PCNSE Manage, Monitor and Operate Practice Test 4 — 15 Questions

Question 1

A network security engineer needs to upgrade a PA-5220 firewall running PAN-OS 10.1.9 to PAN-OS 11.0.4. The firewall has a single default route to the internet. After downloading the base image and the latest maintenance release, the engineer begins the upgrade. The upgrade fails with an error indicating insufficient disk space. Which action should be taken to resolve this issue before retrying the upgrade?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the older PAN-OS images from the firewall's software repository using the CLI command 'delete software version'.. The most direct and supported method to free disk space for a PAN-OS upgrade is to remove older, unused PAN-OS images from the firewall. The CLI command 'delete software version' removes a specific image. This addresses the root cause of insufficient disk space without disrupting operations. Other options are either invalid, unsupported on the hardware, or do not provide immediate space.

Answer

Disable logging to the local disk temporarily and then retry the upgrade.

Answer

Run the command 'request system disk clean' to automatically remove unnecessary files and free up space.

Answer

Increase the disk space by adding a new virtual disk to the firewall and extending the /opt/panlogs partition.

Question 2

An administrator needs to schedule a weekly report that shows the top 10 applications by session count for the last 7 days. The firewall is running PAN-OS 10.2 and has no Panorama. Which built-in feature should the administrator use to generate and email this report automatically?

Accepted Answer

Create a custom report in the Report Groups section under Monitor > Manage Custom Reports and schedule it.. The Manage Custom Reports feature allows defining a report with specific filters, such as top applications by session count for the last 7 days. After creation, the report can be added to a Report Group and scheduled for automatic email delivery. This is the built-in method for generating custom reports without Panorama.

Answer

Use the Email Scheduler under Device > Setup > Management to send a predefined report.

Answer

Use the predefined 'Top Applications' report from the ACC and configure a scheduled export to CSV.

Answer

Configure a syslog server to receive logs and generate the report externally.

Question 3

An administrator is troubleshooting why a firewall is not forwarding logs to an external syslog server. The syslog server is reachable, and the firewall's log forwarding profile is correctly attached to the security policy. The administrator checks the log forwarding profile and sees that the syslog server is configured with the default port. Which action should the administrator take to verify that logs are being sent?

Accepted Answer

Perform a packet capture on the management interface to see if syslog packets are leaving the firewall.. To verify that the firewall is sending syslog messages, a packet capture on the management interface (or the interface used for log forwarding) is the most reliable method. It shows whether UDP packets destined for the syslog server's IP and port are leaving the firewall. If packets are present, the issue likely lies with the syslog server or network path; if absent, the firewall configuration or log forwarding profile may be incorrect.

Answer

Run the CLI command 'show log traffic' to confirm logs are generated.

Answer

Use the CLI command 'show logging-status' to check the status of log forwarding.

Answer

Check the syslog server's logs to see if it is receiving any data.

Question 4

A network administrator needs to schedule a recurring task to export the current configuration of a Palo Alto Networks firewall to an external SCP server every night at 2:00 AM. Which feature should the administrator use?

Accepted Answer

Device > Setup > Operations > Scheduled Tasks. The Scheduled Tasks feature under Device > Setup > Operations allows administrators to automate configuration exports to an external SCP server on a recurring schedule. This built-in capability eliminates the need for external scripts or manual intervention. The other options either describe manual export, incorrect menu paths, or log export scheduling, which is unrelated to configuration backup. Thus, the correct choice is the one that references the Scheduled Tasks menu under Operations.

Answer

Device > Setup > Operations > Export named configuration snapshot

Answer

Device > Scheduled Tasks > Export Configuration

Answer

Device > Setup > Management > Log Export Scheduling

Question 5

An administrator needs to ensure that configuration changes made on a firewall are automatically backed up to an external server. The firewall is managed by Panorama. Which two actions should the administrator take to accomplish this? (Choose two.)

Accepted Answer

Enable configuration versioning in Panorama.. To automatically back up configuration changes to an external server, the administrator should enable configuration versioning in Panorama and configure a scheduled config export to an external server. Versioning ensures each commit is saved as a version, and the scheduled export transfers the configuration to an external location. Other options do not provide automatic backup upon changes.

Answer

Configure a scheduled configuration export on the firewall.

Answer

Set up a log forwarding profile to send configuration logs to a syslog server.

