tech support file on Palo Alto Networks firewalls is 'generate tech-support'. This command collects all relevant logs, configurations, and diagnostic data into a single archive file for TAC analysis. The 'generate' keyword is specific to Palo Alto's CLI syntax for creating output files, unlike Cisco's 'show' or 'request' commands.

Answer

debug generate dump

Answer

show tech-support

Answer

request tech-support

Question 15

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

Accepted Answer

Syslog over TCP with buffering enabled in the log forwarding profile.. Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Answer

Email (SMTP) for each log.

Answer

Syslog over UDP with a log forwarding profile.

Answer

Syslog over SSL without optional buffering.