PCNSA Device Management and Services Practice Question
A network administrator needs to configure certificate-based authentication for administrative access to the firewall's web interface. Which two actions are required?
⚠ Common exam trap
A common mix-up: candidates confuse server certificate configuration (for the firewall's web interface) with client certificate authentication (for user login), leading them to select options like creating a local user with a certificate profile instead of focusing on the server-side certificate assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Import a CA-signed certificate for the firewall.
For certificate-based authentication of administrative access to the firewall's web interface, you must import a CA-signed certificate for the firewall (Option D) because the browser must trust the certificate presented by the firewall during the TLS handshake. Additionally, you must assign that certificate to the HTTPS management interface (Option E) so the firewall uses it for TLS sessions on the management web interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a self-signed server certificate on the firewall.
Why it's wrong here
Self-signed may work but is not considered a required best practice for production environments.
- ✗
Create a local user with a certificate profile.
Why it's wrong here
This is for client certificate authentication, not server certificate setup.
- ✗
Import a CRL from the issuing CA.
Why it's wrong here
CRL is optional for certificate revocation validation.
- ✓
Import a CA-signed certificate for the firewall.
Why this is correct
A CA-signed certificate is needed for trusted HTTPS access.
- ✓
Assign the certificate to the HTTPS management interface.
Why this is correct
The certificate must be assigned to the management interface to be used.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.