Courseiva
← Back to Palo Alto Networks Certified Network Security Administrator PCNSA questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
PCNSA
exam code
Palo Alto Networks
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related PCNSA topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Managing Objects practice questions

Sharpen your PCNSA knowledge of Managing Objects.

Policy Evaluation and Management practice questions

Targeted PCNSA practice covering Policy Evaluation and Management.

Securing Traffic practice questions

Securing Traffic practice questions for PCNSA.

Device Management and Services practice questions

Device Management and Services practice questions for PCNSA.

App-ID and Content-ID practice questions

Targeted PCNSA practice covering App-ID and Content-ID.

Decryption and Monitoring practice questions

Work through PCNSA questions on Decryption and Monitoring.

PCNSA fundamentals practice questions

Targeted PCNSA practice covering PCNSA fundamentals.

PCNSA scenario practice questions

Targeted PCNSA practice covering PCNSA scenario.

PCNSA troubleshooting practice questions

Targeted PCNSA practice covering PCNSA troubleshooting.

Practice set

Practice scenarios

Question 1easymultiple choice
Full question →

Refer to the exhibit. A security rule is configured with destination address group 'internal-servers'. A packet with destination IP 10.10.20.5 arrives. Will the rule match?

Exhibit

admin@PA-500> show object address-group "internal-servers"
group {
    members [ server1 server2 ]
}

admin@PA-500> show object address "server1"
address {
    ip-netmask 10.10.10.0/24
}

admin@PA-500> show object address "server2"
address {
    ip-range 10.10.20.1-10.10.20.10
}
Question 2hardmultiple choice
Full question →

Refer to the exhibit. A user at IP 10.1.1.5 on the untrust zone is trying to access a server on the trust zone. The traffic is being blocked by a default deny rule instead of being allowed by rule1. What is the most likely reason?

Exhibit

Refer to the exhibit.
```
> show security-rule rule1
rule "rule1" {
  from untrust;
  to trust;
  source [10.1.1.0/24];
  negate-source yes;
  destination any;
  application any;
  service any;
  action allow;
}
```
Question 3easymultiple choice
Read the full DNS explanation →

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Exhibit

> show running security-policy

rule 1: name: allow-http, source: trust, dest: untrust, application: web-browsing, action: allow
rule 2: name: allow-dns, source: trust, dest: untrust, application: dns, action: allow
rule 3: name: deny-all, source: any, dest: any, application: any, action: deny
Question 4easymultiple choice
Full question →

Refer to the exhibit. Which profile group is applied to this security rule?

Exhibit

Refer to the exhibit.

Security rule configuration:

description: 'Allow web traffic'
source-zone: Trust
destination-zone: Untrust
source-address: 192.168.1.0/24
destination-address: any
application: web-browsing, ssl
service: application-default
action: allow
profile-group: strict-profile-group
log-end: yes
Question 5mediummultiple choice
Full question →

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Exhibit

> show system info

hostname: PA-5250
model: PA-5250
sw-version: 10.1.3
app-version: 8340-5987
threat-version: 8340-5987

> show running ip-route

destination: 0.0.0.0/0
nexthop: 10.0.0.1
interface: ethernet1/1

> show interface ethernet1/1

interface: ethernet1/1
state: up
ip address: 10.0.0.2/24
zone: external

> show interface ethernet1/2

interface: ethernet1/2
state: down
ip address: 192.168.1.1/24
zone: internal
Question 6hardmultiple choice
Full question →

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

Exhibit

Refer to the exhibit.

config

security {
    rules {
        rule allow-http {
            source-zone [ trust ];
            destination-zone [ untrust ];
            source-address [ any ];
            destination-address [ any ];
            application [ web-browsing ];
            service [ application-default ];
            action allow;
            log-start yes;
        }
    }
}
Question 7mediummultiple choice
Full question →

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Exhibit

> show address-group "web-servers"
Address group name: web-servers
Type: static
Members:
  web-01
  web-02
  web-03
Question 8mediummultiple choice
Full question →

An administrator notices that the firewall's time is incorrect. Based on the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit.
```
> show system services status
Service          Status
DNS proxy        running
NTP              stopped
SNMP             running
Syslog           running
```
Question 9mediummultiple choice
Full question →

Refer to the exhibit. A security analyst notices that URL filtering is blocking some requests, but decryption is working. What can be concluded about the traffic that is being decrypted?

