Courseiva

CCNA Securing Traffic Questions

38 questions · Securing Traffic · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An administrator needs to allow DNS traffic from the Trust zone to the Untrust zone. The security policy rule uses the application 'dns' and service 'application-default'. Which port will be allowed by default?

A.TCP port 53 only
B.UDP port 53 only
C.TCP port 853
D.TCP and UDP port 53
AnswerD

The 'dns' application uses TCP and UDP port 53 by default. When 'application-default' is selected, the firewall automatically permits these ports. This is the correct answer because DNS primarily relies on port 53 for both TCP and UDP. Allowing this service ensures DNS queries and responses can pass.

Why this answer

The 'dns' application in Palo Alto Networks firewalls uses both TCP and UDP port 53. When 'application-default' is selected, the firewall automatically allows these ports. This ensures that DNS queries, responses, and zone transfers function properly without manual service definition.

Exam trap

The trap here is assuming DNS only uses UDP; however, TCP port 53 is also included in the default service for the 'dns' application.

Practice this question →
2
Multi-Selectmedium

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Select 2 answers
A.IPsec Decryption
B.SSH Proxy
C.SSL Inbound Inspection
D.Decryption Mirror
E.SSL Forward Proxy
AnswersC, E

SSL Inbound Inspection decrypts traffic destined to internal servers by installing the server's certificate and private key on the firewall, letting it terminate and inspect inbound TLS sessions. This satisfies the requirement for a valid decryption method alongside forward proxy inspection.

Why this answer

SSL Inbound Inspection (C) is a valid decryption method: the firewall is configured with the server's certificate and private key so it can decrypt traffic destined to an internal server, which is the standard approach for protecting inbound connections to your own web servers. SSL Forward Proxy (E) is also valid: the firewall acts as a man-in-the-middle, generating a forged certificate signed by a trusted CA and decrypting outbound client-initiated SSL/TLS sessions to inspect them. The other options are not decryption methods for SSL/TLS: IPsec Decryption (A) applies to IPsec VPN traffic, not SSL/TLS; SSH Proxy (B) is for controlling SSH sessions, not decrypting SSL/TLS; and Decryption Mirror (D) is a feature for copying decrypted traffic to a destination for analysis, not a method to decrypt SSL/TLS itself.

Exam trap

Candidates may mistakenly believe that SSH Proxy or IPsec Decryption are valid for SSL/TLS decryption, or confuse Decryption Mirror with an actual decryption method. Remember that only SSL Inbound Inspection and SSL Forward Proxy directly decrypt SSL/TLS.

Practice this question →
3
MCQhard

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

A.The security profile group applied to the rule is blocking the traffic before the rule is evaluated.
B.The custom object containing the malicious IP was not committed.
C.A rule with a broader match exists above the blocking rule in the rulebase.
D.The device clock is out of sync, causing time-based rules to fail.
AnswerC

PAN-OS evaluates rules top-down and stops at the first match. A broader rule positioned above the blocking rule matches the malicious destination first, so the later block is never evaluated despite the object being configured correctly.

Why this answer

In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Exam trap

The trap here is that candidates may assume a correctly configured object guarantees enforcement, overlooking the fundamental rulebase ordering principle where a higher-priority allow rule can override a lower-priority block rule.

How to eliminate wrong answers

Option A is wrong because security profile groups are applied after a rule is matched and do not block traffic before rule evaluation; they inspect allowed traffic. Option B is wrong because the administrator verified the custom object is correctly listed, implying it was committed; uncommitted objects would not be listed in the rule. Option D is wrong because an out-of-sync device clock affects time-based rules only if the rule has a schedule configured, and the question does not mention any time-based condition.

Practice this question →
4
MCQeasy

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

A.Block the social-networking category and allow a custom URL category containing LinkedIn URLs.
B.Alert the social-networking category and block a custom URL category for LinkedIn.
C.Block the social-networking category and block a custom URL category for LinkedIn.
D.Allow the social-networking category and block a custom URL category for LinkedIn.
AnswerA

Blocking the entire social-networking category denies all social media, then a custom URL category explicitly allowing LinkedIn URLs creates the permitted exception. URL filtering evaluates custom allow lists ahead of category blocks, so LinkedIn traffic passes while every other social-networking site remains blocked.

Why this answer

To block all social media except LinkedIn, you must block the social-networking URL category and allow a custom URL category containing LinkedIn URLs. URL filtering evaluates custom categories with higher priority than predefined categories, so the allow action for LinkedIn overrides the block for social-networking. This achieves the granular exception without unblocking the entire category.

Exam trap

PCNSA often tests the precedence of custom URL categories over predefined categories; candidates pick the option that blocks both categories because they forget that custom allow rules override predefined block rules.

How to eliminate wrong answers

Option B is wrong because alerting the social-networking category does not block it, and blocking LinkedIn is the opposite of the requirement. Option C is wrong because blocking both the social-networking category and LinkedIn would block LinkedIn, which the company wants to allow. Option D is wrong because allowing the social-networking category would allow all social media, and blocking LinkedIn would block the one site they want to permit.

Practice this question →
5
Multi-Selecthard

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Select 2 answers
A.Enable DNS Security on the outbound DNS traffic.
B.Configure DNS policies to block requests to unknown domains.
C.Allow all TCP traffic on port 53.
D.Enable logging on all DNS traffic for analysis.
E.Block all UDP traffic on port 53.
AnswersA, B

DNS Security detects tunneling attempts.

Why this answer

DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Exam trap

The trap here is that candidates often confuse passive monitoring (logging) with active prevention, or mistakenly think blocking all UDP on port 53 is a viable solution, not realizing it breaks legitimate DNS traffic.

