Courseiva

CCNA Pcnsa Securing Traffic Questions

50 questions · Pcnsa Securing Traffic topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQeasy

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

A.Source Zone, Destination Zone, Application, and User
B.Source Zone, Destination Zone, Application, and Service
C.Source Zone, Destination Zone, Service, and Action
D.Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action
AnswerD

These are the minimum required fields in a security policy rule.

Why this answer

A security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Exam trap

The trap here is that candidates often confuse Service with Application, assuming a port-based service (like TCP/80) is mandatory, but Palo Alto emphasizes App-ID as the primary identifier, making Service optional when Application is defined.

How to eliminate wrong answers

Option A is wrong because User is not a mandatory component; it is optional for user-based policy enforcement via User-ID, but not required for basic HTTP traffic. Option B is wrong because Service is not mandatory when Application is defined; App-ID identifies the application (e.g., HTTP) regardless of port, making Service redundant or optional. Option C is wrong because it omits Application and Source/Destination Address, which are mandatory; Service alone cannot replace Application for proper traffic identification, and Action is listed but the rule still lacks required address objects.

Practice this question →
2
MCQhard

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

A.The security profile group applied to the rule is blocking the traffic before the rule is evaluated.
B.The custom object containing the malicious IP was not committed.
C.A rule with a broader match exists above the blocking rule in the rulebase.
D.The device clock is out of sync, causing time-based rules to fail.
AnswerC

Rules are evaluated from top to bottom; a rule above that matches the traffic will apply, bypassing the blocking rule.

Why this answer

In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Exam trap

The trap here is that candidates may assume a correctly configured object guarantees enforcement, overlooking the fundamental rulebase ordering principle where a higher-priority allow rule can override a lower-priority block rule.

How to eliminate wrong answers

Option A is wrong because security profile groups are applied after a rule is matched and do not block traffic before rule evaluation; they inspect allowed traffic. Option B is wrong because the administrator verified the custom object is correctly listed, implying it was committed; uncommitted objects would not be listed in the rule. Option D is wrong because an out-of-sync device clock affects time-based rules only if the rule has a schedule configured, and the question does not mention any time-based condition.

Practice this question →
3
MCQhard

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

A.Configure intra-vsys security policy for each vsys and allow the traffic.
B.Enable inter-vsys traffic globally in the firewall settings.
C.Traffic between vsys is automatically allowed.
D.Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.
AnswerD

Inter-vsys traffic is controlled by security policies using zones from different vsys.

Why this answer

In Palo Alto firewalls, inter-vsys traffic is controlled by creating a security policy rule that specifies the source zone from vsys1 and the destination zone from vsys2 with action allow. This selectively permits traffic between specific virtual systems. Option A is incorrect because intra-vsys refers to traffic within the same vsys, not between different vsys.

Option B is incorrect because there is no global 'inter-vsys' enable setting; inter-vsys traffic is governed by security policies. Option C is incorrect because inter-vsys traffic is not automatically allowed; it must be explicitly permitted via policy.

Practice this question →
4
MCQeasy

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

A.Block the social-networking category and allow a custom URL category containing LinkedIn URLs.
B.Alert the social-networking category and block a custom URL category for LinkedIn.
C.Block the social-networking category and block a custom URL category for LinkedIn.
D.Allow the social-networking category and block a custom URL category for LinkedIn.
AnswerA

Block the category, then allow the specific override.

Why this answer

It blocks the entire social-networking category and then creates a custom URL category for LinkedIn with an allow override, allowing LinkedIn while blocking all other social media. Option B is incorrect because alerting does not block, so social media would not be blocked. Option C is incorrect because it would block both the category and LinkedIn, resulting in LinkedIn being blocked.

Option D is incorrect because allowing the social-networking category would allow all social media, including those that should be blocked.

Practice this question →
5
Multi-Selecthard

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Select 2 answers
A.Enable DNS Security on the outbound DNS traffic.
B.Configure DNS policies to block requests to unknown domains.
C.Allow all TCP traffic on port 53.
D.Enable logging on all DNS traffic for analysis.
E.Block all UDP traffic on port 53.
AnswersA, B

DNS Security detects tunneling attempts.

Why this answer

DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Exam trap

The trap here is that candidates often confuse passive monitoring (logging) with active prevention, or mistakenly think blocking all UDP on port 53 is a viable solution, not realizing it breaks legitimate DNS traffic.

