PCNSE Manage, Monitor and Operate Practice Test 5 — 15 Questions

Question 1

A firewall administrator needs to configure a new security policy rule to block traffic from the 'Guest' zone to the 'Corporate' zone for all ports except HTTP and HTTPS. Which two configuration steps are required? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'web browsing' and 'ssl' with action 'allow'.. To block all traffic from the Guest zone to the Corporate zone except HTTP and HTTPS, you must explicitly allow the permitted applications and then deny everything else, ensuring correct rule order. Option A creates the necessary allow rule for web-browsing and SSL. Because security policies are evaluated top-down, the allow rule must be placed above any explicit deny-all rule so that the allowed traffic matches first. Option D ensures this ordering. Relying solely on the implicit default-deny is insufficient when explicit control is required; an explicit deny rule (commonly placed at the bottom) demands proper placement of the allow rule above it. Thus, both A and D are required.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', application 'any' with action 'deny'.

Answer

Configure a 'Log Forwarding' profile to send alerts for denied traffic.

Answer

Create a rule with source zone 'Guest', destination zone 'Corporate', and application 'any' with action 'allow'.

Question 2

A security engineer is investigating a potential data exfiltration incident. The firewall logs show that a host in the DMZ made outbound connections to multiple external IPs on port 443, but the traffic was allowed. The engineer wants to review detailed session information including the amount of data transferred and the application used. Which three log types or tools should the engineer use? (Choose three.)

Accepted Answer

App-ID logs.. App-ID logs (option A) are correct because they provide detailed information about the application associated with each session, which is critical for identifying the specific application used in the outbound connections. Traffic logs (option E) are correct because they record session-level details including source/destination IPs, ports, and the amount of data transferred (bytes sent/received). The packet capture feature (option B) is correct because it allows the engineer to capture and inspect the actual packets for forensic analysis, revealing the exact data payload and application behavior.

Answer

System logs.

Answer

URL filtering logs.

Question 3

An administrator needs to configure a firewall to send email alerts when a specific security policy rule is triggered. Which two configuration elements are required? (Choose two.)

Accepted Answer

An 'Email Server' profile configured with SMTP server details.. To send email alerts when a specific security policy rule is triggered, you need an Email Server profile configured with SMTP server details (Option B) to define the mail server, and a Log Forwarding profile that includes email notification (Option C) to specify which log events trigger the email. The Log Forwarding profile is attached to the Security Policy rule, and when the rule matches traffic, the firewall sends the log data to the configured email server.

Answer

A 'Security Policy' rule with 'Log at Session End' enabled.

Answer

A 'Panorama' template to push the configuration.

Answer

A 'User-ID' agent to identify users.

Question 4

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.

Question 5

A GlobalProtect gateway is configured as shown. Remote users report that they can connect to the gateway but cannot authenticate. The users are using the GlobalProtect client with certificate authentication. What is the most likely cause?

Accepted Answer

The gateway does not have a root CA certificate imported for validating client certificates.. For certificate-based authentication, the GlobalProtect gateway must trust the certificate presented by the client. This requires the gateway to have the root CA certificate that issued the client certificate imported into its trusted CA list. Without this root CA, the gateway cannot validate the client's certificate chain, causing authentication to fail even though the initial connection (e.g., IPSec tunnel establishment) succeeds.

Answer

The IPSec crypto profile is too strong for the clients.

Answer

The IP pool is exhausted.

Answer

The DNS server is misconfigured, causing authentication failure.

Question 6

The firewall log shows repeated IKE phase 1 negotiation failures. The remote peer is a third-party VPN device. Which of the following is the most likely cause?

Accepted Answer

The IKE encryption algorithm settings do not match between the local firewall and the remote peer.. IKE phase 1 negotiation failures are most commonly caused by mismatched IKE parameters, particularly the encryption algorithm (e.g., AES-256 vs AES-128), hash algorithm, DH group, or lifetime. Since the remote peer is a third-party device, the local firewall and remote peer must agree on all IKE phase 1 proposals; if even one parameter (like encryption) does not match, the negotiation fails. Option C directly addresses this core requirement.

Answer

The remote peer's firewall is blocking UDP port 500.

Answer

The pre-shared key is incorrect.

Answer

The IKE version (v1 vs v2) is mismatched between the two devices.

Question 7

A network administrator notices that traffic from a specific IP address is being blocked unexpectedly. The traffic is allowed in the security policy. What is the most likely cause?

Accepted Answer

The IP address is on a block list in the External Dynamic List (EDL).. The most likely cause is that the IP address is on a block list in an External Dynamic List (EDL). Even if a security policy explicitly allows traffic from that IP, a block list configured in an EDL overrides the policy because the firewall evaluates threat prevention and URL filtering profiles, including EDL-based block lists, before or in parallel with security policy rules. This is a common troubleshooting scenario where traffic is allowed by policy but still blocked due to a higher-priority security profile action.

Answer

The source zone is incorrectly assigned.

Answer

The application override is misconfigured.

Answer

The profile settings for the security policy are blocking the traffic.

Question 8

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

Accepted Answer

Verify that the user group mapping is correct.. Even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Answer

Restart the User-ID agent service.

