PCNSE Troubleshoot Practice Test 3 — 15 Questions

Question 1

An engineer is troubleshooting a scenario where traffic from a specific source IP is not being logged although the security policy log setting is set to 'log at session end'. Which three conditions could prevent logging for that traffic? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The traffic is denied by a rule that has logging disabled.. Option A is correct because a deny rule with logging disabled will silently drop the traffic, so no log entry is generated even though other rules may have logging enabled. Option C is correct because 'log at session end' only produces a log when the session closes normally; if the session is reset or torn down abnormally, the end-of-session log may never be written. Option E is correct because when the firewall's log rate capacity is exceeded, it can drop or suppress log records, so traffic that should be logged at session end may not appear. Option B is not correct because global log filtering exclusions are not a standard mechanism that suppresses logging for a specific source IP in this way. Option D is not correct because a rule set to 'log at session start' would still generate a log entry, just at the beginning of the session rather than at session end, so it would not prevent logging entirely.

Answer

The source IP is in a global log filtering exclusion.

Answer

The traffic matches a rule with 'log at session start' only.

Question 2

A healthcare organization recently replaced their primary internet circuit and changed the next-hop IP for the default route from 203.0.113.1 to 198.51.100.1. After the change, all internet traffic is failing. The firewall is a PA-220 running PAN-OS 9.1. The administrator verifies that the new default route is present in the virtual router and that the security policies are unchanged. The IP address configuration on the ethernet interface is correct and the link is up. When pinging 8.8.8.8 from the firewall's management interface, it succeeds. But traffic from internal hosts fails. The traffic log shows 'drop' with reason 'route - no route to host'. What is the most likely cause?

Accepted Answer

The default route is not in the same virtual router as the internal zones.. The traffic log shows 'route - no route to host', which indicates the firewall cannot find a valid path for the traffic. Even though the default route is present in the virtual router, if the internal zones (e.g., trust zone) are in a different virtual router than the one containing the default route, the firewall will not use that default route for traffic from those zones. Each virtual router maintains its own routing table, and inter-virtual-router routing requires explicit route leaking or redistribution.

Answer

The new internet circuit does not allow ICMP.

Answer

The internal hosts have incorrect DNS settings.

Answer

The ARP table for the gateway is stale.

Question 3

A large enterprise uses a PA-5250 as a perimeter firewall with multiple virtual systems (vsys). One vsys is for the DMZ, and it is logging high amounts of dropped traffic. The administrator notices that the firewall's dataplane CPU is consistently above 80%. The logs show many 'application-id timeout' drops. The DMZ hosts are running custom applications on non-standard ports. What is the first step to mitigate the issue?

Accepted Answer

Use a custom application signature for the custom applications.. The 'application-id timeout' drops occur because the firewall's App-ID engine cannot identify the custom applications running on non-standard ports, so sessions time out waiting for identification. Creating a custom application signature lets the firewall correctly identify this traffic, eliminating the timeout drops and reducing the dataplane CPU load caused by repeated unidentified session processing. This directly addresses the root cause rather than masking symptoms.

Answer

Disable application identification for the DMZ zone.

Answer

Reduce the number of security rules in the DMZ.

Answer

Increase the application identification timeout for the custom applications.

Question 4

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

Accepted Answer

The authentication sequence changed after upgrade.. After upgrading the GlobalProtect portal and gateway from version 5.0 to 5.1, the authentication sequence may have been reset or changed. If the authentication profile uses LDAP but the sequence now includes a RADIUS server that is unreachable or misconfigured, the user will fail to authenticate even though the LDAP bind works from the CLI. The error 'Unable to connect to gateway' combined with authentication failure points to a change in the authentication order, not a certificate or connectivity issue.

Answer

The LDAP server certificate has expired.

Answer

The RADIUS server is not reachable.

Answer

The GP portal certificate is not trusted by the client.

Question 5

A network engineer is troubleshooting a slow file transfer through a PA-5200. The file transfer is between two sites connected via IPsec VPN. The firewall has a symmetric crypto profile with AES-256 and SHA-256. The throughput is lower than expected. The engineer checks the dataplane CPU and sees it is 30%. The firewall's interface counters show no errors. What should be the first step to improve throughput?

Accepted Answer

Enable hardware acceleration for VPN.. The PA-5200 firewall has dedicated hardware acceleration for IPsec VPN processing, which offloads crypto operations from the dataplane CPU. With the dataplane CPU at only 30% and no interface errors, the bottleneck is likely that the VPN traffic is being processed in software rather than hardware. Enabling hardware acceleration (option B) allows the firewall to use its onboard crypto engine, significantly improving throughput for AES-256 and SHA-256 operations.

Answer

Disable anti-replay protection.

Answer

Change the encryption algorithm to AES-128.

Answer

Increase the MTU on the tunnel interface.

Question 6

A security administrator reports that they can ping and access internal resources, but cannot access any external websites. The firewall is configured with a default route pointing to the internet router, and the NAT policy includes a source NAT rule for the internal subnet. Which step should the administrator take first to troubleshoot this issue?

