PCNSE Manage, Monitor and Operate Practice Test 4 — 15 Questions

Question 1

An administrator wants to view real-time CPU and memory usage on the firewall. Which CLI command should be used?

Accepted Answer

show system resources. The 'show system resources' command displays real-time CPU and memory utilization on a Palo Alto Networks firewall, including load averages, memory usage, and process-level details. This is the correct command for monitoring live resource consumption, as opposed to static system information or logs.

Answer

show system info

Answer

show routing route

Answer

show log system

Question 2

Which TWO are required for SNMP monitoring of a Palo Alto Networks firewall? (Choose two.)

Accepted Answer

Enable SNMP on the firewall (set snmp-server enable).. SNMP monitoring requires the SNMP agent to be enabled on the firewall. The command 'set snmp-server enable' activates the SNMP service, allowing the firewall to respond to SNMP queries from a management station. Without this, no SNMP communication can occur regardless of other configurations.

Answer

Specify an SNMP trap destination.

Answer

Define an SNMP v3 user with authentication.

Answer

Create an SNMP trap profile for high CPU.

Question 3

Which THREE are valid methods to collect logs from a firewall to Panorama? (Choose three.)

Accepted Answer

Configuring the firewall to send syslog to Panorama's log collector.. A firewall can be configured to send syslog data directly to Panorama's log collector, which is a standard method for centralized logging. This leverages the syslog protocol to forward logs, allowing Panorama to aggregate and analyze them without requiring additional infrastructure.

Answer

Using the REST API to pull logs from the firewall to Panorama.

Answer

Logging to a remote syslog server and importing CSV files to Panorama.

Question 4

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 5

What does the session state 'SYN_SENT' indicate about this traffic flow?

Accepted Answer

The firewall has sent a SYN packet and is waiting for a response.. The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Answer

The session has been torn down by the server.

Answer

The traffic is being dropped due to asymmetric routing.

Answer

The application has been identified as incomplete.

Question 6

An administrator has applied the above configuration on a firewall. What will happen to traffic destined to TCP port 2525?

Accepted Answer

All traffic on TCP port 2525 will be classified as the application 'smtp'.. The firewall's application override configuration explicitly maps TCP port 2525 to the application 'smtp'. When an application override is applied, the firewall bypasses App-ID and classifies all traffic matching the specified port and protocol as the defined application, regardless of the actual payload. This means any traffic on TCP port 2525 will be treated as SMTP traffic for policy enforcement and inspection purposes.

Answer

The firewall will perform deeper inspection to identify the application.

Answer

The traffic will be blocked because the application is unknown.

Answer

The traffic will be treated as generic TCP and passed without inspection.

Question 7

The traffic log shows a threat severity 'medium' and the threat log shows action 'allow' for the same session. What is the most likely reason that the threat was allowed?

Accepted Answer

The security policy rule that matched this traffic is configured to allow the threat.. The threat log shows action 'allow' because the security policy rule that matched the session is configured with an action of 'allow'. When a threat is detected but the security rule permits the traffic, the firewall still allows the session to pass, and the threat is logged with the action taken by the rule. This is a common scenario where the firewall's threat prevention profile is set to 'alert' rather than 'block', or the rule's action overrides the threat action.

Answer

The action 'allow' in the threat log is misleading; the traffic was actually blocked.

Answer

The threat was not detected by the firewall.

Answer

The threat log does not record blocked threats.

Question 8

A network administrator notices that traffic from a specific internal subnet is not being logged to the firewall's system logs despite log forwarding being configured. The firewall is running PAN-OS 10.1. Which configuration is most likely causing the issue?

Accepted Answer

The traffic is being matched by a rule with 'Log at Session End' disabled.. In PAN-OS, a security policy rule must have 'Log at Session End' enabled to generate session-end logs. If this setting is disabled, the firewall will not log the traffic even if a log forwarding profile is applied. Since the administrator has confirmed log forwarding is configured, the most likely cause is that the specific rule matching the subnet's traffic has logging disabled.

Answer

The subnet is not in the 'Log Destination' list.

Answer

Log forwarding profile is not applied to the security policy rule.

Answer

The firewall's management plane is overloaded.

Question 9

After upgrading a PA-5250 from PAN-OS 9.1 to PAN-OS 10.1, the firewall fails to establish IPsec VPN tunnels with remote peers. The crypto profiles and IKE gateways appear unchanged. What is the most likely cause?