Answer

Check the firewall's management plane CPU usage.

Answer

Ensure the firewall has a license for User-ID.

Question 9

A firewall is configured with two virtual routers in an active/passive HA pair. The active firewall fails over, and after failover, traffic is not passing through the new active firewall. The interface IP addresses are configured as virtual IPs. What is the most likely cause?

Accepted Answer

The session table is not synchronized between HA peers.. In an active/passive HA pair with virtual IPs, session table synchronization is required for the passive firewall to take over active sessions seamlessly after a failover. If session synchronization is not enabled or fails, the new active firewall will not have the session state for existing traffic, causing it to drop packets that belong to those sessions. This is the most likely cause because the interface IPs are virtual, so the routing and interface configuration are already in place, but the session state is missing.

Answer

The passive firewall's routing table is not synchronized.

Answer

The virtual router is not configured to use the virtual IPs.

Answer

The HA configuration does not include the virtual router.

Question 10

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

Accepted Answer

Traffic Report. The Traffic Report is the correct choice because it provides detailed logs of all traffic passing through the firewall, including both allowed and denied sessions. By filtering the report to show only denied traffic over the past week, the administrator can generate the exact report needed. Other report types focus on specific categories like applications, threats, or URLs, not general traffic denials.

Answer

Application Report

Answer

Threat Report

Answer

URL Filtering Report

Question 11

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. 'show running resource-monitor' displays real-time CPU and memory utilization per dataplane or control plane process, which directly helps identify resource exhaustion causing latency. This command provides granular per-process metrics, unlike the aggregated 'show system resources', making it essential for pinpointing bottlenecks in high-latency scenarios.

Answer

show session info

Answer

show log traffic

Question 12

A firewall is part of a Panorama-managed environment. The administrator needs to ensure that only specific administrators can commit changes to devices. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure role-based access on Panorama.. To restrict commit permissions to specific administrators, two actions are required: configuring role-based access on Panorama (B) and creating an admin role with commit scope limited to specific device groups (C). Role-based access allows fine-grained control over admin privileges on Panorama. By creating a custom admin role with a commit scope limited to specific device groups, you ensure that administrators can only commit changes to devices within their assigned groups. Option A (MFA) enhances authentication but does not restrict commit permissions. Option D (template stacks) is used for template management, not commit control. Option E (commit approval) is not a built-in Panorama feature.

Answer

Enable Multi-Factor Authentication for all admins.

Answer

Use template stacks to restrict commit permissions.

Answer

Set the firewall to require approval for commits.

Question 13

A small business uses a single PA-220 firewall with PAN-OS 10.2. The administrator notices that the firewall is no longer receiving automatic threat updates. The License page shows the Threat Prevention license is active with 200 days remaining. The administrator can manually download updates from the Palo Alto Networks update server. What is the most likely cause?

Accepted Answer

The update schedule is disabled.. The most likely cause is that the update schedule is disabled. Even though the Threat Prevention license is active and manual downloads work, the firewall will not automatically check for or download updates if the scheduled update feature is turned off. In PAN-OS 10.2, the administrator must configure a recurring schedule under Device > Dynamic Updates for automatic updates to occur; otherwise, only manual downloads are possible.

Answer

The firewall is behind a proxy that blocks the update service.

Answer

The firewall's system clock is incorrect.

Answer

The DNS settings are misconfigured.

Question 14

An organization has a pair of PA-5250 firewalls in active/passive HA. During a maintenance window, the active firewall is rebooted. After the reboot, the firewall that was passive becomes active and passes traffic. However, the other firewall remains in a non-functional state and shows 'unknown' as HA state. The administrator checks the HA configuration and finds both firewalls have the same HA settings. What is the most likely issue?

Accepted Answer

The HA control link is down or misconfigured.. After a reboot, the previously active firewall fails to join the HA pair and shows 'unknown' state, which indicates it cannot communicate with its peer. Since both firewalls have identical HA settings, the most likely cause is that the HA control link (the dedicated link used for heartbeat and state synchronization) is down or misconfigured, preventing the rebooted firewall from establishing a valid HA session.

Answer

The backup firewall has a different software version.

Answer

The floating IP addresses are not configured.

Answer

The HA keepalive timer is too short.

Question 15

A large enterprise uses Panorama to manage 100+ firewalls. The security team wants to deploy a new security policy rule to block a specific application across all firewalls. The rule must be placed before the existing rules. The administrator creates the rule in the appropriate rulebase in the device group and pushes. However, the rule appears at the end of the rulebase on the managed firewalls. What is the most likely cause?

Accepted Answer

The rule ordering was not adjusted in the device group.. When a rule is created in a device group, its position within the rulebase is determined by the rule ordering settings in the device group. By default, new rules are appended at the end. To place a rule before existing rules, the administrator must adjust the rule ordering (e.g., using the 'Move' option) before pushing. Panorama does not automatically position new rules based on priority; it respects the explicit order set in the device group's rulebase.

Answer

The firewall's local rulebase overrides the Panorama rule.

Answer

The rule was created in a pre-rulebase instead of post-rulebase.

Answer

The rule was added to a different device group.