How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the PCNSA exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCNSA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Palo Alto Networks Certified Network Security Administrator PCNSA questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCNSA

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Full question →

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

A
Use the CLI command 'show log traffic'.
Why wrong: CLI shows logs but does not persistently collect them.
B
Use SNMP to retrieve logs.
Why wrong: SNMP is not used for log retrieval.
C
Configure Panorama to collect logs.
Panorama acts as a central log collector.
D
Export logs to a CSV file from the GUI.
Exports logs for external analysis.
E
View logs in the Monitor tab.
Why wrong: Viewing is not collecting for analysis.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related PCNSA topic practice pages

Managing Objects practice questions

Policy Evaluation and Management practice questions

Securing Traffic practice questions

Device Management and Services practice questions

App-ID and Content-ID practice questions

Decryption and Monitoring practice questions

PCNSA fundamentals practice questions

PCNSA scenario practice questions

PCNSA troubleshooting practice questions

Practice scenarios

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

A security administrator is troubleshooting an issue where users cannot access a specific website. The security policy allows web-browsing from the internal zone to the external zone. Which TWO actions should the administrator take to verify the traffic is being matched and allowed?

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

A security administrator is analyzing the rulebase for best practices. Which TWO of the following are recommended practices for security policy management? (Choose two.)

An administrator is troubleshooting why a policy is not being matched. Which THREE of the following are valid reasons a security rule might not be hit? (Choose three.)

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

A security administrator is reviewing best practices for creating security policies on a Palo Alto Networks firewall. Which two of the following are recommended practices?

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Which TWO statements about External Dynamic Lists (EDLs) are true?

Which THREE actions can be performed in a decryption policy? (Choose three.)

Which TWO security profile types are used to block known malware? (Choose two.)

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Which TWO methods can be used to create a custom App-ID signature?

Which TWO are required for accurate application identification when an application uses non-standard ports?

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)