PCNSE Manage, Monitor and Operate — Timed 10 Questions

Question 1

A firewall is configured with User-ID using the 'Server Monitoring' method via LDAP. The administrator notices that user-to-IP mappings are only being updated every 60 minutes instead of the configured 15-minute polling interval. The LDAP server is reachable and responds quickly. What configuration parameter is most likely causing the delayed update?

10 minute time limit — choose an answer to begin.

Accepted Answer

The 'User-ID' mapping aging time is set to 60 minutes.. The User-ID mapping aging time determines how long a user-to-IP mapping remains in the firewall's table before it is removed. When a mapping exists, the firewall will not overwrite it with a new mapping for the same user, even if a newer mapping is received from the LDAP server during a poll. Instead, the existing mapping must first age out (after the aging time expires) before a new mapping can be created. Therefore, even though the polling interval is 15 minutes, changes in user-to-IP mappings (such as a new IP address) will only appear after the mapping aging time of 60 minutes has elapsed. This explains why updates are only seen every 60 minutes.

Answer

The firewall's 'Log Forwarding' profile is slowing down the User-ID process.

Answer

The 'User-ID Agent' is configured with a 'Timeout' of 60 minutes.

Answer

The 'Server Monitoring' profile has a 'Retry Interval' set to 60 minutes.

Question 2

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

Accepted Answer

(addr.src eq user@domain.com) and (eventid eq auth-fail). The filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.

Answer

(addr.src eq user@domain.com) or (eventid eq auth-fail)

Answer

(addr.src eq user@domain.com) and (severity ge medium)

Answer

(src eq user@domain.com) and (eventid eq auth)

Question 3

An administrator wants to generate a report that shows the top applications by bandwidth usage over the last week. Which report type should be used to accomplish this?

Accepted Answer

Application Report. The Application Report is designed to provide visibility into application usage, including bandwidth consumption, top applications, and application-level trends over a specified time period. This report type leverages the App-ID engine to classify traffic by application, regardless of port or protocol, making it the correct choice for identifying top applications by bandwidth usage.

Answer

URL Filtering Report

Answer

Traffic Report

Answer

Threat Report

Question 4

A firewall administrator needs to troubleshoot a connectivity issue where users in the 10.0.1.0/24 subnet cannot reach the internet. The administrator suspects a missing policy. Which tool within the firewall's web interface can be used to test which security policy will be matched for a given traffic flow?

Accepted Answer

Policy Optimizer > Test Policy Match. The 'Test Policy Match' tool under Policy Optimizer allows an administrator to simulate a specific traffic flow (source/destination IP, port, protocol) and see which security policy rule it matches. This directly addresses the need to verify whether a missing or misconfigured policy is blocking internet access for the 10.0.1.0/24 subnet.

Answer

Network > Virtual Routers

Answer

Monitor > Logs > Traffic

Answer

Device > Setup > Management

Question 5

A company has a firewall with multiple virtual systems (vsys). The administrator wants to delegate management of one vsys to a junior administrator, allowing them to configure security policies but not access system settings or other vsys. Which administrative role should be assigned?

Accepted Answer

Virtual System Admin. A Virtual System Admin role is specifically designed to delegate administrative access to a single virtual system (vsys) within a Palo Alto Networks firewall. This role allows the junior administrator to configure security policies and objects within their assigned vsys, while explicitly preventing access to system settings, device-level configurations, or other virtual systems. This matches the requirement exactly.

Answer

Superuser

Answer

Device Admin

Answer

Role-Based Admin

Question 6

An administrator is troubleshooting high CPU usage on a PA-5250 firewall. The CPU usage spikes every 5 minutes. Which CLI command should be used to identify the process causing the spike?

Accepted Answer

show running resource-monitor. The 'show running resource-monitor' command displays real-time CPU and memory usage per process on Palo Alto Networks firewalls. Since the CPU spikes every 5 minutes, this command can identify which specific process (e.g., management-plane daemon, dataplane task) is consuming the most CPU during those intervals, enabling targeted troubleshooting.

Answer

show session all

Answer

show dataplane

Answer

show system resources

Question 7

A firewall is configured with two ISPs for redundancy. The administrator wants to ensure that traffic from internal users is load-balanced across both links based on source IP. Which configuration method should be used?

Accepted Answer

ECMP with source IP hash. D is correct because ECMP (Equal-Cost Multi-Path) with source IP hash enables the firewall to load-balance traffic across multiple equal-cost routes by hashing the source IP address, ensuring that all packets from the same source IP consistently use the same link. This method provides per-source-IP stickiness while distributing traffic across both ISPs, meeting the requirement for load balancing based on source IP.

Answer

Static routes with different metrics

Answer

Policy-Based Forwarding (PBF)

Answer

Path monitoring

Question 8

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

Accepted Answer

Configure log export and auto-deletion in Log Settings. The firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Answer

Add an external disk to the firewall

Answer

Disable logging for non-critical traffic

Answer

Manually delete logs from the CLI

Question 9

A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?

Accepted Answer

The passive firewall is running a different PAN-OS version. The passive firewall showing a 'non-functional' state in an Active/Passive HA pair most likely indicates a version mismatch. PAN-OS requires both firewalls in an HA pair to run the exact same software version for configuration synchronization to work. If the passive firewall is running a different PAN-OS version, it cannot properly interpret or apply the configuration from the active firewall, causing it to enter a non-functional state.

Answer

The HA2 link is down but HA1 is up

Answer

The session sync is disabled

Answer

The passive firewall has link monitoring enabled

Question 10

A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?

Accepted Answer

Configure a PCAP filter in the firewall's packet capture feature. The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.

Answer

Set up a port mirror on the upstream switch

Answer

Create an application override policy

Answer

Use tcpdump on the management interface