Practice this question →
6
MCQmedium

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

A.Verify the source and destination zones are correct.
B.Ensure the application is identified by App-ID and that the correct application name is used.
C.Confirm that the action is set to allow.
D.Check the order of security rules.
AnswerB

Application-based rules match on App-ID signatures, not port or IP. If the cloud application's traffic is not yet identified, or the rule references a different application name than the one App-ID assigns, the session falls through to a deny rule, blocking permitted traffic.

Why this answer

In Palo Alto Networks App-ID-based security policy, the firewall matches traffic against the application signature, not just port/protocol. If a cloud application is allowed in the rule but traffic is still blocked, the most likely cause is that the firewall is identifying the traffic as a different App-ID (e.g., 'unknown-tcp', 'ssl', or a dependent application) than the one named in the rule. The administrator should first verify the actual App-ID being detected via the Traffic logs or Application Command Center and ensure the rule references that exact application name.

Exam trap

PCNSA often tests the misconception that allowing an application by name guarantees the firewall will recognize it as that application — candidates forget that App-ID depends on traffic inspection and may resolve to a different or unknown application.

How to eliminate wrong answers

Option A is wrong because zone mismatches would typically block all traffic from that source, not selectively block one cloud application while other traffic passes; zones are a coarse match criterion and would have been caught during initial rule design. Option C is wrong because if the action were not set to allow, no traffic matching the rule would pass at all — the symptom is application-specific blocking, not a blanket deny. Option D is wrong because rule order only matters when a preceding rule shadows the intended rule; while possible, it is not the first thing to check when the rule explicitly names the application and the issue is application identification.

Practice this question →
7
Multi-Selectmedium

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Select 2 answers
A.Configure NAT policies to translate internal addresses.
B.Define separate security zones for Engineering and Finance.
C.Create a single security zone for all internal traffic.
D.Enable QoS policies between the zones.
E.Apply Threat Prevention profiles to the inter-zone security rules.
AnswersB, E

Separate zones for Engineering and Finance create the trust boundaries that inter-zone security rules reference, enabling traffic between the departments to be inspected and controlled. Without distinct zones, segmentation policy cannot distinguish the two departments' traffic at the firewall.

Why this answer

Option B is correct because defining separate security zones for Engineering and Finance is the foundational step for segmenting internal traffic; zones are the logical containers that security rules reference, so distinct zones allow you to control and inspect traffic flowing between the two departments. Option E is correct because, once inter-zone rules exist between the Engineering and Finance zones, attaching Threat Prevention profiles (which bundle Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering) to those rules enforces the required threat inspection on that east-west traffic. Option A is incorrect because NAT policies only translate addresses for routing or hiding purposes and do not segment traffic or apply threat prevention.

Option C is incorrect because a single security zone for all internal traffic collapses the segmentation boundary, preventing distinct inter-zone policy enforcement. Option D is incorrect because QoS policies manage bandwidth and prioritization, not segmentation or threat prevention.

Exam trap

The trap here is that candidates often confuse NAT or QoS with security controls, thinking address translation or bandwidth management can segment traffic, when in fact only zones and security rules enforce access control and threat inspection.

Practice this question →
8
Drag & Dropmedium

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Drag or tap steps into the slots.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Practice this question →
9
MCQeasy

A network administrator is configuring a Security policy rule on a Palo Alto Networks firewall to allow HTTP traffic from the Trust zone to the Untrust zone. The administrator wants to ensure that the rule only allows HTTP traffic on its default port. Which service setting should be used?

A.application-default
B.service-http
C.any
D.TCP-80
AnswerA

The 'application-default' service setting allows traffic only on the default ports defined for the selected application. For HTTP (web-browsing), the default port is TCP 80. This ensures that the rule permits HTTP only on its standard port, enhancing security by not opening additional ports. It is the recommended setting when the application is known, as it dynamically adapts to application definitions.

Why this answer

The 'application-default' service setting is the correct choice because it allows traffic only on the default ports defined for the selected application. For HTTP, the default port is TCP 80. This setting ensures that the rule permits HTTP only on its standard port, aligning with least privilege.

It also automatically updates if application definitions change, reducing administrative overhead. Using 'any' would be too permissive, while specific service objects like TCP-80 are static and less flexible.

Exam trap

The trap here is thinking that specifying a service object like TCP-80 is equivalent to 'application-default', but 'application-default' is dynamic and tied to the application, making it more secure and easier to manage.

Practice this question →
10
Multi-Selectmedium

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Select 3 answers
A.Antivirus
B.URL Filtering
C.Vulnerability Protection
D.File Blocking
E.Anti-Spyware
AnswersA, C, E

Antivirus profiles inspect traffic for known malware signatures and block malicious file transfers, satisfying the requirement to block malware at the content level. Applied alongside anti-spyware and vulnerability protection profiles, it forms the three-profile set Palo Alto Networks recommends for comprehensive threat coverage in a security policy.

Why this answer

Antivirus (A) is correct because it scans traffic for known malware signatures and malicious payloads, directly blocking viruses, worms, and trojans at the content level. Anti-Spyware (E) is correct because it detects and blocks spyware, keyloggers, and command-and-control traffic that antivirus signatures may not cover, providing complementary malware protection. Vulnerability Protection (C) is correct because it inspects traffic for exploits targeting software vulnerabilities, blocking the delivery mechanisms malware often uses to compromise hosts.

URL Filtering (B) is not marked correct because it primarily controls web access by category or reputation rather than blocking malware itself, and File Blocking (D) is not marked correct because it restricts file transfers by type rather than detecting malicious content.

Practice this question →
11
MCQhard

A network security administrator is configuring a security policy rule to allow DNS traffic from the Trust zone to the Untrust zone. The rule uses application dns and service application-default. Users report that DNS queries to external servers are failing. The administrator notices that the firewall is allowing the DNS queries but the responses are being dropped. What is the most likely cause?

