You are troubleshooting an issue where a site-to-site VPN tunnel is 'up' but no traffic passes. Which tool is best suited to verify if the packets are being encapsulated correctly?
A administrator is troubleshooting an intermittent application failure. The Traffic log shows the session is aging out due to 'tcp-rst-from-client'. What is the most effective way to determine if the Palo Alto Networks firewall is prematurely closing the session?
An administrator observes that traffic from the internal network to a specific external server is being dropped. The Traffic Log shows 'drop' with the 'policy-deny' reason. Which tool should the administrator use to identify which security policy is causing this drop?
An administrator has configured a new NAT rule, but traffic is not traversing it. Which column in the NAT logs is the most useful for verifying the NAT translation is occurring?
An administrator needs to perform a packet capture to troubleshoot a slow application. Which stage is most appropriate to capture the packet to ensure it is being decrypted?
A network security analyst is investigating why a user's web browsing session is being blocked by the firewall. The analyst runs a packet capture and sees that the firewall is resetting the connection after the TLS handshake. The analyst suspects that SSL decryption is failing. Which of the following is the most likely cause?
A network security analyst is troubleshooting a Palo Alto Networks firewall where users on the internal network can reach external web servers, but a new web server in the DMZ cannot be reached from the internet. The analyst confirms that the security policy allows the traffic and that the server is up. The analyst suspects a network address translation (NAT) issue. Which CLI command should the analyst use to view the current NAT policy rules and their hit counts?
A network security analyst is investigating why a client cannot reach a web server. The analyst runs 'test security-policy-match from trust to untrust source 10.1.1.50 destination 203.0.113.10 destination-port 443 protocol 6' and the output shows that the traffic matches a security policy with action 'allow', but the client still cannot connect. The analyst suspects that the application is not being identified correctly. Which TWO additional checks should the analyst perform to validate application identification? (Choose two.)
A network security analyst is troubleshooting an issue where a specific application is not being identified correctly by the firewall's App-ID engine. The analyst wants to gather information to determine why the application is being misclassified. Which two actions should the analyst take to troubleshoot this issue? (Choose two.)
A security analyst is investigating a report of slow network performance for a specific application. The analyst suspects that the firewall is performing excessive threat inspection, causing latency. The analyst wants to verify which security profiles are applied to the relevant security policy rule and whether any are causing high CPU usage. Which CLI command should the analyst use to view the security profiles attached to a specific rule?
A network security analyst is troubleshooting a connectivity issue and needs to check whether a specific security policy rule is being matched for a given IP address and port. The analyst wants to simulate a packet with source IP 10.1.1.1, destination IP 192.168.1.1, destination port 443, and protocol TCP. Which CLI command should the analyst use to test the security policy match?
A network security analyst is troubleshooting why an internal user cannot reach a web server at 10.10.20.5 over TCP port 8080. The analyst runs a packet capture on the firewall and sees the client's SYN packet arriving, but no SYN-ACK is returned. The security policy for this traffic is configured with application 'web-browsing' and service 'application-default'. Which action should the analyst take to most directly determine why the firewall is not forwarding the SYN?
A security analyst is investigating a sudden increase in CPU usage on a Palo Alto Networks firewall. The analyst wants to identify which process is consuming the most CPU resources on the management plane. Which CLI command should the analyst use?
A network security analyst notices that a critical application is being blocked by the firewall even though a security policy rule allows it. The analyst runs 'test security-policy-match' and sees that the traffic matches a deny rule with a higher priority. The analyst suspects that the application is not being correctly identified. Which log column should the analyst examine to confirm the application identification and determine why it is misclassified?
A network security administrator is troubleshooting an issue where users cannot access a web application hosted on an internal server. The security policy is configured to allow the application, but traffic is being denied. The administrator suspects that the application is being identified incorrectly. Which two actions should the administrator take to verify and resolve the App-ID identification issue? (Choose two.)
A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the firewall is blocking the traffic due to a URL filtering profile. Which CLI command should the analyst use to verify if the URL is being blocked by a URL filtering profile?
A network security analyst is troubleshooting an issue where a user cannot access a specific website. The analyst checks the traffic log and sees that the session is being denied by a security policy. The analyst wants to determine which security policy rule is blocking the traffic. Which action should the analyst take?
