PCNSE Troubleshoot — 25 Questions

Question 1

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing causes the firewall to drop the SYN packet. The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Answer

Session offload is causing the packet to bypass security checks

Answer

The firewall is unable to resolve the destination MAC address

Answer

The destination NAT is misconfigured

Question 2

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

Accepted Answer

The firewall is dropping the return traffic due to a missing policy. Even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Answer

The application is using asymmetric routing

Answer

The security policy is not logging the traffic correctly

Answer

The firewall is not inspecting UDP traffic correctly

Question 3

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

Accepted Answer

The client does not trust the certificate authority that signed the portal certificate. The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Answer

The portal service is not running

Answer

The portal's IP address is not routable from the internet

Answer

The portal certificate's subject name does not match the portal URL

Question 4

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

Accepted Answer

The URL filtering database is up-to-date. After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Answer

The SSL decryption policy is configured correctly

Answer

The security rule is still referencing the correct URL filtering profile

Answer

The URL filtering license is still valid

Question 5

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Accepted Answer

Check the rule order to see if a rule earlier in the policy is also matching. When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Answer

Use the packet capture tool to capture the traffic

Answer

Enable logging at session end for all rules

Answer

Check the server's network connectivity

Question 6

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

Accepted Answer

The firewall might be incorrectly identifying the application as web-browsing when it is something else. When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Answer

The traffic is being blocked because the 'From Zone' is trust

Answer

The session is being denied by a different rule

Answer

The session is not being logged correctly

Question 7

A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?

Accepted Answer

The gateway's interface is not in the same subnet as the IP pool. The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.

Answer

The GlobalProtect client is outdated

Answer

The LDAP authentication profile is misconfigured

Answer

The client certificate is not trusted by the gateway

Question 8

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

Accepted Answer

The security policy rule's logging setting. Even though the security policy rule has 'Log at Session End' enabled, logs may still not be generated if the setting is not correctly applied to the rule or if a logging profile overrides it. The engineer should verify the rule's logging configuration to ensure it is properly set and that no other rule or logging profile is suppressing the logs. Option A is correct because checking the logging setting on the rule is the first step to troubleshoot missing logs.

Answer

The interface management profile

Answer

The log retention settings

Answer

The system log severity level

Question 9

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 10

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

Accepted Answer

A security policy rule with a geolocation-based deny is blocking the traffic. Even though the GlobalProtect tunnel is established successfully, a security policy rule with a geolocation-based deny can block traffic from the user's source IP address. Since the user is connecting remotely, their IP address may fall into a denied geolocation region, preventing access to internal resources while the tunnel itself remains up. This matches the symptom of successful tunnel establishment but inability to access internal resources.

Answer

Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

Answer

The GlobalProtect gateway is not configured with the correct client settings

Answer

The DNS proxy setting is misconfigured

Question 11

A firewall is experiencing high CPU utilization. The engineer suspects a denial-of-service attack. Which command should be used to identify the source of the attack?

Accepted Answer

show session all | match . The 'show session all' command displays all active sessions on the firewall, and piping the output to 'match ' filters for sessions originating from a specific IP address. In a high CPU scenario suspected to be a DoS attack, this allows the engineer to quickly identify if a single source IP is generating an excessive number of sessions, which is a common indicator of a flood-based attack.

Answer

show counter global | match drop

Answer

request high-availability state

Answer

debug flow basic

Question 12

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

Accepted Answer

The source and destination zones are misconfigured. When a firewall logs 'No rule matched' despite a security policy rule existing, the most common cause is a zone mismatch. In Palo Alto Networks firewalls, security rules are evaluated based on source and destination zones; if the rule specifies different zones than the traffic's ingress and egress zones, the rule will not apply, resulting in a deny. Misconfigured zones prevent the rule from being considered, even if all other attributes (IP, port, application) match.

Answer

The rule is disabled

Answer

The user's IP is in a block list

Answer

The firewall is in transparent mode

Question 13

A firewall has a security policy that includes a rule with a 'Schedule' object. During the scheduled time, traffic should be allowed, but it is being blocked. The schedule is configured correctly. What could be the issue?

Accepted Answer

The schedule object uses the wrong time zone. The schedule object is configured correctly, but if the firewall's time zone setting does not match the schedule's time zone, the rule may activate at the wrong local time. For example, if the schedule is set to UTC but the firewall is in EST, traffic during the intended window will be blocked because the firewall evaluates the schedule against its own system time. This is a common misconfiguration where the schedule object itself is correct, but the time zone context is mismatched.