Accepted Answer

Review the security policy to ensure traffic from the internal zone to the external zone is allowed.. The administrator can ping and access internal resources but cannot reach external websites, which indicates that basic IP connectivity and internal routing are functional. Since the firewall has a default route and a source NAT rule configured, the most likely cause is that a security policy is blocking traffic from the internal zone to the external zone. In Palo Alto Networks firewalls, security policies are evaluated before NAT, so even with correct NAT and routing, traffic will be dropped if no allow rule exists for the session.

Answer

Check the NAT rule for correct interface assignment.

Answer

Check the DNS proxy configuration on the firewall.

Answer

Verify that the default route is active by checking the routing table.

Question 7

Based on the exhibit, which THREE conclusions can be drawn?

Accepted Answer

The session was matched by the security rule 'allow-ssl'.. Option A is correct because the session output explicitly shows the session matched by the security rule named 'allow-ssl', which confirms the policy lookup result for this flow. Option D is correct because the session is shown in an active state (e.g., a state such as 'ACTIVE' or an established/forwarding condition), meaning the firewall is currently permitting and tracking the flow rather than dropping or tearing it down. Option E is correct because the destination address in the session is a public, globally routable IP address rather than a private RFC 1918 address, indicating the session is destined for a public IP. Option B does not belong because source NAT translation status is not established by the exhibit; the session details would need to show a translated source address or NAT rule to conclude that no translation occurs. Option C does not belong because the rule name 'allow-ssl' and the session context point to TCP-based SSL/TLS traffic, not UDP.

Answer

The source NAT is not translating the source IP.

Answer

The traffic is using UDP protocol.

Question 8

A company with multiple branch offices connects to headquarters using IPSec VPN tunnels terminated on PA-220 firewalls. Users at one branch report intermittent connectivity issues when accessing critical applications hosted at HQ. Ping tests to HQ servers succeed consistently, but TCP-based applications (e.g., file transfers, web access) frequently drop connections after a few seconds, particularly when transferring large data. The VPN tunnel status shows 'active' with no rekeys. Security policies are configured to allow all required application traffic. Interface statistics show no discards or errors. Which action should be taken to resolve the issue?

Accepted Answer

Reduce the MTU on the branch firewall's WAN interface to 1400.. The symptoms—consistent pings but TCP drops on large transfers—strongly point to a Path MTU Discovery (PMTUD) failure. When the VPN tunnel encapsulates packets with IPsec headers, the effective MTU shrinks. If the WAN interface MTU remains at the default 1500, large TCP segments get fragmented or dropped, causing TCP connections to stall. Reducing the MTU on the branch firewall's WAN interface to 1400 ensures that the total packet size (including IPsec overhead) stays within the path's physical MTU, allowing PMTUD to work correctly and preventing silent packet drops.

Answer

Disable TCP checksum offloading on the clients.

Answer

Change the IPSec encryption algorithm from AES-256 to AES-128.

Answer

Increase the TCP timeout value in the security policy.

Question 9

A firewall administrator notices that the dataplane CPU is consistently high on a PA-5220 firewall. After reviewing the session table, the administrator sees many sessions with the flag 'tcp-rst-from-server'. The administrator wants to identify which application is causing the most server resets. Which tool should the administrator use to quickly identify the top applications by session count with that flag?

Accepted Answer

The Application Command Center (ACC) with a filter on the session flag 'tcp-rst-from-server'.. The ACC provides aggregated, filterable views of network activity. By filtering on the session flag 'tcp-rst-from-server', the administrator can see which applications are generating the most sessions with that flag. This aggregated view is the fastest way to identify the culprit application. Other commands either provide raw session lists or resource monitoring without application breakdown.

Answer

The 'debug dataplane packet-diag set filter match flag tcp-rst-from-server' command and then view the packet capture.

Answer

The 'show session all filter flag tcp-rst-from-server' command and manually count applications.

Answer

The 'show running resource-monitor' command to view per-application CPU usage.

Question 10

A network administrator is troubleshooting why a Palo Alto Networks firewall is not decrypting traffic for a specific website even though SSL Forward Proxy decryption is configured and applied in the security policy. The administrator has verified that the certificate is trusted and the website is not in the decryption exclusion list. Which of the following is the most likely reason for the decryption not occurring?

Accepted Answer

The website uses a cipher suite that is not supported by the firewall's decryption profile.. When SSL Forward Proxy decryption fails for a specific website while others work, a common cause is an unsupported cipher suite. The firewall's decryption profile must support the cipher suites used by the website. If the website uses a cipher suite that is not enabled or supported, the firewall cannot decrypt the traffic. Other options like no-decrypt action or expired license would have broader effects. Certificate pinning would typically cause client-side errors, not a failure to decrypt.

Answer

The firewall's SSL decryption license has expired.

Answer

The website uses certificate pinning, which prevents decryption.

