PCNSE Multiple Select — 20 Questions

Question 1

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 2

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 3

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog.. A syslog server profile must first be created under Device > Server Profiles > Syslog to define the external syslog server's IP address, port (default 514), and transport protocol (UDP/TCP). This profile is a prerequisite for any log forwarding to an external syslog server.

Answer

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Answer

Directly apply the syslog server profile to each Security policy rule.

Answer

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Question 4

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 5

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Accepted Answer

Kerberos. Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Answer

LDAP

Answer

Local Database

Answer

RADIUS

Question 6

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 7

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 8

A network engineer is troubleshooting high latency on the firewall. Which THREE commands from the CLI should be used to identify potential bottlenecks? (Choose three.)

Accepted Answer

show running resource-monitor. 'show running resource-monitor' displays real-time CPU and memory utilization per dataplane or control plane process, which directly helps identify resource exhaustion causing latency. This command provides granular per-process metrics, unlike the aggregated 'show system resources', making it essential for pinpointing bottlenecks in high-latency scenarios.

Answer

show session info

Answer

show log traffic

Question 9

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Accepted Answer

CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.. Option B is correct because CDSS subscriptions such as DNS Security and WildFire are cloud-hosted services that the firewall must reach over the internet to submit files/URLs and retrieve verdicts, unlike purely on-box inspection. Option C is correct because the architectural split is that CDSS performs cloud-based threat analysis and delivers dynamic signature/content updates, while the NGFW remains the inline enforcement point that applies policy and blocks traffic. Option E is correct because CDSS aggregates telemetry from all subscribed firewalls and pushes newly derived threat intelligence back out globally, giving every firewall protection from threats seen anywhere. Option A is not correct because full application-level packet inspection is done by the NGFW's App-ID engine on the firewall itself, not by CDSS. Option D is not correct because CDSS augments rather than replaces the firewall's local threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) capabilities.

Answer

CDSS performs full application-level packet inspection.

Answer

CDSS is a replacement for the firewall's local threat prevention functionality.

Question 10

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering

Question 11

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Accepted Answer

Source zone. A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Answer

User-ID

Answer

Application ID

Question 12

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. The Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 13

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Accepted Answer

Configure a virtual router and assign interfaces. In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Answer

Enable aggregate Ethernet on all interfaces

Answer

Set up a management profile for each interface

Question 14

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. Option E is correct because a security policy rule in PAN-OS matches traffic based on the Application field, so setting it to the specific application ensures the rule only matches sessions where that application is positively identified by App-ID. Option C is correct because setting the Service to 'application-default' makes the rule honor the application's standard/default port(s) as defined by the App-ID signature, rather than a custom or any service, which is exactly what is needed to match the application on its standard port. Together, Application = specific app plus Service = application-default ensures the rule matches only when that application is detected on its default port. Option A is not required for this specific matching condition, since zones define the source/destination context but do not restrict matching to a detected application on its standard port. Option B (Threat Prevention) is a security profile action applied after matching, not a matching criterion. Option D (Logging at session start) affects logging behavior, not whether the rule matches the application on its standard port.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 15

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. Option A is correct because App-ID relies on inspecting the application payload to identify the application; when SSL decryption is not enabled, the firewall only sees encrypted traffic and cannot match a signature, so the session is reported as incomplete (ssl or insufficient-data). Option D is correct because App-ID requires seeing both directions of a flow to correlate client-to-server and server-to-client data; with asymmetric routing the firewall only observes one half of the session, so it cannot complete identification and marks the traffic incomplete. Option B is not correct because a slow CPU causes performance degradation or dropped packets, not an 'incomplete' App-ID classification. Option C is not correct because Content-ID licensing affects threat, URL, and file inspection, not the base App-ID engine that classifies applications. Option E is not correct because a deny rule simply blocks the session; it does not produce an incomplete App-ID result.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 16

Which THREE components are part of the GlobalProtect infrastructure? (Choose three.)

Accepted Answer

GlobalProtect Gateway. The three core components of the GlobalProtect infrastructure are the GlobalProtect Portal (D), the GlobalProtect Gateway (B), and the GlobalProtect Client (C). The Portal (D) is the entry point that hosts the agent configuration and delivers settings, client certificates, and the list of available gateways to endpoints. The Gateway (B) is the security enforcement point that provides the actual tunnel (SSL or IPSec) and applies security, decryption, and HIP policies to traffic. The Client (C) is the endpoint software (GlobalProtect app) installed on user devices that authenticates to the portal, retrieves configuration, and establishes the tunnel to a gateway. The firewall management interface (A) is only the administrative web UI/CLI used to configure the firewall and is not itself a GlobalProtect infrastructure component, and an authentication server (E) is an external identity source (e.g., LDAP, RADIUS, SAML IdP) that GlobalProtect can reference for user authentication but is not a GlobalProtect component.

Answer

Firewall management interface

Answer

Authentication server

Question 17

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Two physical or subinterfaces assigned to the vwire.. A virtual wire (vwire) requires exactly two interfaces to function as a transparent bridge between two network segments. These interfaces can be physical or subinterfaces, and they must be assigned to the vwire to pass traffic without Layer 3 processing. Without two interfaces, the vwire cannot forward frames between the connected devices.

Answer

A management profile must be applied to the vwire.

Answer

A zone must be assigned to the vwire.

Answer

The interfaces must be of type 'aggregate'.

Question 18

Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?

Accepted Answer

SSL Forward Proxy. B is correct because SSL Forward Proxy allows the firewall to decrypt outbound traffic from internal clients to external servers by acting as an intermediary, generating a new certificate on the fly to inspect the session. E is correct because SSL Inbound Inspection enables the firewall to decrypt inbound traffic destined for protected servers, typically by importing the server's private key, allowing inspection of encrypted payloads.

Answer

Decryption Broker

Answer

SSL Termination

Answer

SSH Proxy

Question 19

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Accepted Answer

Verify that the HA2 link is operational and has sufficient bandwidth.. Session synchronization in an active/passive HA pair uses the HA2 link (or HA2 backup) to replicate session tables between firewalls. If the HA2 link is down, has insufficient bandwidth, or is misconfigured, session synchronization will fail, causing the newly active firewall to have an incomplete session table after a failover. Verifying that the HA2 link is operational and has sufficient bandwidth is therefore a critical first step in troubleshooting this issue.

Answer

Check that the session synchronization encryption is disabled to reduce latency.

Answer

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Answer

Confirm that the HA1 link is using the correct IP address and is in the same subnet.

Question 20

Which THREE factors must match between two IKE peers for successful IPsec tunnel establishment? (Choose three.)

Accepted Answer

IKE encryption algorithm. Option B (IKE encryption algorithm) is correct because both peers must agree on the same Phase 1 encryption algorithm (e.g., AES-256) in their IKE proposals; a mismatch causes the ISAKMP/IKE SA negotiation to fail. Option C (IKE authentication algorithm) is correct because the Phase 1 integrity/hash algorithm (e.g., SHA-256) must match on both peers for the IKE SA to be established. Option E (IKE version v1 or v2) is correct because IKEv1 and IKEv2 are incompatible protocols; peers must run the same version to negotiate the tunnel. Option A (dead peer detection interval) is not required to match, since DPD timers are locally significant and can differ between peers without preventing tunnel establishment. Option D (local certificate) is not required to match, because each peer presents its own identity credential; certificates need only be trusted/validated, not identical.

Answer

Dead peer detection interval

Answer

Local certificate