PCNSE Manage, Monitor and Operate Practice Test 6 — 15 Questions

Question 1

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. The Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 2

Refer to the exhibit. What does the uptime indicate?

Accepted Answer

The firewall has been restarted approximately 3 hours ago.. The uptime displayed in the exhibit shows the firewall has been running for approximately 3 hours. This directly indicates that the firewall was restarted or rebooted about 3 hours ago, making option D correct. Uptime is a measure of time since the last system boot, not related to licensing, HA mode, or memory usage.

Answer

The firewall license is about to expire.

Answer

The firewall is in active-passive HA mode.

Answer

The firewall has high memory usage.

Question 3

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Accepted Answer

TLS 1.1. The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer

TLS 1.0

Answer

TLS 1.3

Answer

TLS 1.2

Question 4

Refer to the exhibit. Based on the log entry, what action was taken on this traffic?

Accepted Answer

The traffic was dropped.. The log entry shows the action field as 'drop', which indicates the firewall denied the traffic. In Palo Alto Networks firewalls, a 'drop' action means the packet was silently discarded without sending a TCP reset or ICMP unreachable message. Therefore, option C is correct.

Answer

The traffic was allowed with a reset.

Answer

The action could not be determined.

Answer

The traffic was allowed and logged.

Question 5

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

Accepted Answer

The server is sending a FIN/RST prematurely due to application layer issues.. When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.

Answer

A deny all security policy is blocking the traffic.

Answer

Asymmetric routing is causing the session to be torn down.

Answer

Packet buffer exhaustion on the firewall is causing drops.

Question 6

A company uses Panorama to manage multiple firewalls. An administrator pushes a template that includes a new Security Profiles group, but the firewalls do not receive the profile group. What is the most likely cause?

Accepted Answer

The firewalls are not assigned to the template that contains the profile group.. Panorama pushes templates to firewalls based on template assignment. If a firewall is not assigned to the template that contains the Security Profiles group, the firewall will never receive that configuration, regardless of the push operation. Template assignment is a prerequisite for any template-based configuration to be applied to a managed firewall.

Answer

The profile group references a profile that does not exist in the template.

Answer

The push was performed to device groups instead of templates.

Answer

The commit was not selected to include the new profiles.

Question 7

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Accepted Answer

generate tech-support file. The 'generate tech-support file' command collects a comprehensive archive of system logs, configuration, resource utilization, and diagnostic data into a single file, which is the standard method for providing TAC with the necessary information to analyze performance issues. This command is specifically designed for troubleshooting and support scenarios, unlike other commands that only capture partial or real-time data.

Answer

debug system dump

Answer

show system resources

Answer

show log system

Question 8

An administrator reviews a traffic log entry: 'Source: 10.0.0.10, Destination: 8.8.8.8, Application: web-browsing, Action: allow, Bytes Sent: 500, Bytes Received: 1200'. What does this log entry indicate about the traffic?

Accepted Answer

The traffic was allowed and identified as web-browsing.. The log entry shows 'Action: allow', which explicitly indicates the firewall permitted the traffic. The 'Application: web-browsing' field confirms that the Palo Alto Networks firewall correctly identified the traffic as HTTP/HTTPS (web-browsing) using App-ID, not just by port. The presence of both 'Bytes Sent' and 'Bytes Received' with non-zero values confirms bidirectional communication, so the traffic was allowed and properly classified.

Answer

The traffic was blocked by a security policy.

Answer

The traffic was only one-way; only received bytes were logged.

Answer

The application was incorrectly identified.

Question 9

Two firewalls in an active/passive HA pair are not synchronizing. The administrator checks 'show high-availability state' and sees 'active' on both firewalls. What is the most likely cause?

Accepted Answer

The HA3 control link is misconfigured or down.. When both firewalls show 'active' in the HA state, it indicates a split-brain scenario where each firewall believes it is the active unit. The HA3 control link is responsible for heartbeat and state synchronization; if it is misconfigured or down, the firewalls cannot detect each other's presence, causing both to assume active status. This is the most common cause of dual-active HA failures.

Answer

Session owner is set to 'primary' on both firewalls.

Answer

Preemptive mode is enabled on both firewalls.

Answer

Both firewalls have different PAN-OS versions.

Question 10

An administrator wants to view real-time CPU and memory usage on the firewall. Which CLI command should be used?

Accepted Answer

show system resources. The 'show system resources' command displays real-time CPU and memory utilization on a Palo Alto Networks firewall, including load averages, memory usage, and process-level details. This is the correct command for monitoring live resource consumption, as opposed to static system information or logs.

Answer

show system info

Answer

show routing route

Answer

show log system

Question 11

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 12

What does the session state 'SYN_SENT' indicate about this traffic flow?

Accepted Answer

The firewall has sent a SYN packet and is waiting for a response.. The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Answer

The session has been torn down by the server.

Answer

The traffic is being dropped due to asymmetric routing.

Answer

The application has been identified as incomplete.

Question 13

An engineer is troubleshooting a security policy that is not matching traffic as expected. The traffic is from source IP 10.1.1.10 to destination 172.16.0.1 port 443. The policy has source zone 'Internal', destination zone 'DMZ', source address '10.1.1.0/24', destination address '172.16.0.0/24', application 'ssl'. The firewall shows the traffic hitting a different rule. What is the most likely cause?

Accepted Answer

The traffic is being matched by an earlier rule with broader criteria.. The most likely cause is that an earlier rule in the security policy rulebase matches the traffic before the intended rule. Palo Alto Networks firewalls evaluate security rules in sequential order from top to bottom, and the first rule that matches all criteria (source/destination zone, source/destination address, application, etc.) is applied. If a rule with broader criteria (e.g., any/any or a less specific application) appears earlier, it will match the traffic, preventing the intended rule from being hit.

Answer

The source zone is incorrectly assigned; traffic is coming from a different zone.

Answer

The destination address is not in the specified subnet due to NAT.

Answer

The application 'ssl' does not match because the traffic is actually using TLS 1.3.

Question 14

A user complains that they cannot access internal resources via GlobalProtect. The firewall shows the user is connected with an IP address from the tunnel pool. Which log type should the administrator check first to determine if traffic is being allowed or denied?

Accepted Answer

Traffic logs.. The administrator should check Traffic logs first because they record every session attempt, showing whether traffic was allowed or denied based on security policies. Since the user is connected with a tunnel IP, the issue is likely policy-based, and Traffic logs provide the source, destination, and action (allow/deny) for each session, directly revealing if the traffic is being blocked.

Answer

System logs.

Answer

Threat logs.

Answer

User-ID logs.

Question 15

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Accepted Answer

Sessions are not logged because logging is disabled.. When both log-start and log-end are set to 'no' in a security policy rule, session logging is disabled regardless of any log-forwarding profile attached. The log-forwarding profile only specifies where logs are sent if logging is enabled; it does not override the explicit logging disable. Therefore, no session logs are generated for this rule.

Answer

Sessions are logged only if the session duration exceeds a threshold.

Answer

Sessions are logged to Panorama immediately when the session starts.

Answer

Sessions are logged to Panorama only when the session ends.