A network security analyst is troubleshooting a site-to-site VPN where the tunnel status is 'up', but users cannot access resources across the tunnel. The analyst suspects that the proxy IDs are misconfigured. Which CLI command should the analyst use to verify the proxy IDs for the tunnel?
A security analyst is investigating a performance issue where a firewall's dataplane CPU is consistently high. The analyst suspects that a specific application is consuming excessive resources due to a large number of sessions. Which CLI command should the analyst use to identify the top applications by session count?
A security administrator is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing through it. The administrator has verified that the security policies allow the traffic and that the tunnel interfaces are correctly configured. Which tool should the administrator use to determine if the packets are being encrypted and sent into the tunnel?
A network security analyst is troubleshooting an issue where a user cannot access a web application. The analyst runs 'show session all filter source 10.1.1.100' and sees the session in an 'active' state, but the application is identified as 'incomplete'. The analyst wants to see the packet-level details to determine why the application is not being fully identified. Which CLI command should the analyst use to capture the relevant packets?
An administrator is troubleshooting an issue where SSL decryption is failing for a specific web application. The forward proxy is configured correctly, and the certificate is trusted. Users report that they receive certificate errors when accessing the application. Which step should the administrator take to identify why SSL decryption is failing for this application?
A network security analyst is troubleshooting an issue where a firewall's management interface is unreachable. The analyst has console access and suspects that the management plane CPU is overloaded. Which CLI command should the analyst use to identify the top processes consuming CPU on the management plane?
A network security analyst is troubleshooting an issue where a user cannot access a web application. The analyst runs 'test security-policy-match' and finds that the traffic is being denied by a security policy. The analyst wants to determine which TWO factors could cause the traffic to match a deny rule instead of the intended allow rule. (Choose two.)
A network security analyst is troubleshooting a connectivity issue and needs to verify whether the firewall is receiving packets on a specific interface. Which CLI command should the analyst use to view real-time packet capture on the interface?
A network security analyst is troubleshooting a site-to-site VPN issue where the tunnel is up, but traffic is not passing. The analyst suspects that the proxy IDs are mismatched. Which CLI command should the analyst use to verify the proxy IDs configured for the VPN tunnel?
A network security analyst is troubleshooting an issue where a user cannot reach an external web server through the firewall. The security policy is configured to allow the traffic, and the routing table on the firewall shows a valid default route. The analyst runs a packet capture on the firewall's ingress interface and sees the client's SYN packets arriving, but no SYN-ACK is returned. The analyst suspects the firewall is dropping the packets. Which troubleshooting step should the analyst perform next to determine why the firewall is dropping the packets?
A network security analyst is troubleshooting a connectivity issue where a client cannot access a server across a VPN tunnel. The analyst runs a packet capture on the firewall's tunnel interface and sees that packets are being sent into the tunnel, but no packets are received back. The analyst suspects that the remote peer is not receiving or processing the packets. Which tool should the analyst use to verify whether the packets are being encrypted and sent out correctly?
A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?
Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?
A user reports that they are seeing a 'Server Certificate Warning' when accessing an internal site. Which feature should the administrator investigate?
An administrator wants to verify that a specific Threat Prevention profile is applied to a security rule. Where is the most accurate place to check this?
An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?
A network security analyst notices that the dataplane CPU on a Palo Alto Networks firewall is consistently above 90%. They need to identify which network interface is generating the highest volume of traffic to pinpoint the source of the load. Which CLI command should they use?
A network security analyst is troubleshooting a connectivity problem where internal users cannot reach an external web server. The analyst suspects a NAT issue. After running a packet capture on the firewall, the analyst sees that the source IP address of outbound packets is not being translated to the firewall's external IP address. Which of the following is the most likely cause?
A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?
A network administrator is troubleshooting why a site-to-site VPN tunnel between two Palo Alto Networks firewalls is not establishing. The administrator runs 'show vpn ike-sa' and sees that the IKE phase 1 negotiation is failing. Which of the following is the most likely cause?