Answer

Use the 'save config' command in the CLI after each change.

Question 6

An administrator needs to ensure that all firewall configuration changes are logged and can be reviewed later. Which built-in feature should be used to track configuration changes made via the web interface or CLI?

Accepted Answer

Review the Configuration Log under Monitor > Logs > Configuration.. The Configuration Log, accessible under Monitor > Logs > Configuration, automatically records all configuration changes made via the web interface, CLI, or API. It includes details such as the administrator username, timestamp, and the specific change. This built-in feature requires no additional configuration and is the correct tool for auditing configuration changes.

Answer

Use the Audit Log under Device > Logs > Audit.

Answer

Configure syslog forwarding for configuration logs.

Answer

Enable the Configuration Log under Device > Setup > Management > Logging and Reporting Settings.

Question 7

An administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is at 192.168.1.50 and uses port 514. The administrator wants to ensure that both traffic logs and threat logs are forwarded. Which two configurations are required? (Choose two.)

Accepted Answer

Attach the Syslog server profile to a Log Forwarding profile.. To forward logs to an external syslog server, you must first create a Syslog server profile that specifies the server's IP address and port. Then, you must attach that profile to a Log Forwarding profile, which defines which log types (e.g., traffic, threat) are forwarded. Finally, the Log Forwarding profile must be applied to security policy rules. The two required configurations are creating the Syslog server profile and attaching it to a Log Forwarding profile.

Answer

Set the log forwarding profile as the default in the security policy.

Answer

Configure a security policy rule to forward logs to the syslog server.

Answer

Enable SNMP traps for log forwarding.

Question 8

An administrator is troubleshooting why a firewall is not sending SNMP traps for high CPU utilization. The SNMP configuration is complete, and the firewall can be polled successfully. Which action should the administrator take to ensure SNMP traps are generated for high CPU?

Accepted Answer

Configure a threshold for CPU utilization under Device > Setup > Management > SNMP Setup > SNMP Trap Settings.. To generate SNMP traps for high CPU utilization, the administrator must configure a CPU threshold under Device > Setup > Management > SNMP Setup > SNMP Trap Settings. This defines the level at which the firewall sends a trap. Since SNMP polling works and trap destinations are likely set, the missing configuration is the threshold. The other options either describe incorrect menu paths or actions that do not enable specific threshold traps. Thus, the correct choice is to set the CPU threshold in the SNMP Trap Settings.

Answer

Enable SNMP traps globally under Device > Setup > Operations > SNMP Trap Enablement.

Answer

Enable the SNMP trap for high CPU under Device > Setup > Management > SNMP Setup > Trap Settings.

Answer

Configure an SNMP trap destination under Device > Setup > Management > SNMP Setup.

Question 9

A firewall administrator is troubleshooting why a specific user is unable to access a web application. The administrator runs 'show session all filter source 10.1.1.100' and sees that the session is being denied by the 'intrazone-default' rule. The user's traffic is from the trust zone to the untrust zone. What is the most likely cause of this issue?

Accepted Answer

The security policy rule allowing the traffic is misconfigured or missing.. The appearance of the 'intrazone-default' rule for traffic between different zones indicates that no interzone security policy rule matched the traffic. This typically happens when a rule is missing or misconfigured—for example, if the rule incorrectly specifies the same zone for both source and destination. The firewall then falls back to the intrazone-default rule, which denies the traffic.

Answer

The session is being denied by the default interzone rule, but the log incorrectly shows 'intrazone-default'.

Answer

The user's IP address is not included in the allowed source addresses of the security policy rule.

Answer

The firewall's zone configuration is incorrect, causing both interfaces to be assigned to the same zone.

Question 10

A security administrator needs to ensure that all firewall logs are forwarded to an external syslog server in a specific format. The administrator configures a syslog server profile and applies it to a log forwarding profile. After testing, the administrator finds that only threat logs are being forwarded, while traffic logs are not. What is the most likely cause?

Accepted Answer

The log forwarding profile is not attached to the security policy rules that generate traffic logs.. Log forwarding profiles must be explicitly attached to security policy rules to forward logs generated by those rules. The administrator applied the profile to a log forwarding profile, but if the security rules do not reference that profile, traffic logs will not be forwarded. Threat logs may be forwarded via a different mechanism, such as a threat prevention profile that includes log forwarding. The correct solution is to attach the log forwarding profile to the relevant security rules.

