Courseiva
← Back to Palo Alto Networks Certified Network Security Administrator PCNSA questions

Scenario-based practice

Hard Difficulty Questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
PCNSA
exam code
Palo Alto Networks
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related PCNSA topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Managing Objects practice questions

Sharpen your PCNSA knowledge of Managing Objects.

Policy Evaluation and Management practice questions

Targeted PCNSA practice covering Policy Evaluation and Management.

Securing Traffic practice questions

Securing Traffic practice questions for PCNSA.

Device Management and Services practice questions

Device Management and Services practice questions for PCNSA.

App-ID and Content-ID practice questions

Targeted PCNSA practice covering App-ID and Content-ID.

Decryption and Monitoring practice questions

Work through PCNSA questions on Decryption and Monitoring.

PCNSA fundamentals practice questions

Targeted PCNSA practice covering PCNSA fundamentals.

PCNSA scenario practice questions

Targeted PCNSA practice covering PCNSA scenario.

PCNSA troubleshooting practice questions

Targeted PCNSA practice covering PCNSA troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Question 2hardmultiple choice
Full question →

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

Question 3hardmultiple choice
Full question →

Refer to the exhibit. A user at IP 10.1.1.5 on the untrust zone is trying to access a server on the trust zone. The traffic is being blocked by a default deny rule instead of being allowed by rule1. What is the most likely reason?

Exhibit

Refer to the exhibit.
```
> show security-rule rule1
rule "rule1" {
  from untrust;
  to trust;
  source [10.1.1.0/24];
  negate-source yes;
  destination any;
  application any;
  service any;
  action allow;
}
```
Question 4hardmultiple choice
Full question →

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Question 5hardmultiple choice
Full question →

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Question 6hardmultiple choice
Full question →

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Exhibit

Refer to the exhibit.

config

security {
    rules {
        rule allow-http {
            source-zone [ trust ];
            destination-zone [ untrust ];
            source-address [ any ];
            destination-address [ any ];
            application [ web-browsing ];
            service [ application-default ];
            action allow;
            log-start yes;
        }
    }
}
Question 7hardmultiple choice
Full question →

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Question 8hardmultiple choice
Full question →

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

Question 9hardmultiple choice
Full question →

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

Question 10hardmultiple choice
Full question →

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

Question 11hardmultiple choice
Full question →

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

Question 12hardmultiple choice
Full question →

Based on the log entry, what is the most likely reason for the TCP reset from the client?

Exhibit

Refer to the exhibit.

Log entry:

Time: 2024-03-01 10:00:00
Source IP: 10.1.1.100
Destination IP: 203.0.113.50
Application: ssl
Action: allow
Session End Reason: tcp-rst-from-client
Bytes Sent: 1024
Bytes Received: 10240

Context: The security policy allows all outbound traffic. The client is a web browser.
Question 13hardmulti select
Full question →

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

Question 14hardmultiple choice
Full question →

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

Question 15hardmultiple choice
Full question →

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Question 16hardmulti select
Full question →

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Question 17hardmulti select
Full question →

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Question 18hardmultiple choice
Full question →

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-SSH      trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssh-proxy

admin@PA-220> show session all
Total sessions: 1

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssh              ACTIVE  FLOW   10.0.0.10:22     192.168.1.50:22       tcp        eth1/1    eth1/2

admin@PA-220> show system log | match ssh
2024-06-15 12:00:00  ssh_decrypt  error  Failed to decrypt SSH session: unsupported key exchange algorithm.  Src: 10.0.0.10 Dst: 192.168.1.50
Question 19hardmultiple choice
Full question →

Refer to the exhibit. A user reports that they receive a certificate warning when accessing https://example.com. The firewall is configured to decrypt SSL traffic. What is the most likely cause?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-Traffic  trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssl-forward-proxy

admin@PA-220> show ssl-decrypt certificate-status
Certificate: PA-Forward-Proxy-CA
  Issuer: CN=PA-Forward-Proxy-CA
  Valid: 2024-01-01 to 2025-01-01
  Status: valid

admin@PA-220> show system log | match ssl
2024-06-15 10:30:22  ssl_decrypt  error  Certificate is not trusted by client.  Src: 10.0.0.5 Dst: 93.184.216.34
Question 20hardmultiple choice
Full question →

Refer to the exhibit. What does this log indicate?

Exhibit

<log>
  <type>threat</type>
  <subtype>intrusion</subtype>
  <severity>critical</severity>
  <action>drop</action>
  <src>192.168.10.5</src>
  <dst>10.10.10.1</dst>
  <app>ssl</app>
  <threatid>40000</threatid>
</log>

These PCNSA practice questions are part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style PCNSA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.