Practice this question →
6
MCQmedium

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

A.Verify the source and destination zones are correct.
B.Ensure the application is identified by App-ID and that the correct application name is used.
C.Confirm that the action is set to allow.
D.Check the order of security rules.
AnswerB

Unknown or uncategorized applications may not match the rule.

Why this answer

If a security policy allows a specific application but traffic from that application is blocked, the most likely cause is that the application is not being correctly identified by App-ID. The administrator should first verify that the application is recognized by App-ID and that the correct application name is used in the rule. Option B is correct.

Option A is wrong because zones being correct is necessary but not the first check if the application is allowed. Option C is wrong because the action is already allow; the issue is identification. Option D is wrong because rule order matters only if multiple rules match, but here the rule matches yet traffic is blocked, so identification is the primary concern.

Practice this question →
7
Multi-Selectmedium

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Select 2 answers
A.Configure NAT policies to translate internal addresses.
B.Define separate security zones for Engineering and Finance.
C.Create a single security zone for all internal traffic.
D.Enable QoS policies between the zones.
E.Apply Threat Prevention profiles to the inter-zone security rules.
AnswersB, E

Separate zones allow fine-grained security policies between departments.

Why this answer

Security zones are the fundamental building blocks for segmenting traffic in Palo Alto Networks firewalls. By placing Engineering and Finance interfaces into separate zones, you create a trust boundary that allows you to enforce inter-zone security rules. Option E is correct because applying Threat Prevention profiles (e.g., antivirus, anti-spyware, vulnerability protection) to the inter-zone rule enables the firewall to inspect and block malicious traffic between the segmented departments.

Exam trap

The trap here is that candidates often confuse NAT or QoS with security controls, thinking address translation or bandwidth management can segment traffic, when in fact only zones and security rules enforce access control and threat inspection.

Practice this question →
8
MCQhard

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

A.The policy "Allow_SSH" has tunnel detection set to none, so it does not match.
B.The application tunnel policy "Block_Tor" is blocking all tunnels.
C.The time-to-live setting prevents SSH tunnel detection.
D.The default action for application tunnels is deny.
AnswerA

Without tunnel detection, the firewall cannot identify SSH tunnels, so the Allow_SSH policy never applies, and tunnels are likely blocked by the default or other rules.

Why this answer

The Allow_SSH policy has tunnel detection set to 'none', which means the firewall will not detect SSH tunnels, so the policy does not match. The other options are incorrect: Option B is wrong because the Block_Tor policy only blocks Tor tunnels, not all tunnels. Option C is wrong because TTL is not related to SSH tunnel detection.

Option D is wrong because the default action for application tunnels is not necessarily deny; it depends on the policy configuration.

Practice this question →
9
Multi-Selectmedium

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Select 2 answers
A.Set the rule action to 'reset-both'.
B.Set the rule action to 'allow'.
C.Set the rule action to 'deny'.
D.Enable 'Log at Session Start' in the rule.
E.Enable 'Log at Session End' in the rule.
AnswersB, E

Allow permits traffic through the firewall.

Why this answer

Setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.

Exam trap

The trap here is that candidates often confuse 'Log at Session Start' with 'Log at Session End', thinking that logging at the start is sufficient for full traffic logging, but in reality, session-end logs provide the complete session metadata needed for security analysis.

Practice this question →
10
MCQmedium

A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?

A.Rule 1: allow-http-from-trust-to-untrust (allow)
B.Rule 3: allow-dns-from-trust-to-untrust (allow)
C.Rule 2: deny-all-from-trust-to-untrust (deny)
D.No rule matches; implicit deny will block the traffic.
AnswerC

Since HTTPS is not HTTP, rule 1 fails; rule 2 matches any application and denies.

Why this answer

The traffic is HTTPS, which uses the SSL application, not HTTP. Rule 1 only matches HTTP, so it does not match. Rule 2 is a deny-all rule that applies to all traffic from the trust zone to the untrust zone, so it matches and denies the HTTPS traffic.

Rule 3 only matches DNS, and the implicit deny is not reached because Rule 2 explicitly denies the traffic. Therefore, the correct rule is Rule 2 (deny-all-from-trust-to-untrust).

Practice this question →
11
Drag & Dropmedium

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.