A.The return traffic is being dropped because the security policy rule does not allow the dns application in the reverse direction.
B.The DNS responses are being dropped due to asymmetric routing where the response takes a different path and the firewall does not see the return traffic.
C.The firewall is performing DNS sinkholing and dropping the responses.
D.The security policy rule does not allow the dns-base application.
AnswerB

If the DNS response takes a different path and does not return through the same firewall, the firewall will not have a session for the response and will drop it. This is a common issue with asymmetric routing. The security policy allows the outbound query, but without the return path, the session cannot complete, causing DNS failures.

Why this answer

Stateful firewalls require that return traffic for a session traverse the same firewall. If DNS responses take a different path (asymmetric routing), the firewall does not recognize them as part of an existing session and drops them. This is a frequent cause of DNS failures when multiple paths exist.

Ensuring symmetric routing or using NAT can resolve the issue.

Exam trap

The trap here is assuming that a security policy rule must explicitly allow return traffic, when in fact stateful inspection handles it—unless asymmetric routing breaks the session.

Practice this question →
12
MCQmedium

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

A.Configure a Source NAT rule to translate the mail server's IP to the public IP.
B.Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.
C.Configure a security policy rule with source NAT to translate the public IP to the private IP.
D.Configure a security policy rule allowing SMTP from external to DMZ without NAT.
AnswerB

The mail server holds a private DMZ address, so inbound SMTP to the firewall's public IP requires destination NAT to translate the public address to the server, plus a security policy permitting SMTP from the external zone to the DMZ zone.

Why this answer

To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Exam trap

The trap here is that candidates often confuse Source NAT with Destination NAT, assuming any NAT rule will work, or they think a security policy alone is sufficient without understanding that NAT is required to route the traffic to the internal server.

How to eliminate wrong answers

Option A is wrong because Source NAT (SNAT) translates the source IP of outbound traffic, not the destination IP of inbound traffic; it would not help the mail server receive inbound SMTP. Option C is wrong because it incorrectly describes a security policy rule with source NAT, which is not a valid configuration for inbound traffic; source NAT is used for outbound traffic, and the translation described (public to private) is actually destination NAT. Option D is wrong because without a NAT rule, the firewall would not translate the destination IP from the public IP to the private IP of the mail server, so the traffic would not reach the server even if the security policy allows it.

Practice this question →
13
MCQmedium

A security administrator needs to create a policy that allows users in the 'trust' zone to access the internet, but blocks access to a specific set of known malicious URLs. The administrator has subscribed to a URL filtering service and wants to use a custom URL category to block the malicious sites. Which configuration should be used?

A.Create a custom URL category containing the malicious URLs, then create a security policy rule that denies web-browsing and applies a URL filtering profile that allows the custom category.
B.Create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.
C.Create a security policy rule that denies web-browsing and applies a URL filtering profile that blocks the 'malware' URL category.
D.Create a custom URL category containing the malicious URLs, then create a security policy rule that allows web-browsing and applies a URL filtering profile that blocks the custom category.
AnswerD

This approach uses a custom URL category to list the malicious URLs and a URL filtering profile to block that category. The security rule allows web-browsing but enforces the URL filtering profile, which will deny access to the malicious sites. This is the correct method to selectively block specific URLs while allowing general internet access.

Why this answer

To block specific malicious URLs while allowing general internet access, the administrator should create a custom URL category with those URLs and apply a URL filtering profile that blocks that category. The security policy rule must allow web-browsing so that traffic is permitted and then inspected by the URL filtering profile. This ensures that only the listed malicious URLs are blocked, while all other web traffic is allowed.

Exam trap

The trap here is using a predefined URL category like 'malware' instead of a custom category, which may not contain the specific malicious URLs the administrator wants to block and could lead to unintended blocking or allowing.

Practice this question →
14
Multi-Selecthard

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Select 3 answers
A.A root CA certificate installed in the trusted root store on client devices.
B.The private key of each destination server.
C.The server certificate for each destination server.
D.A decryption policy rule that matches the traffic to be decrypted.
E.A decryption profile that specifies the forward proxy certificate (CA certificate).
AnswersA, D, E

SSL forward proxy interception requires the firewall to present certificates signed by a CA the client already trusts. Installing the root CA certificate in each client's trusted root store establishes that chain of trust, satisfying the prerequisite for the firewall to re-sign outbound server certificates and decrypt the session.

Why this answer

Option A is correct because SSL forward proxy decryption works by having the firewall/proxy re-sign the destination server's certificate with its own CA; clients must trust that CA, so the root CA certificate must be installed in the trusted root store on client devices. Option D is correct because a decryption policy rule is what actually matches the outbound traffic (by source, destination, URL category, service, etc.) and instructs the proxy to decrypt it rather than bypass it. Option E is correct because a decryption profile defines the forward proxy certificate (the CA certificate and key) used to generate the impersonated server certificates and enforces related SSL settings.

Option B is not required because the proxy does not need the destination servers' private keys; it establishes its own separate TLS sessions with the client and the server. Option C is not required because the proxy obtains the destination server's certificate dynamically during the handshake and generates a substitute certificate signed by its own CA, rather than needing a pre-provisioned copy of each server certificate.

Exam trap

The trap is assuming the firewall needs the destination server's private key or certificate to decrypt — candidates who don't understand MITM re-signing often pick those options instead of the correct CA/policy/profile trio.

Practice this question →
15
MCQhard

A company uses a Palo Alto Networks firewall to secure outbound internet access. The security team wants to ensure that users cannot access malicious websites. They have configured a URL Filtering profile with the 'malware' category set to 'block' and attached it to a Security policy rule that allows web-browsing. However, users report that they can still access some known malicious sites that are categorized as 'malware'. What is the most likely reason?

