PCNSE Troubleshoot Practice Test 2 — 15 Questions

Question 1

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

Accepted Answer

Asymmetric routing. Asymmetric routing causes the firewall to see only one direction of a TCP session, leading to session timeouts despite active session entries. When traffic from the client to the database server traverses one firewall and return traffic takes a different path, the firewall cannot properly track the TCP state, resulting in dropped packets and intermittent connectivity.

Answer

DNS resolution failure

Answer

Security policy configured with service 'any'

Answer

Incomplete TCP three-way handshake

Question 2

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

Accepted Answer

The security policy rule's logging setting. Even though the security policy rule has 'Log at Session End' enabled, logs may still not be generated if the setting is not correctly applied to the rule or if a logging profile overrides it. The engineer should verify the rule's logging configuration to ensure it is properly set and that no other rule or logging profile is suppressing the logs. Option A is correct because checking the logging setting on the rule is the first step to troubleshoot missing logs.

Answer

The interface management profile

Answer

The log retention settings

Answer

The system log severity level

Question 3

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

Accepted Answer

Firmware version mismatch (one firewall is on 10.1.4). In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Answer

Heartbeat interface down

Answer

Management IP mismatch

Answer

License mismatch

Question 4

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Accepted Answer

The source and destination zones in the security policy. The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct. This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Answer

The firewall's DNS settings

Answer

The server's SSL certificate

Answer

The interface management profile

Question 5

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

Accepted Answer

A security policy rule with a geolocation-based deny is blocking the traffic. Even though the GlobalProtect tunnel is established successfully, a security policy rule with a geolocation-based deny can block traffic from the user's source IP address. Since the user is connecting remotely, their IP address may fall into a denied geolocation region, preventing access to internal resources while the tunnel itself remains up. This matches the symptom of successful tunnel establishment but inability to access internal resources.

Answer

Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

Answer

The GlobalProtect gateway is not configured with the correct client settings

Answer

The DNS proxy setting is misconfigured

Question 6

A firewall is experiencing high CPU utilization. The engineer suspects a denial-of-service attack. Which command should be used to identify the source of the attack?

Accepted Answer

show session all | match . The 'show session all' command displays all active sessions on the firewall, and piping the output to 'match ' filters for sessions originating from a specific IP address. In a high CPU scenario suspected to be a DoS attack, this allows the engineer to quickly identify if a single source IP is generating an excessive number of sessions, which is a common indicator of a flood-based attack.

Answer

show counter global | match drop

Answer

request high-availability state

Answer

debug flow basic

Question 7

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

Accepted Answer

Traffic log. The Traffic log records every session that matches a security rule, including the rule ID, source/destination IPs, ports, and action (allow/deny). To verify that a specific security rule is being hit, you must examine the Traffic log, as it shows which rule processed each session. Configuration, Threat, and System logs do not contain per-session rule match data.

Answer

Configuration log

Answer

Threat log

Answer

System log

Question 8

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

Accepted Answer

The source and destination zones are misconfigured. When a firewall logs 'No rule matched' despite a security policy rule existing, the most common cause is a zone mismatch. In Palo Alto Networks firewalls, security rules are evaluated based on source and destination zones; if the rule specifies different zones than the traffic's ingress and egress zones, the rule will not apply, resulting in a deny. Misconfigured zones prevent the rule from being considered, even if all other attributes (IP, port, application) match.

Answer

The rule is disabled

Answer

The user's IP is in a block list

Answer

The firewall is in transparent mode

Question 9

A firewall has a security policy that includes a rule with a 'Schedule' object. During the scheduled time, traffic should be allowed, but it is being blocked. The schedule is configured correctly. What could be the issue?

Accepted Answer

The schedule object uses the wrong time zone. The schedule object is configured correctly, but if the firewall's time zone setting does not match the schedule's time zone, the rule may activate at the wrong local time. For example, if the schedule is set to UTC but the firewall is in EST, traffic during the intended window will be blocked because the firewall evaluates the schedule against its own system time. This is a common misconfiguration where the schedule object itself is correct, but the time zone context is mismatched.

Answer

The schedule object is not referenced in the rule

Answer

The user's traffic is using a different application

Answer

The rule is placed incorrectly in the security policy

Question 10

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Accepted Answer

Verify the security policy order. Security policy order determines which rule matches traffic first; if a policy is misordered or a deny rule precedes an allow rule, traffic will be blocked. Verifying policy order ensures that the intended allow rule is evaluated before any conflicting deny rules, which is a fundamental step in troubleshooting traffic flow on a Palo Alto Networks firewall.

Answer

Reboot the firewall

Answer

Change the interface IP address

Answer

Update the threat prevention signature

Question 11

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Accepted Answer

TCP sequence number mismatch due to packet reordering. TCP sequence number mismatches can occur when packets are reordered, causing the firewall's TCP state engine to see an unexpected sequence number and drop the session. The firewall tracks TCP sequence numbers to validate that packets belong to an established session; if a packet arrives with a sequence number that does not match the expected window, the firewall may interpret it as a spoofed or invalid packet and terminate the session.

Answer

Firewall interface speed mismatch

Answer

Security policy change after session creation

Answer

DNS resolution failure

Question 12

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Accepted Answer

Matching IKE version and encryption algorithms. IKE (Internet Key Exchange) is the protocol that establishes the security association (SA) for an IPsec VPN. Both firewalls must agree on the IKE version (v1 or v2) and the encryption algorithms (e.g., AES-256, 3DES) during Phase 1 negotiation; a mismatch will cause the tunnel to fail to establish.

Answer

Same firewall model

Answer

Same certificate authority

Question 13

Refer to the exhibit. The session is in FIN_WAIT state. What does this indicate about the TCP connection?

Accepted Answer

The firewall has closed the connection and is waiting for the client or server to finish. The FIN_WAIT state indicates that the firewall has sent a FIN packet to close its side of the TCP connection and is now waiting for the corresponding FIN acknowledgment (ACK) from the remote endpoint. This is a normal part of the TCP connection termination process, where the firewall initiates the close and waits for the peer to finish sending data and acknowledge the closure.

Answer

The connection is actively transferring data

Answer

The connection has timed out and is being removed

Answer

The firewall is waiting for a SYN-ACK from the destination

Question 14

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

Accepted Answer

A URL Filtering profile is applied to the rule and is blocking the website's URL category.. A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.

Answer

The security policy rule does not have logging enabled at session end.

Answer

SSL decryption is enabled but the website certificate is untrusted.

Answer

A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

Question 15

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

Accepted Answer

Verify that the firewall's PAN-OS version is supported by the Panorama version.. The 'template validation error' during a commit indicates that the configuration templates being pushed are incompatible with the target firewall's PAN-OS version. Panorama templates may include features or syntax not supported by older firewall versions, causing the validation to fail. Therefore, verifying that the firewall's PAN-OS version is within the supported matrix for the Panorama version is the first logical step.

Answer

Ensure that the administrator account has superuser privileges.

Answer

Check that the firewall is connected to the internet for cloud services.

Answer

Review the system logs on the firewall for disk space errors.