Practice this question →
12
Multi-Selecteasy

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Select 2 answers
A.WildFire
B.User-ID
C.Application-ID
D.URL Filtering
E.Content-ID
AnswersC, E

Allows identification and enforcement based on application signatures.

Why this answer

Options C and E are correct. Application-ID (C) identifies and controls applications, allowing only approved applications to be used on the network. Content-ID (E) enables granular control over file transfers and data patterns, further enforcing security policies.

WildFire (A) analyzes unknown files, User-ID (B) maps users to IP addresses, and URL Filtering (D) controls web categories; none of these directly enforce approved application usage.

Practice this question →
13
Multi-Selectmedium

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Select 3 answers
A.Antivirus
B.URL Filtering
C.Vulnerability Protection
D.File Blocking
E.Anti-Spyware
AnswersA, C, E

Scans for known viruses and malware.

Why this answer

Options A, C, and E are correct. Antivirus blocks known malware, Anti-Spyware blocks spyware and grayware, and Vulnerability Protection blocks exploit attempts. Together, these three profile types provide comprehensive protection against malware.

URL Filtering controls access based on categories, and File Blocking blocks specific file types, but they are not primarily malware-blocking profiles.

Practice this question →
14
MCQhard

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

A.Enable SSL Decryption to inspect encrypted traffic.
B.Change the security policy to use port-based rules instead of application-based.
C.Create custom application signatures for the misidentified applications.
D.Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.
AnswerD

Updating App-ID and using enhancements like application override can correct misidentification.

Why this answer

Ensuring App-ID updates are current and using application identification enhancements (such as application override when needed) directly improves the accuracy of application identification. Option A (SSL Decryption) can help identify encrypted applications but does not directly address misidentification due to outdated signatures or custom needs. Option B (port-based rules) would reduce reliance on App-ID, which is counterproductive.

Option C (custom application signatures) is useful but is not the first step; verifying updates and enhancements is a more fundamental action. Therefore, D is the best initial step.

Practice this question →
15
MCQhard

Based on the log entry, what is the most likely reason for the TCP reset from the client?

A.The connection timed out.
B.The security policy blocked the traffic.
C.The web server sent a reset to the client.
D.The client detected a certificate error and closed the connection.
AnswerD

Client resets can occur due to SSL/TLS handshake failures.

Why this answer

The TCP reset from the client indicates the client terminated the connection. In SSL/TLS traffic, a common reason is a certificate error during the handshake. The client detects an invalid or untrusted certificate and sends a TCP reset to close the connection.

Option A is incorrect because a timeout would show tcp-timeout. Option B is incorrect because a security policy block would show a deny action or drop. Option C is incorrect because a server-initiated reset would show tcp-rst-from-server.

Practice this question →
16
Multi-Selecteasy

Which TWO security profile types are used to block known malware? (Choose two.)

Select 2 answers
A.File Blocking
B.URL Filtering
C.Anti-Spyware
D.Antivirus
E.Vulnerability Protection
AnswersA, D

File blocking can block malicious file types.

Why this answer

The correct answers are A (File Blocking) and D (Antivirus). Antivirus blocks known malware by comparing files against signature databases. File Blocking prevents specific file types (e.g., executables, archives) from being transferred, which can stop malware delivery.

URL Filtering (B) controls web access based on categories, not malware blocking. Anti-Spyware (C) targets spyware specifically, not all known malware. Vulnerability Protection (E) blocks exploit attempts, not malware files themselves.

Practice this question →
17
Multi-Selectmedium

Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?

Select 2 answers
A.Enable URL Filtering profile override on the user-id agent configuration.
B.Create a security rule with a URL category set to 'internal-ip'.
C.Set the URL Filtering profile action to 'alert' instead of 'block'.
D.Add the user's IP address to an exemption list in the URL filtering profile.
E.Use a custom URL category list that includes the allowed internal websites.
AnswersB, E

The 'internal-ip' category is predefined to match traffic to internal IP addresses and bypasses URL filtering.

Why this answer

The correct answers are B and E. Option B is valid because the 'internal-ip' URL category automatically applies to traffic from internal IP addresses, effectively bypassing URL filtering for internal users when used in a security rule with an allow action. Option E is valid because you can create a custom URL category listing internal websites that should be allowed, then use it in a security rule that allows traffic for internal users while applying strict filtering to external traffic.

