PCNSE Troubleshoot Practice Test 3 — 15 Questions

Question 1

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.. In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.

Answer

The firewall's decryption policy is set to 'no-decrypt' for the application.

Answer

The firewall's internet link experiences periodic packet loss.

Answer

The SaaS application's certificate is expired or revoked.

Question 2

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

Accepted Answer

The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.. When a security policy rule is configured with a deny action and logging is set to 'log at session end', the firewall will not generate a log entry because the session is denied immediately and never reaches a normal session end. In Palo Alto Networks firewalls, session end logging requires the session to be established and then terminate naturally; a denied session is dropped before any session state is created, so no log is generated. To capture logs for denied traffic, logging must be explicitly enabled at session start or the rule must be configured to log at session start.

Answer

The firewall's system log rate is exceeded and logs are dropped.

Answer

The rule has logging disabled for the 'deny' action.

Answer

The rule is not being matched because a previous rule allows the traffic.

Question 3

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

Accepted Answer

show session all filter source 10.1.1.100. The 'show session all filter source 10.1.1.100' command displays active sessions in the firewall's session table, including the source IP, destination IP, and the translated (NAT) IP addresses. This allows the administrator to verify whether the internal IP 10.1.1.100 is being NATed to a public IP when accessing the internet, as the session table shows both the pre-NAT and post-NAT source addresses.

Answer

show running nat-policy

Answer

show nat rule

Answer

show address 10.1.1.100

Question 4

A Panorama-managed firewall is not sending logs to Panorama. The firewall is operational and policies are being pushed successfully. Which of the following is the most likely cause?

Accepted Answer

The security policy rules do not have a Log Forwarding profile applied.. The firewall is operational and policies are being pushed successfully, indicating that Panorama management connectivity is intact. Logs are generated only when a security policy rule matches traffic, and by default, logs are not sent to Panorama unless a Log Forwarding profile is explicitly applied to the rule. Without this profile, the firewall does not forward logs to the Panorama collector, even though the rule is enforced.

Answer

The Panorama collector group is not configured correctly.

Answer

The firewall's management interface is not reachable from Panorama.

Answer

The log buffer on the firewall is full.

Question 5

A remote user is unable to connect to the GlobalProtect gateway. The user's client shows 'Connecting' but never establishes a tunnel. The firewall shows no drops in the GlobalProtect logs. Which of the following should be checked first?

Accepted Answer

Ensure the gateway's certificate is trusted by the client machine.. When the GlobalProtect client shows 'Connecting' but never establishes a tunnel, and the firewall logs show no drops, the issue is likely a certificate trust failure during the TLS handshake. The gateway's certificate must be trusted by the client machine (e.g., via a trusted root CA or imported certificate), otherwise the client cannot validate the gateway and will hang at 'Connecting' without generating a log drop on the firewall.

Answer

Verify that the GlobalProtect portal is reachable from the internet.

Answer

Check if the user's authentication credentials are correct.

Answer

Confirm that the user's client is on the same subnet as the gateway.

Question 6

A new application is not being identified by the firewall. Traffic for the application is being treated as 'unknown-tcp'. Which action should be taken to resolve this?

Accepted Answer

Create an application override for the application.. When a firewall fails to identify an application and treats its traffic as 'unknown-tcp', the most direct and efficient solution is to create an application override. This manually maps the traffic (based on IP/port/protocol) to the correct application, bypassing the firewall's signature-based identification. Option D is correct because it immediately resolves the misclassification without waiting for signature updates or weakening security by broadly allowing unknown traffic.

Answer

Modify the security policy rule to allow 'unknown-tcp'.

Answer

Update the application and threat signatures.

Answer

Disable application identification on the zone.

Question 7

A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?

Accepted Answer

Use the CLI command 'show running resource-monitor' to view CPU usage per module.. The 'show running resource-monitor' CLI command provides a per-module breakdown of CPU utilization, including dataplane, management plane, and individual packet processing threads. This granular view is the most effective first step because high CPU on a Palo Alto firewall is often caused by a specific module (e.g., a dataplane core processing excessive traffic or a session table scan), and isolating the module directs further troubleshooting. Other options, like checking rule hit counts or session counts, are secondary steps that do not pinpoint the CPU-consuming component.

Answer

Review the security policy rule hit counts to see if a specific rule is hit frequently.

Answer

Check the number of active sessions using 'show session info'.

Answer

Inspect the packet buffer usage with 'show counter packet-buffer'.

Question 8

Which TWO CLI commands can be used to check whether a specific security policy rule is being matched by traffic? (Choose two.)

Accepted Answer

show security-policy rule-usage. The 'show security-policy rule-usage' command displays the hit count for each security policy rule, allowing you to verify if a specific rule has been matched by traffic. Option C is correct because 'show session all filter rule <rulename>' filters active sessions by the rule name, showing only sessions that matched that specific security policy rule, which directly confirms rule usage.