A.The URL Filtering profile is attached to the wrong Security policy rule; there is a more specific rule above that allows the traffic without URL Filtering.
B.The URL Filtering profile is not applied because the Security policy rule does not have the correct source and destination zones.
C.The 'malware' category is set to 'block', but the site is using HTTPS and the firewall is not decrypting traffic, so the URL Filtering profile cannot inspect the URL.
D.The URL Filtering profile is configured to block the 'malware' category, but the firewall's URL database is outdated and does not contain those sites.
AnswerC

URL Filtering requires visibility into the HTTP request or HTTPS decryption to categorize and block based on URL. If HTTPS traffic is not decrypted, the firewall can only see the IP and port, not the full URL. Thus, sites in the 'malware' category accessed via HTTPS may not be blocked unless SSL decryption is enabled. This is a common oversight; without decryption, URL Filtering is ineffective for HTTPS.

Why this answer

URL Filtering can only block based on URL categories if the firewall can see the full URL. For HTTPS traffic, the URL is encrypted within the TLS session, so without SSL decryption, the firewall cannot inspect the URL and thus cannot enforce URL Filtering for those sites. The most likely reason users can access malicious HTTPS sites is that SSL decryption is not enabled.

Enabling SSL Forward Proxy decryption would allow the firewall to see the URL and apply the URL Filtering profile correctly.

Exam trap

The trap here is assuming that attaching a URL Filtering profile to a rule is sufficient to block malicious sites, ignoring that HTTPS traffic requires decryption for URL inspection.

Practice this question →
16
MCQhard

An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?

A.The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.
B.The decryption policy does not specify a certificate for forward proxy.
C.The CRL (Certificate Revocation List) is not enabled on the firewall.
D.The server certificate for each HTTPS site is missing from the client's certificate store.
AnswerA

SSL forward proxy decryption makes the firewall re-sign each HTTPS session with its own CA certificate. Unless that CA is imported into the Windows trusted root store, clients cannot build a trusted chain and raise certificate errors, despite a correctly configured decryption policy.

Why this answer

In SSL forward proxy decryption, the firewall intercepts the client's HTTPS connection and presents a certificate it generates on the fly, signed by the firewall's own CA. For clients to trust this dynamically generated certificate, the firewall's CA certificate must be installed in the trusted root certificate store of every client workstation. If it is missing, browsers will show certificate errors for every decrypted HTTPS site, even though the decryption policy itself is correct.

Exam trap

The trap is blaming the firewall configuration (policy, CRL, per-site certs) when the actual failure is client-side trust — candidates forget that forward proxy decryption requires the firewall's CA to be installed on every endpoint, and pick a firewall-side answer instead.

How to eliminate wrong answers

Option B is wrong because the forward proxy certificate is generated dynamically by the firewall from its CA — the decryption policy does not need to specify a per-site certificate, and the scenario states the policy is configured correctly. Option C is wrong because CRL checking affects revocation status validation, not the fundamental trust of the firewall's signing CA; a missing CRL would not cause blanket certificate errors on all HTTPS sites. Option D is wrong because the client does not need each website's server certificate in its store — the client trusts the firewall's CA, and the firewall validates the real server certificate on the client's behalf.

Practice this question →
17
MCQmedium

A security administrator has configured a security policy rule to allow SSH from the Trust zone to the Untrust zone. The rule uses the application 'ssh' and the service 'application-default'. Users report that SSH connections to external servers on port 2222 are failing, while SSH on port 22 works. What is the most likely cause of the failure?

A.The application 'ssh' does not support non-standard ports; a custom application must be created.
B.The application 'ssh' is not included in the rule's application list; instead, 'any' is used.
C.The security policy rule is missing a URL filtering profile to allow SSH on port 2222.
D.The service 'application-default' only allows the default port for the application, so port 2222 is blocked.
AnswerD

The service 'application-default' enforces the default port for the selected application. For ssh, the default port is 22. Therefore, traffic on port 2222 is not allowed because it does not match the default port. To allow SSH on port 2222, the administrator must either change the service to 'any' or create a custom service for port 2222 and attach it to the rule. This option correctly identifies the cause of the failure.

Why this answer

The service 'application-default' restricts traffic to the default ports of the selected applications. For SSH, the default port is 22, so connections on port 2222 are blocked. To allow SSH on a non-standard port, the administrator must either set the service to 'any' or create a custom service for port 2222 and apply it to the rule.

This ensures that the firewall permits the traffic on the desired port while still identifying it as SSH.

Exam trap

The trap here is assuming that selecting the 'ssh' application automatically allows SSH on any port, when the service setting controls the port.

Practice this question →
18
MCQeasy

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

A.DNS Security profile
B.Vulnerability Protection profile
C.URL Filtering profile
D.Anti-Spyware profile
AnswerA

DNS tunnelling encodes stolen data within DNS queries and responses, which the DNS Security profile detects and blocks by inspecting DNS payloads for malicious patterns, including tunnelling signatures and anomalous query behaviour. Applying it to outbound DNS traffic directly satisfies the requirement to prevent exfiltration.

Why this answer

DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Exam trap

The trap here is that candidates often confuse DNS Security with Anti-Spyware, assuming that spyware signatures will catch tunneling, but DNS tunneling is a protocol-level evasion technique that requires dedicated DNS inspection, not just signature-based malware detection.

How to eliminate wrong answers

Option B is wrong because Vulnerability Protection profile is designed to detect and block exploit attempts targeting known vulnerabilities in applications and operating systems, not to analyze DNS traffic for tunneling or exfiltration patterns. Option C is wrong because URL Filtering profile controls access to web categories and URLs based on policy, but it does not inspect the content or structure of DNS queries to identify tunneling behavior. Option D is wrong because Anti-Spyware profile focuses on blocking malware command-and-control (C2) traffic and spyware signatures, but it lacks the deep DNS protocol analysis needed to detect data exfiltration via DNS tunneling.