Option A is incorrect because URL Filtering profile override is not a standard feature; User-ID agent configuration does not provide such override. Option C is incorrect because setting the action to 'alert' only logs the traffic, it does not bypass the filtering (the traffic is still subject to the block action if matched). Option D is incorrect because there is no IP exemption list in URL filtering profiles; exemptions are based on URL categories, not IP addresses.

Practice this question →
18
MCQhard

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

A.The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.
B.The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.
C.The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.
D.The firewall has insufficient memory to process URL lookups and is dropping packets.
AnswerA

This is a common cause: uncategorized URLs are blocked by default if the action is not 'alert'.

Why this answer

The URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.

Exam trap

The trap here is that candidates assume only the explicitly mentioned categories (e.g., 'malware') matter, overlooking the 'uncategorized' category which is often set to 'block' by default or inadvertently, causing legitimate traffic to be blocked.

How to eliminate wrong answers

Option B is wrong because the question states the security policy includes a single rule allowing outbound HTTP/HTTPS traffic, and there is no mention of a deny rule above it; incorrect rule order would cause all traffic to be blocked, not just specific legitimate sites. Option C is wrong because URL Filtering profiles are applied per security rule, not at the zone level; zone-level application is not a feature of Palo Alto Networks firewalls. Option D is wrong because insufficient memory would cause packet drops or performance degradation across all traffic, not selective blocking of legitimate websites, and the firewall's logs show sessions to malicious IPs are not being blocked, indicating memory is not the issue.

Practice this question →
19
MCQmedium

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

A.Configure a Source NAT rule to translate the mail server's IP to the public IP.
B.Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.
C.Configure a security policy rule with source NAT to translate the public IP to the private IP.
D.Configure a security policy rule allowing SMTP from external to DMZ without NAT.
AnswerB

Destination NAT translates the public IP to the private IP, and the policy allows the traffic.

Why this answer

To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Exam trap

The trap here is that candidates often confuse Source NAT with Destination NAT, assuming any NAT rule will work, or they think a security policy alone is sufficient without understanding that NAT is required to route the traffic to the internal server.

How to eliminate wrong answers

Option A is wrong because Source NAT (SNAT) translates the source IP of outbound traffic, not the destination IP of inbound traffic; it would not help the mail server receive inbound SMTP. Option C is wrong because it incorrectly describes a security policy rule with source NAT, which is not a valid configuration for inbound traffic; source NAT is used for outbound traffic, and the translation described (public to private) is actually destination NAT. Option D is wrong because without a NAT rule, the firewall would not translate the destination IP from the public IP to the private IP of the mail server, so the traffic would not reach the server even if the security policy allows it.

Practice this question →
20
Multi-Selecthard

Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)

Select 3 answers
A.A root CA certificate installed in the trusted root store on client devices.
B.The private key of each destination server.
C.The server certificate for each destination server.
D.A decryption policy rule that matches the traffic to be decrypted.
E.A decryption profile that specifies the forward proxy certificate (CA certificate).
AnswersA, D, E

Clients must trust the CA that signs the decrypted sessions.

Why this answer

Options A, D, and E are correct. A root CA certificate installed on client devices is required so clients trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt.

A decryption profile specifies the forward proxy certificate (CA certificate) used by the firewall. Option B is incorrect because the firewall does not need the private key of each destination server; it generates its own certificate for the session. Option C is incorrect because the server certificate is not required on clients for forward proxy decryption.

Practice this question →
21
Multi-Selecthard

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Select 2 answers
A.Gateway configuration
B.Host Information Profile (HIP)
C.Client certificates
D.App-IP mapping
E.Pre-logon
AnswersB, C

HIP checks device posture and enforces compliance.

Why this answer

The correct answers are Host Information Profile (HIP) and Client certificates. HIP checks device compliance (e.g., OS, antivirus, disk encryption) to ensure only compliant devices connect. Client certificates authenticate the device itself, providing an additional layer of security.

Gateway configuration is basic connectivity, pre-logon is for always-on VPN, and App-IP mapping is irrelevant to device compliance.

Practice this question →
22
MCQmedium

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

A.User-ID mapping to ensure the user is correctly identified.
B.The application override configuration.
C.The security rule for the user's source zone.
D.The FTP server's health.
AnswerA

If the user is not correctly identified, policies based on user (like group-based allow/deny) may not apply correctly.