Answer

show session limit

Answer

show security-policy rule <rulename>

Answer

show running security-policy

Question 9

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Accepted Answer

Use the Panorama API to retrieve logs.. Panorama provides a RESTful API that allows external systems to programmatically retrieve logs via HTTPS requests. This is a supported method for exporting logs to external systems, enabling integration with SIEM tools or custom scripts for log analysis and monitoring.

Answer

Configure a NetFlow exporter on Panorama.

Answer

Export logs as CSV directly from the Panorama web interface.

Answer

Use SNMP traps to send log data.

Question 10

Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)

Accepted Answer

The server sends a TCP RST packet to the client.. A TCP RST packet from the server indicates that the server has abruptly terminated the connection, often due to an application-layer error or a protocol violation. The firewall logs this as 'tcp-rst-from-server' in the session end reason, reflecting that the reset originated from the server side.

Answer

The session reaches the configured idle timeout.

Answer

The firewall runs out of session resources and starts dropping new sessions.

Question 11

Refer to the exhibit. A user at 10.1.1.10 is trying to connect to a web server at 203.0.113.5 on port 443. The session shows 'State: DROP' with reason 'policy-deny'. However, the administrator has a security policy rule that allows SSL traffic from the source zone to the destination zone. What is the most likely cause of the drop?

Accepted Answer

The security policy rule that allows SSL is in a different rulebase or zone than the traffic.. The session shows 'policy-deny' with a DROP state, which indicates that the traffic matched a deny rule or did not match any allow rule in the security policy. Even though the administrator believes an SSL allow rule exists, the most common cause is that the rule is in a different rulebase (e.g., pre-rulebase or post-rulebase) or the traffic is traversing a different zone pair than the one the rule applies to. The firewall evaluates rules in a specific order (pre-rulebase, then rulebase, then post-rulebase), and if the rule is not in the correct location for the traffic's ingress and egress zones, it will not be matched, resulting in a policy-deny drop.

Answer

The source NAT rule is missing, so the private IP cannot reach the internet.

Answer

The SSL application is not correctly identified because the traffic is encrypted.

Answer

The firewall is configured to block SSL sessions that use weak ciphers.

Question 12

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Accepted Answer

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.. The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer

The service 'application-default' does not match port 443; a custom service must be used.

Answer

The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

Answer

SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

Question 13

Refer to the exhibit. A firewall system log contains a critical license expiration entry for URL Filtering. What will happen to URL Filtering functionality?

Accepted Answer

URL Filtering will continue to use the last downloaded URL database but will not receive updates.. When a URL Filtering license expires on a Palo Alto Networks firewall, the device does not immediately disable the feature. Instead, it continues to use the last downloaded URL database to categorize URLs, but it will no longer receive periodic database updates from the Palo Alto Networks update server. This ensures that existing traffic policies based on URL categories remain functional, though new or changed URLs may not be accurately categorized until the license is renewed.

Answer

The firewall will stop passing traffic until the license is renewed.

Answer

URL Filtering will stop working immediately until a new license is installed.

Answer

The firewall will automatically fall back to a basic URL category list.

Question 14

A network engineer notices that traffic from a specific subnet is being dropped by the firewall. The traffic log shows 'drop' with reason 'policy deny'. The engineer checks the security policy and confirms there is an allow rule for that subnet. What should be checked next?

Accepted Answer

Check the rule order and ensure the allow rule is above any deny rules.. When a traffic log shows 'policy deny' despite an existing allow rule, the most common cause is rule order: Palo Alto firewalls evaluate security rules from top to bottom, and the first matching rule is applied. If a deny rule appears above the allow rule for the same subnet, the deny rule will match first and drop the traffic, making it essential to verify the rule sequence.

Answer

Check the application override.

Answer

Check the QoS policy.

Answer

Check the NAT policy for the traffic.

Question 15

During a troubleshooting session, a user reports that they cannot access an internal web server through the firewall's public IP. The firewall is configured with destination NAT. The engineer checks the NAT policy and sees the rule is active. What should be the next step to verify the NAT is functioning correctly?

Accepted Answer

Check the session table to see if the NAT translation is occurring.. Checking the session table (e.g., using 'show session all' or 'show session id <id>') directly confirms whether the destination NAT (DNAT) translation is being applied to the traffic. If the session shows the original destination IP being translated to the internal server's IP, the NAT rule is functioning; if not, the issue lies elsewhere (e.g., policy order, matching conditions). This is the most immediate and definitive verification step in a Palo Alto Networks firewall.

Answer

Check the application dependency.

Answer

Check the security policy for the post-NAT zone.

Answer

Check the routing table for the destination.