Practice this question →
19
MCQeasy

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

A.Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.
B.Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.
C.Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.
D.Modify the rule to use application 'any' to allow all applications.
AnswerC

Application-default restricts web-browsing to TCP 80 and 443, so port 8080 never matches. A custom application defining TCP 8080, added to the existing rule, permits the partner site without opening any port or service broadly.

Why this answer

The traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Exam trap

The trap here is that candidates assume 'web-browsing' will match any HTTP-like traffic regardless of port, but Palo Alto Networks App-ID requires explicit application definition for non-standard ports, and simply changing the service or application to 'any' undermines the security model.

How to eliminate wrong answers

Option A is wrong because permitting traffic to 203.0.113.50 on any port and any application bypasses all application and port restrictions, violating the principle of least privilege and potentially allowing malicious traffic. Option B is wrong because changing the service to 'any' would allow web-browsing on any port, but the traffic on TCP 8080 still does not match the 'web-browsing' application definition, so the rule would not permit it. Option D is wrong because modifying the rule to use application 'any' would allow all applications through the rule, completely defeating the purpose of application-based security and exposing the network to unnecessary risks.

Practice this question →
20
MCQeasy

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

A.It is a security rule that allows the session.
B.It is a QoS rule that prioritizes the traffic.
C.It is a NAT rule that translates the source IP.
D.It is a decryption rule that decrypts the traffic.
AnswerA

Security rules in PAN-OS permit or deny sessions based on zone, address, application and service match criteria; this rule matches the outbound session and its action is allow, so it authorises the traffic rather than performing NAT, decryption or logging-only functions.

Why this answer

The rule 'Allow_Outbound' is a security rule that permits outbound traffic from the specified zone to the destination zone. In Palo Alto Networks firewalls, security rules define whether traffic is allowed or denied, and this rule explicitly allows the session.

Exam trap

PCNSA often tests the distinction between security, NAT, QoS, and decryption rules, and candidates may confuse the purpose of a rule based on its name alone.

How to eliminate wrong answers

Option B is wrong because QoS rules are defined in a separate QoS policy and are used for bandwidth management, not for allowing traffic. Option C is wrong because NAT rules are configured in the NAT policy and handle IP address translation, not security enforcement. Option D is wrong because decryption rules are in the Decryption policy and are used for SSL/TLS decryption, not for allowing sessions.

Practice this question →
21
MCQhard

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal users and the internet. The security team wants to enforce different security profiles based on the destination country of outbound traffic. They have created a Security policy rule that allows web-browsing and ssl from the trust zone to the untrust zone. They now need to apply a URL Filtering profile that blocks malicious sites only when the destination IP is geolocated in a specific high-risk country. What should the administrator configure to achieve this?

A.Modify the existing Security policy rule to include a destination region object for the high-risk country and attach the URL Filtering profile.
B.Create a new Security policy rule below the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.
C.In the Security policy rule, add a source region object for the high-risk country and attach the URL Filtering profile.
D.Create a new Security policy rule above the existing rule that matches destination region for the high-risk country, allows the applications, and attaches the URL Filtering profile.
AnswerD

This approach correctly uses a destination region object to match traffic destined for the high-risk country. Placing the new rule above the existing rule ensures it is evaluated first for matching traffic, allowing the URL Filtering profile to be applied only to those sessions. The existing rule continues to handle other destinations without the profile, achieving granular control based on geolocation.

Why this answer

The correct configuration creates a new Security policy rule with a destination region match for the high-risk country, placed above the existing rule. This ensures that traffic to that country is evaluated first and receives the URL Filtering profile, while other traffic continues to be handled by the original rule. This leverages geolocation objects and rule ordering to apply security profiles conditionally.

Exam trap

The trap here is confusing source and destination regions, or placing the new rule in the wrong order so it never matches.

Practice this question →
22
MCQeasy

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

A.Deploy SSL decryption to see user credentials.
B.Configure User-ID by integrating with Active Directory or using captive portal.
C.Enable URL Filtering to track user visits.
D.Activate App-ID to detect user login events.
AnswerB

Integrating with Active Directory or deploying captive portal provides the user-to-IP mapping that User-ID requires, satisfying the stem's need to identify users in policy. Security policies match on usernames only after this mapping exists; without it, the firewall cannot attribute traffic to a specific user.

Why this answer

User-ID requires a source of user-to-IP mapping. The two supported methods on Palo Alto Networks firewalls are integrating with a directory service such as Active Directory (via the User-ID Agent or Windows-based agent) or using captive portal to force users to authenticate. Once mappings exist, security policies can reference users or groups in the Source User field.

Exam trap

PCNSA often tests the misconception that SSL decryption or App-ID is needed to identify users, when in fact User-ID depends on directory integration or captive portal authentication.

How to eliminate wrong answers

Option A is wrong because SSL decryption reveals application content, not user identity — User-ID mappings come from directory logs or captive portal authentication, not from decrypting traffic. Option C is wrong because URL Filtering classifies and controls web destinations; it does not create user-to-IP mappings. Option D is wrong because App-ID identifies applications regardless of user, and it does not generate user login events for User-ID.

Practice this question →
23
MCQmedium

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

A.Dynamic IP and Port (DIPP) with source NAT.
B.Bidirectional NAT.
C.Static NAT with source NAT.
D.Destination NAT with port forwarding.
AnswerA

Dynamic IP and Port source NAT translates many internal sessions to a pool of public addresses using unique source ports, allowing internet-bound traffic to share the public IP pool. This matches the requirement for outbound user access via a public address pool rather than static one-to-one mapping.

Why this answer

Dynamic IP and Port (DIPP) with source NAT is the correct choice because it translates multiple internal IP addresses to a pool of public IP addresses while also translating source ports, allowing many internal users to share a small public IP pool. This is the standard Palo Alto Networks configuration for outbound internet access from internal users.