Why this answer

The issue is user-specific (only one user cannot access, others can). This suggests a problem with user identification or authentication. User-ID mapping ensures the user is correctly identified so that security rules tied to specific users (rather than just IP addresses) are applied properly.

Checking User-ID mapping is the first logical step.

Practice this question →
23
MCQhard

An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?

A.The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.
B.The decryption policy does not specify a certificate for forward proxy.
C.The CRL (Certificate Revocation List) is not enabled on the firewall.
D.The server certificate for each HTTPS site is missing from the client's certificate store.
AnswerA

Correct. The firewall's CA certificate must be trusted by clients to avoid certificate errors.

Why this answer

The firewall's CA certificate must be installed in the trusted root certificate store on client workstations; otherwise, the dynamically generated certificates for HTTPS sites will not be trusted, causing certificate errors. Option B is incorrect because the decryption policy does specify a certificate for forward proxy (typically the firewall's own CA certificate), so the issue is not a missing certificate in the policy. Option C is incorrect because the CRL (Certificate Revocation List) is used to check revocation status; not enabling it may allow revoked certificates but does not directly cause certificate trust errors.

Option D is incorrect because the server certificate is presented by the web server during the TLS handshake and does not need to be pre-installed on clients; the client validates it against the trusted root store.

Practice this question →
24
MCQmedium

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

A.The security policy is not enabled on the firewall.
B.The deny rule was removed from the configuration.
C.The traffic is matching the implicit deny rule at the end.
D.There is an allow rule above the deny rule that matches the traffic first.
AnswerD

Rule order evaluation stops on first match; allow rule above the deny will permit traffic.

Why this answer

Any deny rule placed after a matching allow rule will not be evaluated if the allow rule is hit first. Rule order is critical in PAN-OS. Option A is wrong because removing the rule is not the cause.

Option B is wrong because policy is not optional. Option C is wrong because implicit deny exists but only if no rule matches.

Practice this question →
25
MCQeasy

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

A.Rule 3 (allow-dns)
B.Rule 2 (block-malware)
C.Rule 1 (allow-web)
D.No rule matches; traffic is denied by default.
AnswerC

The traffic matches all criteria in rule 1 and is allowed.

Why this answer

Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.

Exam trap

Palo Alto Networks often tests the concept that rule order matters and that a more specific rule (like allow-web) will match before a generic block rule, leading candidates to incorrectly assume a later block rule would apply if they overlook the explicit allow rule earlier in the list.

How to eliminate wrong answers

Option A is wrong because Rule 3 (allow-dns) is designed for DNS traffic (UDP/TCP port 53), not HTTP (TCP port 80), and the destination IP 192.0.2.50 is not a DNS server in this context. Option B is wrong because Rule 2 (block-malware) would block traffic based on threat signatures or malicious IPs, but the traffic is a legitimate HTTP request to 192.0.2.50, and no malware indicators are present. Option D is wrong because Rule 1 matches the traffic, so the default deny action is not triggered; the firewall applies the first matching rule.

Practice this question →
26
MCQeasy

An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?

A.Source NAT (Outbound)
B.Dynamic IP and Port (DIPP)
C.Destination NAT
D.Static NAT
AnswerA

Source NAT changes the source IP to the firewall's interface IP.

Why this answer

Source NAT (Outbound). Source NAT translates the source IP address of internal hosts to a public IP address when traffic goes out to the Internet, effectively hiding internal IP addresses. Option B (Dynamic IP and Port) is a type of source NAT that also hides addresses, but it is a specific method, not the broad category.

Option C (Destination NAT) translates destination IP addresses for inbound traffic, not outbound. Option D (Static NAT) provides a one-to-one mapping and does not hide the internal IP because the translation is fixed and often bidirectional.

Practice this question →
27
MCQmedium

A company uses SSL Forward Proxy to decrypt all outbound HTTPS traffic. Users report significant performance degradation when accessing external web applications. Which action should the administrator take to improve performance while maintaining security?

A.Create a decryption exclusion rule for financial and banking websites.
B.Increase the session timeout values for decrypted traffic.
C.Enable hardware SSL decryption offloading on the firewall.
D.Change the decryption profile to require only high-strength ciphers.
AnswerA

Excluding high-value but sensitive categories reduces decryption load and complies with regulatory standards, thus improving performance.

