PCNSE Troubleshoot Practice Test 2 — 15 Questions

Question 1

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A URL Filtering profile is applied to the rule and is blocking the website's URL category.. A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.

Answer

The security policy rule does not have logging enabled at session end.

Answer

SSL decryption is enabled but the website certificate is untrusted.

Answer

A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

Question 2

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

Accepted Answer

Verify that the firewall's PAN-OS version is supported by the Panorama version.. The 'template validation error' during a commit indicates that the configuration templates being pushed are incompatible with the target firewall's PAN-OS version. Panorama templates may include features or syntax not supported by older firewall versions, causing the validation to fail. Therefore, verifying that the firewall's PAN-OS version is within the supported matrix for the Panorama version is the first logical step.

Answer

Ensure that the administrator account has superuser privileges.

Answer

Check that the firewall is connected to the internet for cloud services.

Answer

Review the system logs on the firewall for disk space errors.

Question 3

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

Accepted Answer

The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.. In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.

Answer

The firewall's decryption policy is set to 'no-decrypt' for the application.

Answer

The firewall's internet link experiences periodic packet loss.

Answer

The SaaS application's certificate is expired or revoked.

Question 4

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

Accepted Answer

The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.. When a security policy rule is configured with a deny action and logging is set to 'log at session end', the firewall will not generate a log entry because the session is denied immediately and never reaches a normal session end. In Palo Alto Networks firewalls, session end logging requires the session to be established and then terminate naturally; a denied session is dropped before any session state is created, so no log is generated. To capture logs for denied traffic, logging must be explicitly enabled at session start or the rule must be configured to log at session start.

Answer

The firewall's system log rate is exceeded and logs are dropped.

Answer

The rule has logging disabled for the 'deny' action.

Answer

The rule is not being matched because a previous rule allows the traffic.

Question 5

A Panorama-managed firewall is not sending logs to Panorama. The firewall is operational and policies are being pushed successfully. Which of the following is the most likely cause?

Accepted Answer

The security policy rules do not have a Log Forwarding profile applied.. The firewall is operational and policies are being pushed successfully, indicating that Panorama management connectivity is intact. Logs are generated only when a security policy rule matches traffic, and by default, logs are not sent to Panorama unless a Log Forwarding profile is explicitly applied to the rule. Without this profile, the firewall does not forward logs to the Panorama collector, even though the rule is enforced.

Answer

The Panorama collector group is not configured correctly.

Answer

The firewall's management interface is not reachable from Panorama.

Answer

The log buffer on the firewall is full.

Question 6

A remote user is unable to connect to the GlobalProtect gateway. The user's client shows 'Connecting' but never establishes a tunnel. The firewall shows no drops in the GlobalProtect logs. Which of the following should be checked first?

Accepted Answer

Ensure the gateway's certificate is trusted by the client machine.. When the GlobalProtect client shows 'Connecting' but never establishes a tunnel, and the firewall logs show no drops, the issue is likely a certificate trust failure during the TLS handshake. The gateway's certificate must be trusted by the client machine (e.g., via a trusted root CA or imported certificate), otherwise the client cannot validate the gateway and will hang at 'Connecting' without generating a log drop on the firewall.

Answer

Verify that the GlobalProtect portal is reachable from the internet.

Answer

Check if the user's authentication credentials are correct.

Answer

Confirm that the user's client is on the same subnet as the gateway.

Question 7

A new application is not being identified by the firewall. Traffic for the application is being treated as 'unknown-tcp'. Which action should be taken to resolve this?

Accepted Answer

Create an application override for the application.. When a firewall fails to identify an application and treats its traffic as 'unknown-tcp', the most direct and efficient solution is to create an application override. This manually maps the traffic (based on IP/port/protocol) to the correct application, bypassing the firewall's signature-based identification. Option D is correct because it immediately resolves the misclassification without waiting for signature updates or weakening security by broadly allowing unknown traffic.

Answer

Modify the security policy rule to allow 'unknown-tcp'.

Answer

Update the application and threat signatures.

Answer

Disable application identification on the zone.

Question 8

A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?

Accepted Answer

Use the CLI command 'show running resource-monitor' to view CPU usage per module.. The 'show running resource-monitor' CLI command provides a per-module breakdown of CPU utilization, including dataplane, management plane, and individual packet processing threads. This granular view is the most effective first step because high CPU on a Palo Alto firewall is often caused by a specific module (e.g., a dataplane core processing excessive traffic or a session table scan), and isolating the module directs further troubleshooting. Other options, like checking rule hit counts or session counts, are secondary steps that do not pinpoint the CPU-consuming component.

Answer

Review the security policy rule hit counts to see if a specific rule is hit frequently.

Answer

Check the number of active sessions using 'show session info'.

Answer

Inspect the packet buffer usage with 'show counter packet-buffer'.

Question 9

Which TWO CLI commands can be used to check whether a specific security policy rule is being matched by traffic? (Choose two.)