Accepted Answer

The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.. In PAN-OS 10.1, the default minimum pre-shared key length for IKEv2 was increased to 32 characters. If the existing PSK is shorter than 32 characters, the firewall will reject it during IKE negotiation, causing the tunnel to fail even though the crypto profiles and IKE gateways appear unchanged. This is a common compatibility issue when upgrading from PAN-OS 9.1, which had no such minimum length requirement.

Answer

The default SSL/TLS service profile changed, affecting management access.

Answer

The upgrade reset the IKE gateway configuration to default.

Answer

The firewall's management IP address changed during the upgrade.

Question 10

An organization is experiencing intermittent connectivity issues with their GlobalProtect remote access VPN. Users report that they can connect but after a random period (20-40 minutes) the tunnel drops and reconnects. The firewall has sufficient licensing. Which setting should be reviewed first?

Accepted Answer

GlobalProtect gateway 'Idle Timeout' setting.. The 'Idle Timeout' setting on the GlobalProtect gateway controls how long an inactive session is allowed to remain connected. If this value is set too low (e.g., 20-30 minutes), the gateway will terminate the tunnel after that period of inactivity, causing the client to disconnect and immediately reconnect, which matches the described symptom of intermittent drops every 20-40 minutes. This is the most likely cause because the issue is periodic and consistent with a timeout-based disconnection, not a network change or authentication failure.

Answer

The 'Disconnect on Network Change' option on the client.

Answer

The authentication timeout on the firewall.

Answer

'Tunnel Rekey' interval in the IPSec configuration.

Question 11

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 12

An engineer is troubleshooting a security policy that is not matching traffic as expected. The traffic is from source IP 10.1.1.10 to destination 172.16.0.1 port 443. The policy has source zone 'Internal', destination zone 'DMZ', source address '10.1.1.0/24', destination address '172.16.0.0/24', application 'ssl'. The firewall shows the traffic hitting a different rule. What is the most likely cause?

Accepted Answer

The traffic is being matched by an earlier rule with broader criteria.. The most likely cause is that an earlier rule in the security policy rulebase matches the traffic before the intended rule. Palo Alto Networks firewalls evaluate security rules in sequential order from top to bottom, and the first rule that matches all criteria (source/destination zone, source/destination address, application, etc.) is applied. If a rule with broader criteria (e.g., any/any or a less specific application) appears earlier, it will match the traffic, preventing the intended rule from being hit.

Answer

The source zone is incorrectly assigned; traffic is coming from a different zone.

Answer

The destination address is not in the specified subnet due to NAT.

Answer

The application 'ssl' does not match because the traffic is actually using TLS 1.3.

Question 13

A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?

Accepted Answer

Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet. This is the standard method for inter-virtual-router routing without dynamic redistribution.

Answer

Create a security policy rule allowing the traffic between the zones.

Answer

Configure route redistribution between VR-A and VR-B using a routing protocol.

Answer

Place all interfaces in the same virtual router.

Question 14

A user complains that they cannot access internal resources via GlobalProtect. The firewall shows the user is connected with an IP address from the tunnel pool. Which log type should the administrator check first to determine if traffic is being allowed or denied?

Accepted Answer

Traffic logs.. The administrator should check Traffic logs first because they record every session attempt, showing whether traffic was allowed or denied based on security policies. Since the user is connected with a tunnel IP, the issue is likely policy-based, and Traffic logs provide the source, destination, and action (allow/deny) for each session, directly revealing if the traffic is being blocked.

Answer

System logs.

Answer

Threat logs.

Answer

User-ID logs.

Question 15

An organization is migrating from a legacy firewall to a Palo Alto Networks firewall and needs to ensure that all existing application-based policies are accurately replicated. The engineer exports the configuration from the old firewall and imports it using the 'Config Audit' feature. After import, the engineer notices that many security policy rules have the application set to 'any' instead of the specific applications from the old firewall. What is the most likely reason?

Accepted Answer

The administrator did not correctly map the old firewall's application signatures to Palo Alto Networks application IDs during the migration.. The 'Config Audit' feature in Palo Alto Networks firewalls compares rule configurations but does not automatically translate third-party application signatures into Palo Alto Networks App-IDs. The administrator must manually map the old firewall's application definitions to the correct App-IDs during migration; otherwise, the imported rules default to 'any' for the application field, as the system cannot infer the intended application without explicit mapping.

Answer

The old firewall did not support application identification, so the import process defaulted to 'any'.

Answer

The import process uses a different naming convention for applications, causing a mismatch.

Answer

The 'Config Audit' tool does not import applications; it only identifies rule conflicts.