Exhibit

admin@PA-220> show system log | tail -20
2024-06-15 11:00:01  threat  url  example.com  spyware  blocked  high
2024-06-15 11:00:02  threat  url  badsite.com  malware  blocked  critical
2024-06-15 11:00:03  system  config  commit  admin  success

admin@PA-220> show url-filtering statistics
URL Filtering Profile: strict-profile
  Total requests: 1500
  Blocked: 45
  Allowed: 1455
  Categories: malware, spyware, phishing

admin@PA-220> show decryption statistics
Forward Proxy SSL/TLS Decryption: 1200 sessions, 45 MB decrypted

admin@PA-220> show running global-protect
No GlobalProtect configured
Question 10hardmultiple choice
Full question →

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-SSH      trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssh-proxy

admin@PA-220> show session all
Total sessions: 1

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssh              ACTIVE  FLOW   10.0.0.10:22     192.168.1.50:22       tcp        eth1/1    eth1/2

admin@PA-220> show system log | match ssh
2024-06-15 12:00:00  ssh_decrypt  error  Failed to decrypt SSH session: unsupported key exchange algorithm.  Src: 10.0.0.10 Dst: 192.168.1.50
Question 11hardmultiple choice
Full question →

Refer to the exhibit. A user reports that they receive a certificate warning when accessing https://example.com. The firewall is configured to decrypt SSL traffic. What is the most likely cause?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-Traffic  trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssl-forward-proxy

admin@PA-220> show ssl-decrypt certificate-status
Certificate: PA-Forward-Proxy-CA
  Issuer: CN=PA-Forward-Proxy-CA
  Valid: 2024-01-01 to 2025-01-01
  Status: valid

admin@PA-220> show system log | match ssl
2024-06-15 10:30:22  ssl_decrypt  error  Certificate is not trusted by client.  Src: 10.0.0.5 Dst: 93.184.216.34
Question 12hardmultiple choice
Full question →

Refer to the exhibit. What does this log indicate?

Exhibit

<log>
  <type>threat</type>
  <subtype>intrusion</subtype>
  <severity>critical</severity>
  <action>drop</action>
  <src>192.168.10.5</src>
  <dst>10.10.10.1</dst>
  <app>ssl</app>
  <threatid>40000</threatid>
</log>
Question 13mediummultiple choice
Full question →

Refer to the exhibit. The administrator notices that traffic from 192.168.1.100 to 10.1.1.1 using HTTPS is being blocked. What is the most likely cause?

Exhibit

rulebase security rules
{
  "rule1" : {
    "action" : "allow",
    "source" : [ "192.168.1.0/24" ],
    "destination" : [ "10.0.0.0/8" ],
    "application" : [ "web-browsing" ],
    "service" : [ "application-default" ]
  }
}
Question 14mediummultiple choice
Full question →

Refer to the exhibit. What is the status of the commit job?

Exhibit

admin@PA-5000> show jobs all

Job ID: 12345
Type: Commit
Status: Pending
Submitted by: admin
Question 15easymultiple choice
Full question →

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

Exhibit

template {
  name "Chicago-FW-Config"
  config {
    deviceconfig {
      system {
        hostname "CHI-FW-01"
        domain "example.com"
        ip-address 192.168.1.1
        netmask 255.255.255.0
        default-gateway 192.168.1.254
      }
    }
    network {
      interface ethernet1/1 {
        layer3 {
          ip 10.0.0.1/24
        }
        profile "protect"
      }
    }
  }
}

These PCNSA practice questions are part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style PCNSA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.