Accepted Answer

show security-policy rule-usage. Option B, 'show security-policy rule-usage', is correct because it displays per-rule hit counters for security policy rules, directly showing whether traffic has matched a specific rule. Option C, 'show session all filter rule ', is correct because it filters the session table by the rule name, letting you see active sessions that were permitted by that specific policy rule, which confirms the rule is being matched. Option A, 'show session limit', only displays session capacity/limits and does not indicate rule matching. Option D, 'show security-policy rule ', displays the rule's configuration rather than match statistics. Option E, 'show running security-policy', shows the running policy configuration, not whether traffic is hitting a rule.

Answer

show session limit

Answer

show security-policy rule <rulename>

Answer

show running security-policy

Question 10

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Accepted Answer

Use the Panorama API to retrieve logs.. Option B is correct because Panorama exposes a REST API (and XML API) that lets external systems query and retrieve logs programmatically, for example via the /API/?type=log&log-type=traffic endpoint, making it a valid method to export logs to an external system. Option D is correct because Panorama supports Log Forwarding profiles that can be attached to Log Forwarding or Collector Group configurations to forward logs to external destinations such as syslog servers, SNMP traps, email, or HTTP(S) receivers. Option A is incorrect because NetFlow export is a feature of firewalls (and can be configured on Panorama-managed firewalls), not a Panorama log-export mechanism; Panorama itself does not act as a NetFlow exporter for its logs. Option C is incorrect because the Panorama web interface does not provide a direct 'export logs as CSV' function for log data; logs are viewed/filtered in the Monitor tab and exported via API or forwarding. Option E is incorrect because SNMP traps are used for monitoring and alerting on system events, not for exporting log data from Panorama to an external log system.

Answer

Configure a NetFlow exporter on Panorama.

Answer

Export logs as CSV directly from the Panorama web interface.

Answer

Use SNMP traps to send log data.

Question 11

Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)

Accepted Answer

The server sends a TCP RST packet to the client.. Option A is correct because a 'tcp-rst-from-server' end reason is recorded precisely when the server side of the connection transmits a TCP RST packet, which immediately tears down the session instead of a normal FIN/ACK exchange. Option B is correct because an application override that misidentifies the traffic can cause the firewall to apply the wrong App-ID/decoder, leading the endpoint or the firewall to reset the connection, which surfaces as a tcp-rst-from-client or tcp-rst-from-server end reason. Option D is correct because a decryption error during the SSL handshake (for example, a certificate or cipher mismatch) causes the firewall or endpoint to abort the connection with a TCP RST, producing one of these reset flags. Option C is not correct because an idle timeout produces a 'tcp-fin' or timeout-based end reason (such as 'aged-out'), not a RST flag. Option E is not correct because session resource exhaustion causes new sessions to be dropped or discarded, which is reported as a 'resources-unavailable' or drop reason rather than a tcp-rst-from-server/client flag.

Answer

The session reaches the configured idle timeout.

Answer

The firewall runs out of session resources and starts dropping new sessions.

Question 12

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 13

After upgrading a PA-5250, the firewall is not passing traffic. The administrator checks the dataplane CPU utilization and sees it is at 100%. Which command should be run to identify the cause?

Accepted Answer

show system resources dataplane. The 'show system resources dataplane' command displays detailed CPU utilization per dataplane core, which is critical for identifying whether a single core is maxed out (e.g., due to a traffic storm or a specific session) or if the load is evenly distributed. In a PA-5250, the dataplane handles packet forwarding; 100% CPU indicates the dataplane is overwhelmed, and this command pinpoints the exact core(s) under stress, guiding further investigation into the root cause.

Answer

show session all

Answer

show counter global

Answer

show running resource-monitor

Question 14

A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?

Accepted Answer

The domain controller security policy is blocking RPC traffic.. User-ID mapping via domain controller polling relies on the firewall querying the domain controller's security event logs using RPC (Remote Procedure Call). If the domain controller's security policy blocks RPC traffic (typically TCP port 135 and dynamic RPC ports), the firewall cannot retrieve the login events needed to map users to IP addresses, causing incorrect or missing User-ID mappings.

Answer

The firewall is not configured for TLS decryption.

Answer

The user-ID agent is not installed.

Answer

The firewall does not have network access to the domain controller.

Question 15

A security administrator is trying to isolate a performance issue on a PA-3220. Which two commands provide real-time information about the dataplane performance? (Choose two.)

Accepted Answer

show system resources dataplane. Option A, 'show system resources dataplane', is correct because it displays real-time CPU, memory, and resource utilization specifically for the dataplane on a PA-3220, directly helping isolate dataplane performance issues. Option C, 'show running resource-monitor', is correct because it provides a live, continuously updating view of resource usage (such as CPU, memory, and session counts) that refreshes in real time, making it ideal for observing dataplane performance as it happens. Option B, 'show counter global', shows cumulative global counters and drop statistics rather than real-time performance data, so it is not a real-time dataplane performance command. Option D, 'show session info', reports session table statistics and utilization but not live dataplane performance metrics. Option E, 'show job all', lists background system jobs and their status, which is unrelated to real-time dataplane performance monitoring.

Answer

show counter global

Answer

show session info

Answer

show job all