PCNSE Manage, Monitor and Operate Practice Test 5 — 15 Questions

Question 1

A firewall administrator needs to configure a new security policy rule to block traffic from the 'Guest' zone to the 'Corporate' zone for all ports except HTTP and HTTPS. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'web browsing' and 'ssl' with action 'allow'.. Option A is correct because to allow HTTP and HTTPS traffic from Guest to Corporate, you must create an allow rule that specifies the source zone 'Guest', destination zone 'Corporate', and the applications 'web-browsing' (HTTP) and 'ssl' (HTTPS). This rule permits only those specific applications while implicitly denying all other traffic, as Palo Alto Networks firewalls use a default-deny policy for inter-zone traffic.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'any' with action 'deny'.

Answer

Configure a 'Log Forwarding' profile to send alerts for denied traffic.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', and application 'any' with action 'allow'.

Question 2

A security engineer is investigating a potential data exfiltration incident. The firewall logs show that a host in the DMZ made outbound connections to multiple external IPs on port 443, but the traffic was allowed. The engineer wants to review detailed session information including the amount of data transferred and the application used. Which three log types or tools should the engineer use? (Choose three.)

Accepted Answer

App-ID logs.. App-ID logs (option A) are correct because they provide detailed information about the application associated with each session, which is critical for identifying the specific application used in the outbound connections. Traffic logs (option E) are correct because they record session-level details including source/destination IPs, ports, and the amount of data transferred (bytes sent/received). The packet capture feature (option B) is correct because it allows the engineer to capture and inspect the actual packets for forensic analysis, revealing the exact data payload and application behavior.

Answer

System logs.

Answer

URL filtering logs.

Question 3

An administrator needs to configure a firewall to send email alerts when a specific security policy rule is triggered. Which two configuration elements are required? (Choose two.)

Accepted Answer

An 'Email Server' profile configured with SMTP server details.. Options A and B are correct. A log forwarding profile defines the action (email), and an email server profile defines the SMTP server details. The security policy rule itself also needs logging enabled, but the question specifically asks for elements to send email alerts, which are the log forwarding profile and the email server profile.

Answer

A 'Security Policy' rule with 'Log at Session End' enabled.

Answer

A 'Panorama' template to push the configuration.

Answer

A 'User-ID' agent to identify users.

Question 4

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 5

A GlobalProtect gateway is configured as shown. Remote users report that they can connect to the gateway but cannot authenticate. The users are using the GlobalProtect client with certificate authentication. What is the most likely cause?

Accepted Answer

The gateway does not have a root CA certificate imported for validating client certificates.. Option C is correct because for client certificate authentication, the firewall must have the root CA certificate that issued the client certificates imported; otherwise, it cannot validate the client certificate. Option A is wrong as DNS is only for client DNS server assignment. Option B (IP pool exhaustion) would prevent IP assignment, not authentication. Option D (crypto profile) affects tunnel establishment, not authentication.

Answer

The IPSec crypto profile is too strong for the clients.

Answer

The IP pool is exhausted.

Answer

The DNS server is misconfigured, causing authentication failure.

Question 6

The firewall log shows repeated IKE phase 1 negotiation failures. The remote peer is a third-party VPN device. Which of the following is the most likely cause?

Accepted Answer

The IKE encryption algorithm settings do not match between the local firewall and the remote peer.. IKE phase 1 negotiation failures are most commonly caused by mismatched IKE parameters, particularly the encryption algorithm (e.g., AES-256 vs AES-128), hash algorithm, DH group, or lifetime. Since the remote peer is a third-party device, the local firewall and remote peer must agree on all IKE phase 1 proposals; if even one parameter (like encryption) does not match, the negotiation fails. Option C directly addresses this core requirement.

Answer

The remote peer's firewall is blocking UDP port 500.

Answer

The pre-shared key is incorrect.

Answer

The IKE version (v1 vs v2) is mismatched between the two devices.

Question 7

A network administrator notices that traffic from a specific IP address is being blocked unexpectedly. The traffic is allowed in the security policy. What is the most likely cause?

Accepted Answer

The IP address is on a block list in the External Dynamic List (EDL).. Option A is correct because an External Dynamic List (EDL) configured with a block list can override the security policy and block traffic. Options B, C, and D are less likely causes for this specific symptom.

Answer

The source zone is incorrectly assigned.

Answer

The application override is misconfigured.

Answer

The profile settings for the security policy are blocking the traffic.

Question 8

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

Accepted Answer

Verify that the user group mapping is correct.. Option D is correct because even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Answer

Restart the User-ID agent service.

Answer

Check the firewall's management plane CPU usage.

Answer

Ensure the firewall has a license for User-ID.

Question 9

A firewall is configured with two virtual routers in an active/passive HA pair. The active firewall fails over, and after failover, traffic is not passing through the new active firewall. The interface IP addresses are configured as virtual IPs. What is the most likely cause?

