PCNSE Troubleshoot — 30 Questions

Question 1

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

Accepted Answer

Check the IPSec tunnel status and IKE/IPSEC SA rekey timers. The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Answer

Check the traffic logs for any denial events

Answer

Reboot the firewall to clear any stale sessions

Answer

Verify the routing table on both firewalls

Question 2

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

Accepted Answer

Asymmetric routing causes the firewall to drop the SYN packet. The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Answer

Session offload is causing the packet to bypass security checks

Answer

The firewall is unable to resolve the destination MAC address

Answer

The destination NAT is misconfigured

Question 3

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

Accepted Answer

Check the security policy rulebase order and matching. The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Answer

Verify the user-ID agent is mapping the IP correctly

Answer

Check the service configuration for the destination port

Answer

Check the NAT configuration for the user's subnet

Question 4

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

Accepted Answer

The firewall is dropping the return traffic due to a missing policy. Option D is correct because even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Answer

The application is using asymmetric routing

Answer

The security policy is not logging the traffic correctly

Answer

The firewall is not inspecting UDP traffic correctly

Question 5

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

Accepted Answer

The client does not trust the certificate authority that signed the portal certificate. The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Answer

The portal service is not running

Answer

The portal's IP address is not routable from the internet

Answer

The portal certificate's subject name does not match the portal URL

Question 6

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

Accepted Answer

The URL filtering database is up-to-date. After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Answer

The SSL decryption policy is configured correctly

Answer

The security rule is still referencing the correct URL filtering profile

Answer

The URL filtering license is still valid

Question 7

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

Accepted Answer

Add the URL to an allow list in the URL filtering profile. Option D is correct because the traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Answer

Disable URL filtering on the existing security rule

Answer

Check the user-ID mapping to ensure the user is authenticated

Answer

Create a new security rule allowing the user's IP to any

Question 8

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

Accepted Answer

The firewall's App-ID identified the traffic as a different application than the one specified in the rule. The 'application mismatch' log reason indicates that the firewall's App-ID engine identified the traffic as a different application than the one specified in the security rule. Even though the rule allows the application you intended, the actual traffic does not match that App-ID signature, so the session is denied. This is a common scenario when the application classification does not align with the rule's application object.

Answer

The application is not recognized by the firewall and is treated as unknown

Answer

The security rule is not configured to allow any application

Answer

The firewall's SSL decryption is misconfigured

Question 9

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Accepted Answer

Check the rule order to see if a rule earlier in the policy is also matching. When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Answer

Use the packet capture tool to capture the traffic

Answer

Enable logging at session end for all rules

Answer

Check the server's network connectivity

Question 10

Which THREE components should be verified when troubleshooting a site-to-site IPSec VPN that is not coming up?

Accepted Answer

Pre-shared key configuration on both ends. The pre-shared key (PSK) must match exactly on both VPN peers. If the PSK differs, IKE Phase 1 authentication fails, preventing the tunnel from establishing. This is a fundamental requirement for both IKEv1 and IKEv2, as the PSK is used to generate authentication keys during the main or aggressive mode exchange.

Answer

Zone protection profile on the untrust zone

Answer

Interface management profile on the external interface

Question 11

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Accepted Answer

show vpn ike-sa. Option B is correct because 'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Answer

show system info

Answer

show routing route

Answer

show interface all

Question 12

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

Accepted Answer

The firewall might be incorrectly identifying the application as web-browsing when it is something else. When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Answer

The traffic is being blocked because the 'From Zone' is trust

Answer

The session is being denied by a different rule

Answer

The session is not being logged correctly

Question 13

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Accepted Answer

The traffic matched a security rule that explicitly denies it. The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Answer

A threat prevention profile detected and blocked the session

Answer

The traffic was blocked because the application is not allowed

Answer

The destination URL is categorized as prohibited

Question 14

A company has two Palo Alto Networks firewalls in an active/passive high availability pair. The firewalls are configured with a virtual IP (VIP) for the internal network. Recently, the passive firewall was upgraded to a new PAN-OS version. After the upgrade, the active firewall is still running the old version. The administrator wants to perform a failover to make the upgraded firewall active. However, when the administrator attempts to manually failover, the new passive firewall does not become active. The HA synchronization status shows 'synchronized' but the preemption is disabled. The administrator checks the HA configuration and finds that the peer's version is not compatible. What should the administrator do to successfully failover to the upgraded firewall?

Accepted Answer

Upgrade the active firewall to the same PAN-OS version as the passive firewall. Option B is correct because PAN-OS requires both firewalls in an active/passive HA pair to run the same major version to form a compatible HA connection. Even if synchronization status shows 'synchronized', the version mismatch prevents failover from succeeding. Upgrading the active firewall to match the passive firewall's version restores version compatibility and allows the failover to proceed.

Answer

Disable HA, then reconfigure HA on both firewalls

Answer

Force the failover via the CLI using 'request high-availability state suspend' on the active firewall

Answer

Downgrade the passive firewall back to the old version

Question 15

A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?

Accepted Answer

The gateway's interface is not in the same subnet as the IP pool. The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.

Answer

The GlobalProtect client is outdated

Answer

The LDAP authentication profile is misconfigured

Answer

The client certificate is not trusted by the gateway

Question 16

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

Accepted Answer

Asymmetric routing. Asymmetric routing can cause sessions to be created on one firewall while traffic returns via a different path, leading to session lookup failures and drops. This is a common cause of intermittent connectivity with active sessions.

Answer

DNS resolution failure

Answer

Security policy configured with service 'any'

Answer

Incomplete TCP three-way handshake

Question 17

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

Accepted Answer

The security policy rule's logging setting. If the security rule does not have logging enabled, no traffic logs are generated even if sessions are active. This is a common misconfiguration.

Answer

The interface management profile

Answer

The log retention settings

Answer

The system log severity level

Question 18

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). HA requires identical PAN-OS versions. A minor version mismatch, even a patch level difference, can cause the passive firewall to fail to synchronize.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 19

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. If the interface receiving the traffic has no management profile or is not configured to allow the necessary services (e.g., HTTP/HTTPS), the traffic may be dropped at the interface level. However, for pass-through traffic, the zone and interface assignment are critical. The most common first step is to verify the source and destination zones in the policy.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile

Question 20

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

Accepted Answer

A security policy rule with a geolocation-based deny is blocking the traffic. After tunnel establishment, traffic is subject to security policies. A misconfigured rule (e.g., geolocation-based deny) could block the traffic. Also, split tunneling settings could be misconfigured. The most common cause is a security policy blocking the traffic after tunnel is up.

Answer

Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

Answer

The GlobalProtect gateway is not configured with the correct client settings

Answer

The DNS proxy setting is misconfigured