PCNSE Manage, Monitor and Operate Practice Test 3 — 15 Questions

Question 1

A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?

Accepted Answer

TCP sessions are being terminated due to MSS clamping issues.. The 'flow_aged_error_tcp_mss' counter increments when the firewall ages out TCP sessions due to TCP MSS (Maximum Segment Size) clamping issues. This occurs when the firewall modifies the MSS value in SYN packets to avoid fragmentation, but the actual path MTU is smaller than the clamped MSS, causing the session to be terminated prematurely. The rapid increment indicates that MSS clamping is misconfigured or the path MTU is inconsistent, leading to session failures.

Answer

The firewall is experiencing a SYN flood attack.

Answer

There is a routing loop causing packet retransmission.

Answer

The firewall's hardware acceleration is failing.

Question 2

Which TWO methods can be used to monitor traffic passing through a Palo Alto Networks firewall?

Accepted Answer

Review traffic logs under Monitor > Traffic.. The Monitor > Traffic log is the primary GUI-based method for reviewing detailed session logs, including source/destination IPs, ports, applications, and actions (allow/deny). Option E is correct because the Application Command Center (ACC) provides a high-level, visual dashboard for monitoring traffic patterns, top applications, and threats in near real-time, aggregating data from traffic and threat logs.

Answer

Use the show session all command.

Answer

Enable config drift monitoring.

Answer

Configure a packet capture on the dataplane.

Question 3

Which THREE steps should be performed when upgrading an active/passive HA pair to a new PAN-OS version?

Accepted Answer

Make the passive firewall active after its upgrade, then upgrade the original active.. In an active/passive HA pair, the recommended upgrade procedure is to first suspend HA synchronization (Option C), then upgrade the passive firewall (Option D), and finally make the upgraded passive firewall active (Option A) before upgrading the original active firewall. This ensures minimal downtime and maintains session state by leveraging the HA3 link for stateful failover. The correct three steps are A, C, and D.

Answer

Upgrade both firewalls at the same time to minimize downtime.

Answer

Reconfigure the HA3 link after the upgrade.

Question 4

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. The Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 5

Refer to the exhibit. What does the uptime indicate?

Accepted Answer

The firewall has been restarted approximately 3 hours ago.. The uptime displayed in the exhibit shows the firewall has been running for approximately 3 hours. This directly indicates that the firewall was restarted or rebooted about 3 hours ago, making option D correct. Uptime is a measure of time since the last system boot, not related to licensing, HA mode, or memory usage.

Answer

The firewall license is about to expire.

Answer

The firewall is in active-passive HA mode.

Answer

The firewall has high memory usage.

Question 6

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 7

Refer to the exhibit. Based on the log entry, what action was taken on this traffic?

Accepted Answer

The traffic was dropped.. The log entry shows the action field as 'drop', which indicates the firewall denied the traffic. In Palo Alto Networks firewalls, a 'drop' action means the packet was silently discarded without sending a TCP reset or ICMP unreachable message. Therefore, option C is correct.

Answer

The traffic was allowed with a reset.

Answer

The action could not be determined.

Answer

The traffic was allowed and logged.

Question 8

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

Accepted Answer

The server is sending a FIN/RST prematurely due to application layer issues.. When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.

Answer

A deny all security policy is blocking the traffic.

Answer

Asymmetric routing is causing the session to be torn down.

Answer

Packet buffer exhaustion on the firewall is causing drops.

Question 9

A network engineer needs to configure SNMP traps on a PA-5250 running PAN-OS 10.2 to alert when CPU usage exceeds 80% for more than 10 minutes. Which CLI command should be used to set this threshold?

Accepted Answer

set snmp-server trap cpu-threshold 80. The CLI command 'set snmp-server trap cpu-threshold 80' directly configures the CPU utilization threshold for SNMP trap generation on a Palo Alto Networks firewall running PAN-OS 10.2. When the CPU usage exceeds 80% for a sustained period (default 10 minutes), the firewall sends an SNMP trap to configured trap destinations. This command is specific to setting the threshold value, and the 10-minute duration is a fixed, non-configurable parameter in this PAN-OS version.