Answer

The security policy rule is set to 'no-decrypt' for the application.

Question 11

A network security engineer is troubleshooting why a PA-5220 firewall is not decrypting traffic for a specific website. The SSL Forward Proxy decryption policy is configured to decrypt traffic to that website, and the certificate is trusted. The engineer runs 'show system setting ssl-decrypt' and sees that the status is 'enabled'. However, the traffic logs show the application as 'ssl' and not 'web-browsing', and no decryption is occurring. What is the most likely cause?

Accepted Answer

The website uses TLS 1.3 with Encrypted Client Hello (ECH) or the firewall does not support decryption of TLS 1.3.. The firewall is not decrypting traffic to a specific website despite a decryption policy. The most likely cause is that the website uses TLS 1.3 with features like Encrypted Client Hello (ECH) that prevent the firewall from identifying the SNI or decrypting. The firewall may also lack support for TLS 1.3 decryption if not configured properly. Checking the decryption profile and PAN-OS version is necessary. Other causes like certificate trust or license issues would affect all decryption, not just one site.

Answer

The firewall's SSL decryption license has expired.

Answer

The website uses a self-signed certificate that is not trusted by the firewall.

Answer

The decryption policy rule is not matching because the source user or source zone is incorrect.

Question 12

A security engineer is troubleshooting an issue where a Palo Alto Networks firewall is not generating a Threat log for a known exploit attempt. The engineer confirms that the vulnerability protection profile is applied to the security policy rule that matches the traffic, and the action is set to 'alert'. What is the most likely reason the Threat log is not appearing?

Accepted Answer

The vulnerability protection profile is not configured to log the specific threat signature.. Threat logs are generated based on the action configured in the vulnerability protection profile for each signature. If the signature action is set to 'alert' but logging is not enabled for that signature, no log is generated. The profile must be configured to log the threat, either by setting the action to 'alert' with logging enabled or by using a separate log setting. Other options are less likely given the scenario.

Answer

The Threat log is only generated for 'block' actions, not 'alert'.

Answer

The firewall's log quota for Threat logs has been exceeded, so new logs are dropped.

Answer

The log forwarding profile is not configured to forward Threat logs to Panorama.

Question 13

An administrator is investigating why a critical business application performs poorly only for users in the branch office, while users at headquarters report no issues. The branch users access the application via a site-to-site IPsec tunnel terminated on a PA-3220. The administrator checks the tunnel status and sees it is up. Which Palo Alto Networks tool should the administrator use to identify whether packets are being fragmented or dropped due to MTU issues within the tunnel?

Accepted Answer

Use the 'test vpn ipsec-sa' command to check the tunnel status and then use 'ping' with the 'df-bit' and varying packet sizes from a branch client to the application server.. The correct approach is to verify the tunnel and then test the actual path MTU from the affected client to the server. Using ping with the DF bit and varying packet sizes allows the administrator to discover the exact MTU that causes fragmentation or drops. This directly addresses the branch-specific performance issue, as it tests the real user-to-application path and identifies if the tunnel's MTU is too low for the application's traffic.

Answer

Use the 'show counter global filter delta yes' command to check for packet fragmentation and reassembly counters.

Answer

Use the 'test vpn ipsec-sa' command to verify the IPsec security association and rekey timers.

Answer

Use the 'ping' command with the 'df-bit' and varying packet sizes from the branch firewall to the headquarters firewall.

Question 14

A network engineer is troubleshooting why a PA-3220 firewall is not blocking traffic that matches a security policy rule set to 'deny'. The rule is in the correct zone and has the correct source and destination addresses. The administrator runs 'show session all filter source 10.1.1.100 destination 8.8.8.8' and sees a session with application 'incomplete' and state 'ACTIVE'. What is the most likely reason the deny rule is not being applied?

Accepted Answer

Application identification has not completed, so the firewall uses the default application 'incomplete' and may not match the deny rule.. The key issue is that application identification is not yet complete, so the firewall cannot match the deny rule that likely specifies an application. The session shows 'incomplete', meaning the firewall is still analyzing the traffic. Until identification finishes, a broader allow rule may permit the session. This is a common troubleshooting point: application-based rules require successful identification, and delays can cause temporary allows.

Answer

The security policy rule is not committed.

Answer

The deny rule is placed after an allow rule that matches the traffic.

Answer

The firewall is in tap mode and does not block traffic.

Question 15

A firewall administrator is unable to commit a configuration change because the commit fails with an error related to a duplicate object name. The administrator wants to quickly identify which object is causing the conflict. Which CLI command should the administrator use to validate the configuration and see the specific error?

Accepted Answer

validate full. The 'validate full' command checks the entire candidate configuration for errors, including duplicate object names, and returns specific error messages. It is the standard CLI tool for pre-commit validation. Other commands like 'show config diff' only show changes, and 'check config' does not exist. Using 'validate full' allows the administrator to quickly locate and resolve the conflict.

Answer

check config

Answer

show config diff

Answer

debug config validate