PCNSA Practice Questions

Question 1

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Accepted Answer

The position of the deny rule in the rulebase relative to allow rules.. The firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.

Answer

Whether logging is enabled on the rule.

Answer

Whether SSL decryption is enabled for the traffic.

Question 2

Drag and drop the steps to configure a NAT policy on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Navigate to Policies > NAT, add rule > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Configure Translated Packet (Translated Source, Translated Destination) > Commit. NAT policy configuration requires specifying original and translated addresses, service, and committing.

Answer

Navigate to Policies > NAT, add rule > Configure Translated Packet (Translated Source, Translated Destination) > Configure Original Packet (Source Zone, Destination Zone, Source Address, Destination Address, Service) > Commit

Answer

Configure Original Packet > Navigate to Policies > NAT, add rule > Configure Translated Packet > Commit

Answer

Navigate to Policies > NAT, add rule > Configure Original Packet > Commit > Configure Translated Packet

Question 3

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit. VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Answer

Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit

Answer

Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit

Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy

Question 4

A junior administrator is investigating a network issue where traffic to a critical server is being blocked. To see the specific security rule that matched and the action taken, which log should the administrator review?

Accepted Answer

Traffic log. The Traffic log records every session that traverses the firewall, including the specific security rule that matched and the action taken (allow, deny, drop, etc.). Since the administrator needs to identify which rule blocked the traffic to the critical server, the Traffic log is the correct source. System, Threat, and Config logs do not provide per-session rule matching details.

Answer

System log

Answer

Threat log

Answer

Config log

Question 5

A company has a PA-5250 firewall in an active/passive HA pair. During a maintenance window, the administrator upgrades the passive firewall from PAN-OS 10.0 to 10.1. After the upgrade, the passive firewall fails to synchronize with the active firewall. The active firewall remains at 10.0. What is the most likely cause?

Accepted Answer

The PAN-OS versions are different between the HA peers. PAN-OS requires both HA peers to run the same major version to synchronize configuration and state. The active firewall at PAN-OS 10.0 and the passive at 10.1 are incompatible, preventing HA synchronization. Even though the passive firewall was upgraded, the active firewall remains on the older version, breaking the HA session.

Answer

The HA2 link is down or misconfigured

Answer

The HA keepalive timer is misconfigured

Answer

The passive firewall has preemption enabled

Question 6

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Accepted Answer

The custom application signatures were not migrated.. During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Answer

The security rules were modified.

Answer

The application database was rolled back.

Answer

The firewall needs a reboot.

Question 7

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Accepted Answer

The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.. The most likely cause is that a more specific route for 10.10.20.0/24 in the virtual router's routing table points to a different virtual router or interface that belongs to a different zone. In Palo Alto Networks firewalls, zone membership is determined by the ingress interface, not by the source IP address alone. If traffic from the new subnet enters through an interface in a different zone, the security rule with source zone 'Internal' will not match, and the SSH connection is denied or dropped. This explains why other subnets in Internal work while the new subnet does not, even though the source address object covers it.

Answer

The application is not correctly identified because the SSH server uses a non-standard port.

Answer

There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.

Answer

The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.

Question 8

An administrator notices that the firewall's time is incorrect. Based on the exhibit, what is the most likely cause?

Accepted Answer

NTP service is stopped. The firewall's time is incorrect because the NTP service is stopped. NTP (Network Time Protocol) is responsible for synchronizing the system clock with an external time source. Without NTP, the firewall relies on its internal hardware clock, which can drift over time, leading to an incorrect time.

Answer

DNS proxy is running

Answer

Management service is down

Answer

SNMP is running

Answer

Syslog is running

Question 9

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 10

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Accepted Answer

The application is incorrectly identified; perhaps the traffic is using a different app.. The rule specifies application 'web-browsing', but the traffic may be classified as a different application (e.g., 'ssl' or 'http-proxy'), causing a mismatch. Even though the traffic uses port 80, the firewall identifies applications by signature, not just port. Option A is not necessary; the application does not need to be 'any' to match. Option C is false; the log setting does not affect whether the rule is hit. Option D is incorrect; a broad destination address (any) is not an issue.

Answer

The application must be set to 'any'.

Answer

The log setting is preventing hits.

Answer

The destination address is too broad.

Question 11

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

Accepted Answer

Create an App-ID override for the application's specific IP addresses and ports.. An App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Answer

Disable App-ID for the security policy rule that allows this traffic.

Answer

Upgrade the App-ID database to the latest version.

Answer

Add the application's TCP port to the service definition in the security policy.

Question 12

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

Accepted Answer

Using an FTP server. PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Answer

Using the CLI

Answer

Using the Web GUI

Answer

Using Panorama

Question 13

Which TWO of the following are key benefits of using an Application-Based Security Policy compared to a Port-Based Security Policy? (Choose TWO.)

Accepted Answer

Ability to control applications regardless of port or protocol evasion. Option B is correct because an Application-Based Security Policy identifies traffic by the application signature itself rather than by TCP/UDP port, so it can still enforce policy even when an application uses non-standard ports, tunnels over another protocol, or otherwise attempts port/protocol evasion. Option D is correct because application-based policies natively identify the specific application in use, enabling granular logging, reporting, and auditing of application usage to satisfy compliance requirements. Option A is incorrect because application-based policies are generally more complex to configure than simple port-based rules for well-known protocols like HTTP (TCP 80) and FTP (TCP 21). Option C is incorrect because, while application identification can help with dynamic-port applications, the primary stated benefit is control regardless of port, and port-based policies can also be written to permit dynamic port ranges. Option E is incorrect because application-based inspection typically requires deep packet inspection, which adds processing overhead rather than increasing throughput.

Answer

Simpler configuration for traditional protocols like HTTP and FTP

Answer

Easier to allow applications that use dynamic ports

Answer

Increased throughput because firewall does not need to inspect ports

Question 14

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 15

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Accepted Answer

Add two or more interfaces as members of the virtual wire. Option E is correct because creating the virtual wire object under Network > Virtual Wires is the foundational step that defines the vwire and lets you bind its interfaces. Option A is correct because a virtual wire must have at least two interfaces assigned as members (typically a pair) so that traffic can be bridged transparently between them. Option C is correct because, as with any PAN-OS configuration change, the candidate configuration must be committed for the virtual wire to take effect. Option B is not valid because a virtual wire operates at Layer 2 and is transparent, so it does not have or require an IP address. Option D is not a required configuration step for the vwire itself; security policy is a separate function and is not part of the virtual wire setup process.

Answer

Assign an IP address to the virtual wire

Answer

Create a security policy allowing traffic on the virtual wire

Palo Alto Networks Certified Network Security Administrator PCNSA practice test

Three ways to study

Study PCNSA by domain

Study PCNSA by topic

Managing Objects practice questions

Securing Traffic practice questions

Policy Evaluation and Management practice questions

Device Management and Services practice questions

App-ID and Content-ID practice questions

Decryption and Monitoring practice questions

PCNSA fundamentals practice questions

PCNSA scenario practice questions

PCNSA troubleshooting practice questions

Top PCNSA questions

Palo Alto Networks Certified Network Security Administrator PCNSA practice questions