Why this answer

Excluding financial and banking websites from SSL decryption reduces the processing load on the firewall, alleviating performance degradation while still maintaining security for most outbound traffic. These websites typically use high-grade encryption and are trusted, so decryption is unnecessary and can cause performance issues. Option B is incorrect because increasing session timeouts does not reduce decryption processing overhead.

Option C is incorrect because hardware SSL decryption offloading may not be supported on all models or may not fully address the performance impact of decrypting all traffic. Option D is incorrect because requiring only high-strength ciphers increases processing overhead, worsening performance.

Practice this question →
28
MCQmedium

A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.

A.The internal resources require a specific security profile that is not applied to the rule.
B.The User-ID agent is not mapping remote usernames correctly.
C.The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings.
D.The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'.
AnswerD

If the rule expects source zone 'Trust', traffic from GlobalProtect zone won't match, and a subsequent deny rule blocks it.

Why this answer

The logs show traffic from remote users is being matched to a rule that denies inter-zone traffic from GlobalProtect to internal, meaning the intended allow rule is not matching. If the security rule's source zone is set to 'Trust' instead of 'GlobalProtect', traffic sourced from the GlobalProtect zone will not match that rule and will instead hit the default inter-zone deny rule. Option A is about security profiles, which would not cause a rule mismatch.

Option B (User-ID) affects user mapping but not zone-based rule matching. Option C (routes/split-tunneling) affects routing but not policy matching; the users can connect and get IPs, so routing is working, but the traffic is being denied by policy, not routing.

Practice this question →
29
MCQeasy

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

A.DNS Security profile
B.Vulnerability Protection profile
C.URL Filtering profile
D.Anti-Spyware profile
AnswerA

DNS Security is designed to detect and block DNS tunneling.

Why this answer

DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.

Exam trap

The trap here is that candidates often confuse DNS Security with Anti-Spyware, assuming that spyware signatures will catch tunneling, but DNS tunneling is a protocol-level evasion technique that requires dedicated DNS inspection, not just signature-based malware detection.

How to eliminate wrong answers

Option B is wrong because Vulnerability Protection profile is designed to detect and block exploit attempts targeting known vulnerabilities in applications and operating systems, not to analyze DNS traffic for tunneling or exfiltration patterns. Option C is wrong because URL Filtering profile controls access to web categories and URLs based on policy, but it does not inspect the content or structure of DNS queries to identify tunneling behavior. Option D is wrong because Anti-Spyware profile focuses on blocking malware command-and-control (C2) traffic and spyware signatures, but it lacks the deep DNS protocol analysis needed to detect data exfiltration via DNS tunneling.

Practice this question →
30
MCQeasy

A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?

A.Add a new rule before 'Allow-Web' that permits traffic to 203.0.113.50 on any port and any application.
B.Change the service in the 'Allow-Web' rule to 'any' to allow web-browsing on any port.
C.Create a custom application that matches TCP port 8080 for the partner's website and add it to the 'Allow-Web' rule alongside 'web-browsing'.
D.Modify the rule to use application 'any' to allow all applications.
AnswerC

This allows App-ID to recognize the traffic on the non-standard port while maintaining granular control.

Why this answer

The traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.

Exam trap

The trap here is that candidates assume 'web-browsing' will match any HTTP-like traffic regardless of port, but Palo Alto Networks App-ID requires explicit application definition for non-standard ports, and simply changing the service or application to 'any' undermines the security model.

How to eliminate wrong answers

Option A is wrong because permitting traffic to 203.0.113.50 on any port and any application bypasses all application and port restrictions, violating the principle of least privilege and potentially allowing malicious traffic. Option B is wrong because changing the service to 'any' would allow web-browsing on any port, but the traffic on TCP 8080 still does not match the 'web-browsing' application definition, so the rule would not permit it. Option D is wrong because modifying the rule to use application 'any' would allow all applications through the rule, completely defeating the purpose of application-based security and exposing the network to unnecessary risks.

Practice this question →
31
MCQeasy

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

A.It is a security rule that allows the session.
B.It is a QoS rule that prioritizes the traffic.
C.It is a NAT rule that translates the source IP.
D.It is a decryption rule that decrypts the traffic.
AnswerA

The session matched rule Allow_Outbound, which is a security rule that permitted the session.

Why this answer

Based on the exhibit, the session output shows that the rule 'Allow_Outbound' matched and allowed the session. This rule is a security rule because it permits traffic. Options B, C, and D are incorrect: QoS rules prioritize traffic, NAT rules translate IP addresses, and decryption rules decrypt traffic.