Exam trap

PCNSA often tests the confusion between source NAT and destination NAT; the trap is that DIPP is source NAT for outbound traffic, while port forwarding and static NAT are destination NAT for inbound traffic.

How to eliminate wrong answers

Option B is wrong because bidirectional NAT is used when both source and destination translation are needed, typically for publishing internal servers, not for outbound user internet access. Option C is wrong because static NAT with source NAT implies a one-to-one mapping, which does not scale for a pool of users and is used for inbound publishing scenarios. Option D is wrong because destination NAT with port forwarding is used for inbound access to internal servers, not for outbound user traffic.

Practice this question →
24
MCQeasy

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

A.The rule order is incorrect; the allow rule is below the 'Deny All' rule.
B.The application 'web-browsing' is not being properly identified by App-ID.
C.The source address object for the allow rule is misconfigured with a wrong subnet mask.
D.The User-ID agent is overriding the allow rule and triggering a block action.
AnswerA

Palo Alto firewalls evaluate security rules top-down and stop at the first match, so the 'Deny All' rule sitting above the allow rule intercepts the traffic before it is ever evaluated against the web-browsing permit. Reordering the rules so the allow rule precedes 'Deny All' resolves the connectivity failure.

Why this answer

In Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Practice this question →
25
MCQmedium

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

A.The TCP sequence numbers are out of order, causing the packets to be out of the expected window.
B.The NAT policy is misconfigured, causing the source IP to not be translated correctly.
C.The security policy uses an incorrect service object that doesn't match the application.
D.Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.
AnswerD

The firewall drops the session because it never observed the initial SYN handshake. With asymmetric routing, return or subsequent packets traverse a different firewall that lacks session state, so it treats them as non-SYN and terminates the session.

Why this answer

When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Exam trap

The trap here is that candidates often confuse 'tcp-non-syn' with TCP sequence number issues or NAT problems, but the key is recognizing that this drop occurs only when the firewall has no session state, which points directly to asymmetric routing.

How to eliminate wrong answers

Option A is wrong because out-of-order sequence numbers cause 'tcp-out-of-window' drops, not 'tcp-non-syn'; the firewall tracks sequence numbers within the established session window. Option B is wrong because a misconfigured NAT policy would typically cause translation failures or session timeouts, not a 'tcp-non-syn' drop; the firewall would still see the SYN and create a session. Option C is wrong because an incorrect service object would cause a policy match failure or application misidentification, but the firewall would still process the SYN and create a session if the traffic is allowed; the 'tcp-non-syn' drop specifically indicates no prior SYN was seen.

Practice this question →
26
MCQmedium

A security administrator at a hospital needs to allow clinicians to access a cloud-based electronic health record (EHR) system at ehr.example.com. The firewall must inspect the traffic for threats, but the EHR vendor requires that the firewall not decrypt the traffic due to strict patient data privacy regulations. Which Security policy rule configuration should the administrator implement?

A.Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to no-decrypt, and create a Security policy rule that allows the application ssl and attaches the appropriate Security profiles.
B.Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to decrypt, and create a Security policy rule that allows the application ssl without any Security profiles.
C.Create a Security policy rule that allows the application ssl, with the action allow, and attach a Decryption profile set to no-decrypt for the EHR server certificate.
D.Create a Security policy rule that allows the application ssl, with the action allow, and attach a URL Filtering profile that blocks the healthcare category.
AnswerA

This correctly uses a Decryption policy rule with the no-decrypt action to exempt the EHR traffic from SSL decryption, satisfying the vendor's privacy requirement. The Security policy rule then allows the application ssl and applies Security profiles such as Vulnerability Protection and Antivirus to inspect the traffic for threats without decrypting it, providing both access and protection.

Why this answer

The correct solution uses a Decryption policy rule with the no-decrypt action to exempt ehr.example.com from SSL decryption, honoring the privacy requirement. A separate Security policy rule allows the application ssl and applies Security profiles, ensuring threat inspection still occurs on the encrypted traffic. This two-policy approach is the standard method to selectively bypass decryption while maintaining security enforcement.

Exam trap

The trap here is assuming that a Security policy rule can directly control decryption or that URL filtering can exempt specific sites from decryption.

Practice this question →
27
MCQhard

A multinational corporation uses a Palo Alto Networks firewall to secure traffic between its internal zones. The security team wants to ensure that all traffic from the Users zone to the Servers zone is inspected for threats, but they also need to allow specific applications that use non-standard ports. They create a Security policy rule with 'application: any' and 'service: any', and attach a Vulnerability Protection profile. However, they notice that some traffic is not being inspected because it is being allowed by a more specific rule higher in the rulebase that allows only web-browsing and ssl. What should the administrator do to ensure all traffic is inspected?

A.Create a new rule at the top of the rulebase that denies all traffic from Users to Servers, forcing traffic to be inspected by the next rule.
B.Enable 'Log at Session Start' on the more specific rule to ensure inspection occurs.
C.Move the rule with 'application: any' and 'service: any' above the more specific rule in the rulebase.
D.Modify the more specific rule to include 'application: any' and attach the same Vulnerability Protection profile.
AnswerC

Security policy rules are evaluated top-down, and the first match is applied. The more specific rule allowing only web-browsing and ssl is matched first for that traffic, so it bypasses the broader rule with threat inspection. Moving the broader rule above ensures that all traffic from Users to Servers is matched by the rule with the Vulnerability Protection profile, thus inspected. This is the correct approach to enforce inspection for all traffic.

Why this answer

Security policy rules are processed in order, and the first matching rule determines the action and profiles applied. The more specific rule allowing web-browsing and ssl is matched before the broader rule with 'any' application and the Vulnerability Protection profile. To ensure all traffic is inspected, the administrator must move the broader rule with the inspection profile above the specific rule.

This way, all traffic from Users to Servers is matched by the inspection rule first, and threat inspection is applied.