Answer

show snmp-server trap

Answer

set snmp-server trap source-interface ethernet1/1

Answer

set snmp-server trap destination host 192.168.1.100 community public

Question 10

An administrator wants to see only the candidate configuration changes that have not yet been committed. Which CLI command should be used?

Accepted Answer

show configuration sessions changes. The 'show configuration sessions changes' command displays the uncommitted candidate configuration changes for the current administrative session. This is the correct command because it specifically shows only the modifications that have been made to the candidate config but not yet committed to the running configuration on a Palo Alto Networks firewall.

Answer

show configuration running

Answer

show configuration sessions all

Answer

show configuration candidate

Question 11

An engineer notices a decrease in network performance and wants to verify if a specific security policy is being triggered frequently. Which CLI command will show the hit count for a specific policy?

Accepted Answer

show running security-policy hit-count. The 'show running security-policy hit-count' command displays the hit count for each security policy rule, allowing the engineer to identify which specific policy is being triggered frequently. This command directly shows the number of times a rule has matched traffic, which is essential for diagnosing performance issues related to policy usage.

Answer

show security-rulebase

Answer

show rule-usage

Answer

show running security-policy

Question 12

A company uses Panorama to manage multiple firewalls. An administrator pushes a template that includes a new Security Profiles group, but the firewalls do not receive the profile group. What is the most likely cause?

Accepted Answer

The firewalls are not assigned to the template that contains the profile group.. Panorama pushes templates to firewalls based on template assignment. If a firewall is not assigned to the template that contains the Security Profiles group, the firewall will never receive that configuration, regardless of the push operation. Template assignment is a prerequisite for any template-based configuration to be applied to a managed firewall.

Answer

The profile group references a profile that does not exist in the template.

Answer

The push was performed to device groups instead of templates.

Answer

The commit was not selected to include the new profiles.

Question 13

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Accepted Answer

generate tech-support file. The 'generate tech-support file' command collects a comprehensive archive of system logs, configuration, resource utilization, and diagnostic data into a single file, which is the standard method for providing TAC with the necessary information to analyze performance issues. This command is specifically designed for troubleshooting and support scenarios, unlike other commands that only capture partial or real-time data.

Answer

debug system dump

Answer

show system resources

Answer

show log system

Question 14

An administrator reviews a traffic log entry: 'Source: 10.0.0.10, Destination: 8.8.8.8, Application: web-browsing, Action: allow, Bytes Sent: 500, Bytes Received: 1200'. What does this log entry indicate about the traffic?

Accepted Answer

The traffic was allowed and identified as web-browsing.. The log entry shows 'Action: allow', which explicitly indicates the firewall permitted the traffic. The 'Application: web-browsing' field confirms that the Palo Alto Networks firewall correctly identified the traffic as HTTP/HTTPS (web-browsing) using App-ID, not just by port. The presence of both 'Bytes Sent' and 'Bytes Received' with non-zero values confirms bidirectional communication, so the traffic was allowed and properly classified.

Answer

The traffic was blocked by a security policy.

Answer

The traffic was only one-way; only received bytes were logged.

Answer

The application was incorrectly identified.

Question 15

Two firewalls in an active/passive HA pair are not synchronizing. The administrator checks 'show high-availability state' and sees 'active' on both firewalls. What is the most likely cause?

Accepted Answer

The HA3 control link is misconfigured or down.. When both firewalls show 'active' in the HA state, it indicates a split-brain scenario where each firewall believes it is the active unit. The HA3 control link is responsible for heartbeat and state synchronization; if it is misconfigured or down, the firewalls cannot detect each other's presence, causing both to assume active status. This is the most common cause of dual-active HA failures.

Answer

Session owner is set to 'primary' on both firewalls.

Answer

Preemptive mode is enabled on both firewalls.

Answer

Both firewalls have different PAN-OS versions.