PCNSE Timed Practice Test 1 — 10 Questions

Question 1

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

10 minute time limit — choose an answer to begin.

Accepted Answer

allow. The correct action is 'allow' because the security engineer needs to permit inbound HTTPS traffic from the Untrust zone to the DMZ web server. In Palo Alto Networks firewalls, the security policy action 'allow' explicitly permits the traffic to pass through the firewall, which is required for legitimate inbound web traffic.

Answer

reset-both

Answer

deny

Answer

drop

Question 2

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

Accepted Answer

The session was idle for longer than the timeout threshold.. The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Answer

The session was terminated by a firewall policy.

Answer

The session was forcibly closed by an administrator.

Answer

The session ended due to a TCP FIN/RST from the client.

Question 3

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

Accepted Answer

A security policy allowing traffic between the zones associated with the virtual routers. In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Answer

Redistribution of routes between the virtual routers

Answer

Enabling packet forwarding on the virtual router interfaces

Answer

A static route on both virtual routers pointing to each other's subnets

Question 4

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 5

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Accepted Answer

generate tech-support file. The 'generate tech-support file' command collects a comprehensive archive of system logs, configuration, resource utilization, and diagnostic data into a single file, which is the standard method for providing TAC with the necessary information to analyze performance issues. This command is specifically designed for troubleshooting and support scenarios, unlike other commands that only capture partial or real-time data.

Answer

debug system dump

Answer

show system resources

Answer

show log system

Question 6

Which TWO actions should be taken when deploying a Palo Alto Networks firewall in a branch office to ensure secure and efficient operation? (Choose two.)

Accepted Answer

Enable Threat Prevention profiles to block known malware. Enabling Threat Prevention profiles (A) is correct because it applies IPS signatures to block known malware, exploits, and vulnerabilities inline, which is essential for branch office security without requiring constant manual intervention. Configuring logging for all traffic (B) is correct because it provides visibility for monitoring, troubleshooting, and compliance, and is necessary for effective use of features like ACC and reporting.

Answer

Leave the default admin password until the next audit

Answer

Use the default NAT policies provided by the initial configuration

Answer

Manually download dynamic updates daily to ensure latest signatures

Question 7

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog.. A syslog server profile must first be created under Device > Server Profiles > Syslog to define the external syslog server's IP address, port (default 514), and transport protocol (UDP/TCP). This profile is a prerequisite for any log forwarding to an external syslog server.

Answer

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Answer

Directly apply the syslog server profile to each Security policy rule.

Answer

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Question 8

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Accepted Answer

The traffic matched a security rule that explicitly denies it. The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Answer

A threat prevention profile detected and blocked the session

Answer

The traffic was blocked because the application is not allowed

Answer

The destination URL is categorized as prohibited

Question 9

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 10

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.