PCNSE Timed Practice Test 3 — 10 Questions

Question 1

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

Accepted Answer

The firewalls that are not receiving the template are not included in the same template stack.. In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Answer

The device group has not been committed.

Answer

The firewalls are not licensed for Panorama management.

Answer

The template is in 'preview' mode.

Question 2

Which TWO types of traffic should typically be excluded from SSL decryption for compliance or operational reasons? (Choose two.)

Accepted Answer

Traffic to healthcare portals and electronic medical records.. Options A and C are correct because financial and healthcare traffic often have regulatory compliance requirements. Option B is wrong because social media is typically low-risk. Option D is wrong because bank traffic is often financial. Option E is wrong because internal corporate traffic can be decrypted.

Answer

Traffic to social media websites.

Answer

Traffic between internal data center servers.

Answer

Traffic to external email services (e.g., Gmail).

Question 3

Based on the exhibit, what is the most likely cause for the majority of bypassed sessions?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the clients or servers.. The majority of bypassed sessions are most likely caused by a cipher mismatch between the firewall's SSL/TLS service profile and the clients or servers. When the firewall decrypts traffic, it must negotiate a cipher suite that both the client and server support; if the service profile does not include the cipher suites used by the endpoints, the firewall cannot complete the SSL/TLS handshake and bypasses the session. This is a common misconfiguration in Palo Alto Networks firewalls where the SSL/TLS service profile's cipher list is too restrictive.

Answer

The firewall is overloaded and cannot handle more decryption sessions.

Answer

The decryption certificate is not trusted by clients.

Answer

There is a network connectivity issue between firewall and servers.

Question 4

A company wants to decrypt traffic to productivity and collaboration sites but avoid decrypting traffic to financial and healthcare sites due to compliance. How should the SSL decryption policy be configured?

Accepted Answer

Create a rule to decrypt based on URL categories except financial and healthcare.. Option B is correct because URL Category-based rules allow granular exclusion by category. Option A is wrong because decrypting all then blocking exceptions is inefficient. Option C is wrong because site lists are static and not category-based. Option D is wrong because decryption policy does not support schedule-based rules.

Answer

Add all financial and healthcare sites to a custom URL list and exclude them.

Answer

Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

Answer

Use time-based rules to apply decryption only during business hours.

Question 5

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. Option B is correct because TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 6

Which TWO conditions typically cause the firewall to bypass SSL decryption for a session? (Choose two.)

Accepted Answer

The client and server negotiate a cipher suite not supported by the firewall.. Option B is correct because if the client and server negotiate a cipher suite that the firewall does not support, the firewall cannot decrypt the session. The firewall must be able to inspect the SSL/TLS handshake and match the cipher suite to its supported list; if the cipher suite is unsupported (e.g., TLS 1.3-only ciphers on an older firewall), decryption fails and the session is bypassed. Option C is correct because when the server presents an invalid certificate (expired, untrusted, or mismatched), the firewall cannot complete the SSL handshake with the client, so it bypasses decryption to avoid breaking the session.

Answer

The firewall detects that the session is already decrypted (e.g., by another device).

Answer

The traffic matches a 'no-decrypt' rule in the decryption policy.

Answer

The decrypted data exceeds a certain size threshold.

Question 7

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

Accepted Answer

Policy-based forwarding (PBF) with source criteria. Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Answer

Multiple virtual routers

Answer

ECMP with route metrics

Answer

Subinterfaces per ISP

Question 8

Which TWO of the following are required for stateful failover in an Active/Passive HA pair?

Accepted Answer

HA1 link configured with a dedicated interface.. In an Active/Passive HA pair, stateful failover requires the HA1 link (management/control plane synchronization) and the HA2 link (data plane session synchronization) to be configured with dedicated interfaces. The HA1 link ensures heartbeat and configuration sync, while the HA2 link synchronizes session tables so that the passive firewall can seamlessly take over active sessions without disruption.

Answer

HA3 link configured with a dedicated interface.

Answer

Heartbeat backup link configured.

Answer

Session table synchronization enabled.

Question 9

Which THREE of the following are mandatory components for GlobalProtect client connectivity?

Accepted Answer

Authentication profile.. The GlobalProtect portal and gateway are the two fundamental server-side components required for client connectivity. The portal provides the initial configuration, including gateway lists and client settings, while the gateway terminates the VPN tunnel and enforces security policies. An authentication profile is mandatory because the portal must verify the user's identity before the client can download the portal configuration and subsequently connect to a gateway.

Answer

Client certificate.

Answer

DNS suffix.

Question 10

A company has a firewall with multiple virtual routers. They need to ensure that traffic from a specific subnet (10.1.1.0/24) can reach the internet but not other internal subnets. What is the best way to achieve this?

Accepted Answer

Implement security policies with source zone and destination zone. Option C is correct because security policies in Palo Alto Networks firewalls control traffic based on source and destination zones, enabling you to restrict traffic from the 10.1.1.0/24 subnet (assigned to a specific zone) to only the internet zone while blocking access to other internal subnets. This is achieved by creating a security policy that allows traffic from the source zone (e.g., 'Internal') to the destination zone (e.g., 'Internet') and explicitly denying traffic to other internal zones, without relying on routing or NAT.

Answer

Use NAT policies

Answer

Configure static routes in the virtual router

Answer

Configure path monitoring