Accepted Answer

The session table is not synchronized between HA peers.. Option D is correct because after failover, the session table on the new active firewall may not be synchronized if session synchronization is not enabled or if the session table was not fully synced before failover. This causes the new active firewall to not have active sessions, leading to traffic drops. Options A, B, and C are incorrect because virtual router configuration, HA synchronization, and ARP tables are typically handled automatically in HA.

Answer

The passive firewall's routing table is not synchronized.

Answer

The virtual router is not configured to use the virtual IPs.

Answer

The HA configuration does not include the virtual router.

Question 10

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

Accepted Answer

Traffic Report. Option C is correct because the Traffic Report can be filtered by action (e.g., deny) to show denied traffic. Options A, B, and D are incorrect as they focus on specific categories like applications, threats, or URL filtering.

Answer

Application Report

Answer

Threat Report

Answer

URL Filtering Report

Question 11

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. Options B, C, and D are correct. 'show running resource-monitor' displays CPU and memory usage per dataplane, 'show counter global' shows packet drop counters, and 'show system resources' provides overall CPU/memory/disk usage. Option A is incorrect because 'show session info' shows active sessions but not performance bottlenecks. Option E is incorrect because 'show log traffic' is for historical logs, not real-time troubleshooting.

Answer

show session info

Answer

show log traffic

Question 12

A firewall is part of a Panorama-managed environment. The administrator needs to ensure that only specific administrators can commit changes to devices. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure role-based access on Panorama.. Options A and B are correct. Creating an admin role with commit scope limited to specific device groups (A) and configuring role-based access on Panorama (B) are necessary to restrict commit permissions to specific administrators. Option C is incorrect because Multi-Factor Authentication is for authentication, not commit restriction. Option D is incorrect because template stacks are for template management. Option E is incorrect because Panorama does not have a built-in commit approval workflow.

Answer

Enable Multi-Factor Authentication for all admins.

Answer

Use template stacks to restrict commit permissions.

Answer

Set the firewall to require approval for commits.

Question 13

A small business uses a single PA-220 firewall with PAN-OS 10.2. The administrator notices that the firewall is no longer receiving automatic threat updates. The License page shows the Threat Prevention license is active with 200 days remaining. The administrator can manually download updates from the Palo Alto Networks update server. What is the most likely cause?

Accepted Answer

The update schedule is disabled.. The most likely cause is that the update schedule is disabled. Even though the Threat Prevention license is active and manual downloads work, the firewall will not automatically check for or download updates if the scheduled update feature is turned off. In PAN-OS 10.2, the administrator must configure a recurring schedule under Device > Dynamic Updates for automatic updates to occur; otherwise, only manual downloads are possible.

Answer

The firewall is behind a proxy that blocks the update service.

Answer

The firewall's system clock is incorrect.

Answer

The DNS settings are misconfigured.

Question 14

An organization has a pair of PA-5250 firewalls in active/passive HA. During a maintenance window, the active firewall is rebooted. After the reboot, the firewall that was passive becomes active and passes traffic. However, the other firewall remains in a non-functional state and shows 'unknown' as HA state. The administrator checks the HA configuration and finds both firewalls have the same HA settings. What is the most likely issue?

Accepted Answer

The HA control link is down or misconfigured.. Option B is correct because if the HA control link is down or misconfigured, the firewalls cannot exchange heartbeats, causing the HA state to be 'unknown'. Option A is incorrect because a short keepalive timer would cause flapping, not 'unknown'. Option C is incorrect because different software versions would prevent HA formation. Option D is incorrect because floating IPs are not related to HA state.

Answer

The backup firewall has a different software version.

Answer

The floating IP addresses are not configured.

Answer

The HA keepalive timer is too short.

Question 15

A large enterprise uses Panorama to manage 100+ firewalls. The security team wants to deploy a new security policy rule to block a specific application across all firewalls. The rule must be placed before the existing rules. The administrator creates the rule in the appropriate rulebase in the device group and pushes. However, the rule appears at the end of the rulebase on the managed firewalls. What is the most likely cause?

Accepted Answer

The rule ordering was not adjusted in the device group.. Option B is correct because when adding a rule via Panorama, the rule order must be explicitly set using drag-and-drop or ordering options. If the administrator did not adjust the order, the rule will be appended at the end. Option A is incorrect because pre-rules are placed before local rules, but ordering still applies. Option C is incorrect because Panorama rules take precedence over local rules unless local rules are configured to override. Option D is incorrect because the rule was created in the correct device group (as stated).

Answer

The firewall's local rulebase overrides the Panorama rule.

Answer

The rule was created in a pre-rulebase instead of post-rulebase.

Answer

The rule was added to a different device group.