An administrator is troubleshooting why a site-to-site VPN tunnel is not passing traffic despite the tunnel showing as 'up'. The administrator suspects that the Phase 2 selectors (proxy IDs) are mismatched. Which TWO commands should the administrator use to verify the proxy IDs on both ends of the tunnel? (Choose two.)
A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?
A network security analyst notices that a critical business application is intermittently failing. The application traffic passes through a Palo Alto Networks firewall. The analyst wants to identify exactly which security policy rule is allowing or denying the traffic in real time, without committing changes. Which CLI command should the analyst use?
A security analyst is troubleshooting an issue where a critical application is being blocked intermittently. The analyst suspects that the application is being identified differently at different times. Which TWO actions should the analyst take to verify the application identification and policy matching? (Choose two.)
A network administrator is troubleshooting a connectivity issue between two sites connected by an IPsec VPN. The VPN tunnel status shows as 'up', but no traffic is passing. The administrator wants to verify whether packets are being encrypted and decrypted correctly. Which tool should the administrator use?
A network security administrator notices that a critical business application is intermittently failing to connect through the firewall. The security policy allows the application based on its App-ID. During a failure, the administrator runs a packet capture on the firewall and sees that the first few packets of the session are allowed, but subsequent packets are dropped. Which troubleshooting step should the administrator take first to identify the cause?
A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?
A network security analyst is troubleshooting a connectivity issue where a client cannot access a web server. The analyst runs 'test security-policy-match' and finds that the traffic matches a rule that allows the application 'web-browsing'. However, the analyst notices that the rule has a 'URL Filtering' profile attached that blocks the 'malware' category. The analyst wants to verify whether the URL category of the web server is being correctly identified. Which CLI command should the analyst use to test the URL category for the web server?
A network security analyst is troubleshooting why a security policy is not matching traffic as expected. The analyst runs 'test security-policy-match' and sees that the traffic matches a policy, but the action is 'deny'. The analyst wants to see the exact rule that matched. Which field in the output should the analyst examine to identify the matching rule?
A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?
A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?
A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)
A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?
A network security analyst is troubleshooting a performance issue where throughput on a specific sub-interface is lower than expected. The analyst needs to monitor real-time throughput data for that sub-interface to determine if the interface is saturated. Which CLI command should the analyst use?
A NetSec-Analyst is troubleshooting a connectivity issue between two internal subnets. The analyst suspects that the firewall is dropping packets due to a security policy. Which CLI command should the analyst use to view the security policy that is matching a specific flow?
A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)
A network security analyst is troubleshooting connectivity issues between two internal subnets separated by a firewall. The analyst suspects that the firewall is dropping packets due to a security policy rule. Which CLI command should the analyst use to view the real-time packet drop counters for the firewall's dataplane?
A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the traffic is being denied by a security policy. Which CLI command should the analyst use to simulate the flow and see which security policy rule is matching?
A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)
A network security analyst is investigating why a specific application is not being identified correctly by App-ID. The analyst wants to see the details of how the firewall classified the application for a particular session. Which CLI command should the analyst use to display the application identification details for an active session?
A network security administrator is troubleshooting an issue where a user cannot access a website. The administrator checks the traffic log and sees that the session was denied by a security policy. To determine which security policy rule is causing the denial, which CLI command should the administrator use?
A security analyst is investigating why a large file transfer from a trusted internal server to an external partner is being blocked. The security policy allows the application 'ftp' and the service 'application-default'. The analyst runs 'show session all filter source 10.1.1.5' and sees the session is in the 'discard' state. Which action should the analyst take next to determine the cause?
A network security analyst is troubleshooting why a security policy is not matching traffic from a specific user. The policy is configured to allow HTTP traffic from the 'Trust' zone to the 'Untrust' zone for a specific source IP. The analyst runs 'test security-policy-match' and sees that the traffic matches a different policy that denies it. The analyst wants to determine the exact order of policy evaluation and why the deny policy is matching first. Which action should the analyst take?
A network security analyst is troubleshooting a site-to-site VPN issue where the tunnel is up, but traffic is not passing. The analyst has verified that the IKE and IPsec security associations are established. The analyst suspects that the issue is related to routing or policy. Which two actions should the analyst perform to further troubleshoot the problem? (Choose two.)