PCNSE Timed Practice Test 5 — 10 Questions

Question 1

A team uses the Panorama API to generate custom reports. They need to retrieve a list of all rules that have logging at session end enabled. Which API endpoint should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules. The 'SecurityRule' object in the API provides access to security policy rules, including logging settings. 'LogSetting' is for log forwarding profiles. 'DeviceGroup' is for device group hierarchy. 'Report' is for running predefined reports.

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=get&xpath=/config/shared/log-settings

Answer

GET /api/?type=report&reporttype=predefined

Question 2

A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?

Accepted Answer

TCP sessions are being terminated due to MSS clamping issues.. The 'flow_aged_error_tcp_mss' counter increments when the firewall ages out TCP sessions due to TCP MSS (Maximum Segment Size) clamping issues. This occurs when the firewall modifies the MSS value in SYN packets to avoid fragmentation, but the actual path MTU is smaller than the clamped MSS, causing the session to be terminated prematurely. The rapid increment indicates that MSS clamping is misconfigured or the path MTU is inconsistent, leading to session failures.

Answer

The firewall is experiencing a SYN flood attack.

Answer

There is a routing loop causing packet retransmission.

Answer

The firewall's hardware acceleration is failing.

Question 3

Which TWO configurations are required for User-ID to work using the Windows User-ID Agent (WUA) in a distributed environment?

Accepted Answer

The User-ID Agent must have permissions to query Active Directory domain controllers.. Option A is correct because the Windows User-ID Agent (WUA) must have permissions to query Active Directory (AD) domain controllers to retrieve user login events (e.g., security event ID 4624). Without these permissions, the agent cannot map IP addresses to usernames, which is the core function of User-ID in a distributed environment.

Answer

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Answer

An Application Override policy must be created for User-ID traffic.

Answer

The User-ID Agent must be in the same Layer 2 subnet as the users.

Question 4

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

Accepted Answer

The server is sending a FIN/RST prematurely due to application layer issues.. Option C is correct because a session in CLOSE state indicates the firewall has already processed and closed the session, often due to a FIN/RST received. This could happen if the server closes the connection prematurely due to a mismatch in application detection or timeout. Option A is wrong because a deny policy would show a different drop reason. Option B is wrong because asymmetric routing would show a different session state (e.g., SYN_SENT). Option D is wrong because packet buffer exhaustion would cause drops across all traffic, not specific sessions.

Answer

A deny all security policy is blocking the traffic.

Answer

Asymmetric routing is causing the session to be torn down.

Answer

Packet buffer exhaustion on the firewall is causing drops.

Question 5

A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?

Accepted Answer

Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.. Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet. This is the standard method for inter-virtual-router routing without dynamic redistribution.

Answer

Create a security policy rule allowing the traffic between the zones.

Answer

Configure route redistribution between VR-A and VR-B using a routing protocol.

Answer

Place all interfaces in the same virtual router.

Question 6

Which THREE are common causes of high CPU utilization on a Palo Alto Networks firewall? (Choose three.)

Accepted Answer

Large number of dynamic IP address group lookups.. A large number of dynamic IP address group lookups can cause high CPU utilization because each lookup requires the firewall to evaluate the dynamic group membership in real time, often involving LDAP or other directory queries. This process is computationally expensive, especially when policies trigger frequent lookups for every new session, leading to sustained CPU spikes.

Answer

Insufficient disk space on the log partition.

Answer

BGP prefix flapping causing route recalculations.

Question 7

After upgrading a PA-5250 from PAN-OS 9.1 to PAN-OS 10.1, the firewall fails to establish IPsec VPN tunnels with remote peers. The crypto profiles and IKE gateways appear unchanged. What is the most likely cause?

Accepted Answer

The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.. In PAN-OS 10.1, the default minimum pre-shared key length for IKEv2 was increased to 32 characters. If the existing PSK is shorter than 32 characters, the firewall will reject it during IKE negotiation, causing the tunnel to fail even though the crypto profiles and IKE gateways appear unchanged. This is a common compatibility issue when upgrading from PAN-OS 9.1, which had no such minimum length requirement.

Answer

The default SSL/TLS service profile changed, affecting management access.

Answer

The upgrade reset the IKE gateway configuration to default.

Answer

The firewall's management IP address changed during the upgrade.

Question 8

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

Accepted Answer

Configure a 'Log Forwarding' profile with 'Buffering' enabled.. Option C is correct because enabling 'Buffering' in the log forwarding profile stores logs locally when Panorama is unreachable and forwards them once connectivity is restored. Options A and B do not address unreachability. Option D (syslog) is independent but still requires connectivity.

Answer

Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

Answer

Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

Answer

Use the 'High Availability' feature with active/passive.

Question 9

An organization is migrating from a legacy firewall to a Palo Alto Networks firewall and needs to ensure that all existing application-based policies are accurately replicated. The engineer exports the configuration from the old firewall and imports it using the 'Config Audit' feature. After import, the engineer notices that many security policy rules have the application set to 'any' instead of the specific applications from the old firewall. What is the most likely reason?

Accepted Answer

The administrator did not correctly map the old firewall's application signatures to Palo Alto Networks application IDs during the migration.. Option C is correct because the 'Config Audit' feature in Palo Alto Networks firewalls compares rule configurations but does not automatically translate third-party application signatures into Palo Alto Networks App-IDs. The administrator must manually map the old firewall's application definitions to the correct App-IDs during migration; otherwise, the imported rules default to 'any' for the application field, as the system cannot infer the intended application without explicit mapping.

Answer

The old firewall did not support application identification, so the import process defaulted to 'any'.

Answer

The import process uses a different naming convention for applications, causing a mismatch.

Answer

The 'Config Audit' tool does not import applications; it only identifies rule conflicts.

Question 10

An administrator needs to configure a firewall to send email alerts when a specific security policy rule is triggered. Which two configuration elements are required? (Choose two.)

Accepted Answer

An 'Email Server' profile configured with SMTP server details.. Options A and B are correct. A log forwarding profile defines the action (email), and an email server profile defines the SMTP server details. The security policy rule itself also needs logging enabled, but the question specifically asks for elements to send email alerts, which are the log forwarding profile and the email server profile.

Answer

A 'Security Policy' rule with 'Log at Session End' enabled.

Answer

A 'Panorama' template to push the configuration.

Answer

A 'User-ID' agent to identify users.