Answer

The syslog server profile is configured with the wrong port number for traffic logs.

Answer

Traffic logs are not enabled in the security policy rules; only threat logs are enabled.

Answer

The firewall's log storage is full, causing traffic logs to be dropped before forwarding.

Question 11

An administrator is troubleshooting why a firewall is not sending logs to an external syslog server. They have verified that the syslog server profile is correctly configured and applied to the security policy. Which additional step should they check?

Accepted Answer

Verify that the firewall's management interface can reach the syslog server.. When a syslog server profile is correctly configured and applied but logs are not being received, the most likely cause is a network connectivity issue between the firewall's management interface and the syslog server. The administrator should verify that the management interface can reach the server, checking routing and any intermediate firewalls. Security policy rules do not apply to management plane traffic, and log forwarding profiles are already in use if a syslog server profile is applied.

Answer

Confirm that the security policy is set to allow traffic to the syslog server.

Answer

Ensure that the log forwarding profile is attached to the security policy.

Answer

Check that the log severity level in the log forwarding profile matches the syslog server's expectations.

Question 12

An administrator needs to ensure that all configuration changes made to a firewall managed by Panorama are automatically backed up to an external SCP server every week. The administrator wants to use Panorama to schedule this task for all managed firewalls. Which Panorama feature should be used?

Accepted Answer

Panorama > Setup > Operations > Scheduled Tasks. Panorama's Scheduled Tasks feature, located under Panorama > Setup > Operations, allows administrators to schedule configuration exports for managed firewalls to an external SCP server. This centralizes backup management and can be set to run weekly. The other options either describe non-existent menus or incorrectly place the functionality under Device Groups or Managed Devices. Therefore, the correct choice is the one that references Panorama > Setup > Operations > Scheduled Tasks.

Answer

Panorama > Device Groups > Backup Scheduling

Answer

Panorama > Scheduled Config Export

Answer

Panorama > Managed Devices > Scheduled Backups

Question 13

An administrator is using the firewall's CLI to troubleshoot a connectivity issue. The administrator needs to verify that the firewall is receiving packets on a specific interface and that the packets are being processed correctly. Which two CLI commands should the administrator use to capture and analyze the packets? (Choose two.)

Accepted Answer

debug dataplane packet-diag set filter match source destination . To capture and analyze packets on a specific interface, the administrator can use the dataplane packet diagnostics tools. The 'debug dataplane packet-diag set filter' command configures a capture filter for specific traffic, and 'view-packet-diag' displays the captured packets with processing details. Together, these commands provide deep insight into packet flow and processing.

Answer

show counter interface <interface>

Answer

tcpdump filter <filter>

Answer

show interface <interface>

Question 14

A security operations team uses Panorama to manage multiple firewalls. They need to ensure that all configuration changes made on Panorama are automatically pushed to the managed firewalls within 5 minutes. Which Panorama feature should they configure?

Accepted Answer

Auto Commit and Push. The Auto Commit and Push feature in Panorama automatically commits and pushes configuration changes to managed firewalls when a commit is performed on Panorama. This eliminates the need for manual intervention and ensures changes are propagated quickly. By enabling this feature, the security operations team can meet the requirement of pushing changes within 5 minutes, as the push occurs immediately after the commit.

Answer

Panorama Commit and Push on Save

Answer

Device Group Synchronization

Answer

Scheduled Config Push

Question 15

An administrator is using the Panorama Logging Service to collect logs from multiple firewalls. The administrator wants to ensure that logs are retained for at least 180 days to meet compliance requirements. Which two actions must be taken to achieve this? (Choose two.)

Accepted Answer

Ensure the Logging Service has sufficient disk space to store 180 days of logs based on the daily log volume.. To retain logs for 180 days with the Panorama Logging Service, the administrator must either ensure sufficient disk space on the Logging Service to hold 180 days of logs or forward logs to an external syslog server for long-term storage. The Logging Service does not have a configurable retention period; retention is a function of disk capacity and log volume. Therefore, the two correct actions are to provide adequate storage and to forward logs externally if local storage is insufficient. The other options describe non-existent features or ineffective methods.

Answer

Configure the firewalls to send logs only for critical events to reduce volume.

Answer

Increase the log retention period in the Logging Service settings under Panorama > Logging Service > Retention.

Answer

Enable log compression on the Logging Service to reduce storage consumption.