Exam trap

The trap here is assuming that attaching a Security profile to a rule guarantees inspection for all matching traffic, ignoring that rule order determines which rule is applied.

Practice this question →
28
MCQmedium

An administrator wants to block all peer-to-peer (P2P) file sharing applications while allowing other traffic. Which security policy action should be used to achieve this?

A.Create a rule that allows all applications except P2P, using the 'negate' option for the application.
B.Create a rule that denies the 'p2p' application group and place it above the allow rules.
C.Use an application filter that excludes P2P applications in the allow rule.
D.Configure a URL filtering profile that blocks P2P websites and apply it to the allow rule.
AnswerB

To block P2P applications, create a security rule that denies the 'p2p' application group and position it above any allow rules. This ensures that P2P traffic is matched and blocked before a broader allow rule can permit it. This is the correct approach because rule order matters; a deny rule must precede allow rules to be effective.

Why this answer

To block P2P applications, create a security policy rule with the action 'deny' and specify the 'p2p' application group. Place this rule above any allow rules that permit general internet traffic. This ensures P2P is blocked while other applications are allowed.

Rule order is critical because the firewall evaluates rules top-down.

Exam trap

The trap here is thinking you can negate applications within a single rule, but Palo Alto Networks firewalls require a separate deny rule placed before allow rules.

Practice this question →
29
Multi-Selectmedium

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Select 2 answers
A.Captive Portal
B.Kerberos Authentication
C.LDAP Synchronization
D.XML API
E.User-ID Agent
AnswersA, E

Captive Portal authenticates users directly and maps IPs.

Why this answer

Options A and E are correct. Captive Portal authenticates users directly by requiring them to log in, and User-ID Agent collects user-to-IP mappings from directory services like Active Directory. Option B (Kerberos Authentication) is a protocol used for authentication but not a dedicated User-ID method.

Option C (LDAP Synchronization) is a method for synchronizing directory data, not for identifying users in real time. Option D (XML API) is an interface for configuration, not a standard User-ID identification method.

Practice this question →
30
MCQhard

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

A.Create an allow rule for all users, then a deny rule for HR with application social-media.
B.Create a deny rule for the HR user group with application social-media before the allow rule.
C.Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.
D.Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.
AnswerD

This approach correctly uses User-ID to dynamically identify HR users, specifies the source zone corporate and the application social-media, and places the deny rule before the allow rule. This ensures that traffic from HR users to social media is blocked by the deny rule, while all other traffic matches the subsequent allow rule.

Why this answer

The best approach is to use User-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule. This ensures that the deny rule is evaluated first, blocking social media for HR while allowing all other traffic. User-ID enables user-specific policies, and rule order is critical in Palo Alto Networks firewalls.

Exam trap

PCNSA often tests the importance of rule order and the use of User-ID for granular control, trapping candidates who forget that deny rules must precede allow rules to be effective.

How to eliminate wrong answers

Option A is wrong because placing the deny rule after the allow rule means the allow rule will match first, permitting all traffic including social media for HR. Option B is wrong because it lacks User-ID, so it cannot specifically target HR users; it would deny social media for all users in the corporate zone. Option C is wrong because placing the deny rule after the allow rule renders it ineffective, as the allow rule will already have permitted the traffic.

Practice this question →
31
MCQhard

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

A.Rely on the browser's security settings to prevent decryption.
B.Disable SSL Decryption globally when the user visits sensitive sites.
C.Use a policy to decrypt only HTTP traffic.
D.Create a decryption exclusion rule for specific URLs or categories.
AnswerD

A decryption exclusion rule matches specific URLs or URL categories and bypasses decryption for them, honouring privacy and legal constraints for banking traffic. Forward proxy decryption policies evaluate exclusions before decryption profiles, so sensitive sessions stay encrypted.

Why this answer

Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites.

Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Practice this question →
32
MCQhard

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

A.A zone protection profile is blocking ICMP packets.
B.The virtual router does not have a default route to the external network.
C.The decryption policy is blocking the traffic because it is not decrypted.
D.The NAT policy is missing for the outbound traffic.
AnswerB

The management interface responds because it sits on the firewall itself, but forwarding to an external server requires the virtual router to hold a default route toward the untrusted next hop. Without it, the permitted traffic is dropped for lack of a route.

Why this answer

The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Exam trap

The trap here is that candidates often confuse routing issues with security policy or NAT problems, but the firewall must have a viable route in the virtual router before it can forward any traffic, regardless of policy allowances.

How to eliminate wrong answers

Option A is wrong because a zone protection profile blocks ICMP at the zone level, but the user can already ping the management IP, indicating ICMP is not blocked globally; the issue is routing, not ICMP filtering. Option C is wrong because decryption policies apply to SSL/TLS traffic, not to ICMP ping traffic, and the question states the user is pinging, so decryption is irrelevant. Option D is wrong because a missing NAT policy would affect source address translation but not prevent the firewall from routing the packet; the firewall can still forward traffic without NAT if the destination is reachable, but the core problem here is the lack of a route.

Practice this question →
33
MCQeasy

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

A.Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.
B.Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.
C.Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.
D.Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.
AnswerA

A single security policy matching source zone Untrust and destination zone DMZ, with the application set to web-browsing and ssl, permits only HTTP and HTTPS while implicitly denying all remaining traffic. This satisfies the stem's requirement for one rule, since Palo Alto Networks App-ID identifies the applications directly rather than relying on port numbers.

Why this answer

Palo Alto Networks next-generation firewalls identify applications rather than just ports, so a single security policy using the application set 'web-browsing' (HTTP) and 'ssl' (HTTPS) with action allow accomplishes the requirement in one rule. This leverages App-ID to permit only the intended web traffic from Untrust to DMZ while implicitly denying everything else via the default interzone deny. Using applications instead of services is the most efficient and secure approach.