Answer

The schedule object is not referenced in the rule

Answer

The user's traffic is using a different application

Answer

The rule is placed incorrectly in the security policy

Question 14

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Accepted Answer

TCP sequence number mismatch due to packet reordering. Option A is correct because TCP sequence number mismatches caused by packet reordering can break an established session: the receiving host may see out-of-window or unexpected sequence numbers, drop segments, and trigger retransmissions or resets even though the initial three-way handshake succeeded. Option E is correct because asymmetric routing can cause return traffic to take a different path than the original flow, so stateful firewalls or security devices that did not see the full handshake may drop the packets, and TCP can also fail if sequence/acknowledgment behavior becomes inconsistent across paths. Option B is not a common cause of session drops after the handshake because interface speed mismatch typically affects link negotiation or throughput, not an already established TCP session. Option C is not a common cause after session creation because most firewalls evaluate policy at session setup; a later policy change usually affects new sessions unless the device is explicitly configured to re-evaluate or tear down existing flows. Option D is not correct because DNS resolution is used before the connection is established, so a DNS failure would prevent the initial connection rather than drop an existing session.

Answer

Firewall interface speed mismatch

Answer

Security policy change after session creation

Answer

DNS resolution failure

Question 15

Refer to the exhibit. The session is in FIN_WAIT state. What does this indicate about the TCP connection?

Accepted Answer

The firewall has closed the connection and is waiting for the client or server to finish. The FIN_WAIT state indicates that the firewall has sent a FIN packet to close its side of the TCP connection and is now waiting for the corresponding FIN acknowledgment (ACK) from the remote endpoint. This is a normal part of the TCP connection termination process, where the firewall initiates the close and waits for the peer to finish sending data and acknowledge the closure.

Answer

The connection is actively transferring data

Answer

The connection has timed out and is being removed

Answer

The firewall is waiting for a SYN-ACK from the destination

Question 16

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

Accepted Answer

A URL Filtering profile is applied to the rule and is blocking the website's URL category.. A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.

Answer

The security policy rule does not have logging enabled at session end.

Answer

SSL decryption is enabled but the website certificate is untrusted.

Answer

A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

Question 17

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

Accepted Answer

Verify that the firewall's PAN-OS version is supported by the Panorama version.. The 'template validation error' during a commit indicates that the configuration templates being pushed are incompatible with the target firewall's PAN-OS version. Panorama templates may include features or syntax not supported by older firewall versions, causing the validation to fail. Therefore, verifying that the firewall's PAN-OS version is within the supported matrix for the Panorama version is the first logical step.

Answer

Ensure that the administrator account has superuser privileges.

Answer

Check that the firewall is connected to the internet for cloud services.

Answer

Review the system logs on the firewall for disk space errors.

Question 18

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

Accepted Answer

The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.. In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.

Answer

The firewall's decryption policy is set to 'no-decrypt' for the application.

Answer

The firewall's internet link experiences periodic packet loss.

Answer

The SaaS application's certificate is expired or revoked.

Question 19

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

Accepted Answer

The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.. When a security policy rule is configured with a deny action and logging is set to 'log at session end', the firewall will not generate a log entry because the session is denied immediately and never reaches a normal session end. In Palo Alto Networks firewalls, session end logging requires the session to be established and then terminate naturally; a denied session is dropped before any session state is created, so no log is generated. To capture logs for denied traffic, logging must be explicitly enabled at session start or the rule must be configured to log at session start.

Answer

The firewall's system log rate is exceeded and logs are dropped.

Answer

The rule has logging disabled for the 'deny' action.

Answer

The rule is not being matched because a previous rule allows the traffic.

Question 20

A Panorama-managed firewall is not sending logs to Panorama. The firewall is operational and policies are being pushed successfully. Which of the following is the most likely cause?

Accepted Answer

The security policy rules do not have a Log Forwarding profile applied.. The firewall is operational and policies are being pushed successfully, indicating that Panorama management connectivity is intact. Logs are generated only when a security policy rule matches traffic, and by default, logs are not sent to Panorama unless a Log Forwarding profile is explicitly applied to the rule. Without this profile, the firewall does not forward logs to the Panorama collector, even though the rule is enforced.

Answer

The Panorama collector group is not configured correctly.

Answer

The firewall's management interface is not reachable from Panorama.

Answer

The log buffer on the firewall is full.