Exam trap

The trap here is confusing service-based (port) filtering with application-based (App-ID) filtering — candidates often pick the service tcp/80 and tcp/443 option thinking it's equivalent, but PCNSA emphasizes App-ID as the most efficient and secure single-rule approach.

How to eliminate wrong answers

Option B is wrong because 'application default' matches only a small predefined set of applications and does not explicitly cover web-browsing and ssl, so HTTP/HTTPS traffic may not be reliably permitted. Option C is wrong because allowing service any and application any effectively permits all traffic from Untrust to DMZ, violating the requirement to block everything except HTTP/HTTPS. Option D is wrong because using service tcp/80 and tcp/443 with no application specified relies on port-based filtering, which is less secure and less efficient than App-ID-based matching, and does not leverage the firewall's application identification.

Practice this question →
34
MCQhard

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

A.Create a single rule with both allow and deny actions based on source.
B.Place the specific servers in a different zone and create a new policy for that zone.
C.Add a new allow rule above the deny rule that matches the specific traffic.
D.Modify the existing deny rule to allow all traffic.
AnswerC

PAN-OS evaluates security policy top-down, so a specific allow rule placed above the existing deny rule matches the special source range first and permits it. All other inter-zone traffic continues to hit the deny rule, preserving the block.

Why this answer

In Palo Alto Networks security policies, rules are evaluated top-down, and the first match is applied. To allow specific traffic while still blocking other traffic, the administrator should add a new allow rule above the existing deny rule that matches the specific source IP range and application. This ensures the specific traffic is permitted, while all other traffic continues to be blocked by the deny rule below.

Exam trap

The trap is thinking that a single rule can both allow and deny based on source, or that modifying the deny rule is acceptable; the key is rule order and specificity.

How to eliminate wrong answers

Option A is wrong because a single rule cannot have both allow and deny actions; each rule has one action. Option B is wrong because moving servers to a different zone is unnecessary and does not address the policy ordering; it adds complexity without solving the problem. Option D is wrong because modifying the deny rule to allow all traffic would defeat the purpose of blocking other traffic.

Practice this question →
35
MCQhard

An administrator has configured a security policy rule to allow traffic from the 'trust' zone to the 'untrust' zone with application 'any' and service 'any'. The administrator wants to ensure that the firewall logs all allowed traffic, but notices that not all sessions are being logged. What is the most likely reason?

A.The security policy rule does not have 'Log at Session End' enabled.
B.The firewall is not configured to log at session start, and some sessions are not being logged because they are not completing.
C.The security policy rule is not matching all traffic because it is placed after a more specific rule that denies or allows traffic without logging.
D.The firewall's log storage is full, causing new logs to be dropped.
AnswerC

Security rules are evaluated top-down, and if a more specific rule above the 'any/any' rule matches traffic and has logging disabled, those sessions will not be logged by the 'any/any' rule. The 'any/any' rule only logs traffic that it processes. This is a common cause of missing logs when multiple rules exist. Ensuring the rule order and logging settings are correct is essential.

Why this answer

The most likely reason for not all allowed sessions being logged is that another rule earlier in the rulebase is matching some traffic and either has logging disabled or is a deny rule. The 'any/any' rule only logs sessions that it processes. If a more specific rule above it handles certain traffic without logging, those sessions will not appear in the logs.

Therefore, reviewing rule order and logging settings is necessary to ensure all allowed traffic is logged.

Exam trap

The trap here is assuming that an 'any/any' allow rule with logging enabled will log all traffic, when in fact earlier rules can intercept traffic and bypass logging, leading to incomplete logs.

Practice this question →
36
MCQmedium

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

A.The log forwarding profile only includes 'traffic' logs and not 'threat' logs.
B.The firewall is logging only at session end and the deny sessions are not completing.
C.The log forwarding profile is not configured to forward logs for denied sessions.
D.The SIEM is not configured to receive syslog messages for deny actions.
AnswerC

Denied sessions are dropped before a session is established, so they generate no traffic logs; only threat logs capture them. The profile must explicitly enable log forwarding for denied sessions, otherwise the firewall discards those entries regardless of the profile being attached to the deny rules.

Why this answer

In PAN-OS, log forwarding profiles have a separate checkbox for 'Denied Sessions' under the Traffic log type. Even if the profile includes the 'traffic' log type, denied traffic logs will not be forwarded unless this option is explicitly enabled. Since the SIEM receives allowed traffic logs but not denied ones, the most likely cause is that the profile is not configured to forward logs for denied sessions.

Exam trap

PCNSA often tests the misconception that including the 'traffic' log type in a log forwarding profile automatically forwards denied traffic logs, when in fact a separate 'Denied Sessions' option must be enabled.

How to eliminate wrong answers

Option A is wrong because the profile already includes 'threat' logs, and the issue is about denied traffic logs, not threat logs. Option B is wrong because deny sessions are typically logged immediately when the session is denied, not at session end; session end logging applies to allowed sessions. Option D is wrong because the SIEM is already receiving allowed traffic logs, so it is configured to receive syslog messages; the issue is specific to denied traffic logs.

Practice this question →
37
Matchingmedium

Match each PAN-OS component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Handles configuration and logging

Processes traffic and enforces policies

Manages routing and session setup

Aggregates logs from multiple firewalls

Why these pairings

The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Practice this question →
38
MCQmedium

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

A.The profiles are set to 'alert' instead of 'block' for the critical threat categories.
B.The antivirus signatures are outdated.
C.The security profiles are not attached to any security rule.
D.The profile groups are applied in the wrong order.
AnswerA

Profiles configured to alert rather than block generate threat logs but permit the traffic to continue, so malware reaches endpoints despite the security policy. Changing critical threat categories to block enforces the intended prevention action.

Why this answer

If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight.

Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Securing Traffic questions.

Start 20-question session