The session was allowed, indicating a security rule.

Practice this question →
32
MCQhard

A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?

A.Use only default ports for services to avoid creating service objects.
B.Convert all application-based rules to use service objects instead.
C.Consolidate rules using Security Profile Groups (SPGs) and broader application groups.
D.Place the most specific rules at the top of the rulebase.
AnswerC

SPGs allow multiple rules to reference the same security profiles, reducing rule count while maintaining security posture.

Why this answer

Consolidating rules using Security Profile Groups (SPGs) and broader application groups reduces rule count while maintaining visibility. SPGs allow multiple rules to share the same security profiles, reducing duplication, and application groups bundle related applications to minimize rule entries. Option A is incorrect as using default ports bypasses App-ID, losing application visibility.

Option B is incorrect because converting to service objects removes application visibility and does not reduce rule count. Option D is incorrect; placing specific rules at the top does not reduce rule count—it only affects rule matching order.

Practice this question →
33
MCQeasy

An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?

A.Deploy SSL decryption to see user credentials.
B.Configure User-ID by integrating with Active Directory or using captive portal.
C.Enable URL Filtering to track user visits.
D.Activate App-ID to detect user login events.
AnswerB

User-ID maps IP addresses to usernames.

Why this answer

User-ID requires integration with Active Directory, a captive portal, or other user mapping methods to identify users for security policies. Option A is incorrect because SSL decryption is not required; user identification relies on mapping IP addresses to usernames, not decrypting credentials. Option C is incorrect because URL Filtering is used for categorizing web traffic, not for identifying users.

Option D is incorrect because App-ID identifies applications, not users.

Practice this question →
34
MCQmedium

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

A.Dynamic IP and Port (DIPP) with source NAT.
B.Bidirectional NAT.
C.Static NAT with source NAT.
D.Destination NAT with port forwarding.
AnswerA

DIPP translates internal IPs to public IPs with port multiplexing, suitable for outbound internet access.

Why this answer

Dynamic IP and Port (DIPP) NAT allows multiple internal users to share a pool of public IP addresses by using port address translation, which is ideal for outbound internet access. Option B (Bidirectional NAT) is typically used for static 1-to-1 mappings that allow both inbound and outbound translation, not for sharing a pool of addresses. Option C (Static NAT with source NAT) is used for static mapping of a private IP to a public IP, primarily for inbound traffic, not for sharing a pool.

Option D (Destination NAT with port forwarding) is used to forward specific inbound traffic to internal servers, not for outbound internet access.

Practice this question →
35
MCQeasy

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

A.Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.
B.Use a Zone Protection profile to block the IP.
C.Create a security rule with source IP address and action deny.
D.Use a DoS protection policy to block the IP.
AnswerA

This is straightforward and effective; the rule denies traffic from that IP immediately.

Why this answer

Creating a security rule with the source zone (external), source IP, any destination, and action deny, placed at the top of the rulebase, is the simplest and most direct method to block all traffic from a specific IP. Option B (Zone Protection profile) is designed for flood protection and not for blocking specific IPs. Option C omits the source zone, which could allow traffic from other zones and is not as precise.

Option D (DoS protection policy) is intended for rate limiting and anomaly detection, not for simply blocking a single IP address.

Practice this question →
36
MCQhard

Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?

A.Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.
B.Remove the service restriction from rule1.
C.Create a custom application that matches TCP port 8080 and add it to rule1.
D.Change the application in rule1 to 'any' to match all applications.
AnswerC

A custom application allows App-ID to correctly identify HTTP traffic on non-standard ports, and adding it to the rule allows the traffic.

Why this answer

The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.

Exam trap

The trap here is that candidates assume changing the service to 'any' or removing the service restriction will allow the traffic, but they overlook that the application 'web-browsing' still has a default port binding of 80, so the traffic on port 8080 will not be matched by the rule.

How to eliminate wrong answers

Option A is wrong because adding a new rule before rule1 with application 'web-browsing' and service 'tcp-8080' would still not match the traffic, as 'web-browsing' application is typically defined for port 80, not 8080. Option B is wrong because removing the service restriction from rule1 would allow any service, but the application 'web-browsing' still only matches port 80, so the traffic would not be identified as matching the rule. Option D is wrong because changing the application to 'any' would bypass application identification, which is not a best practice and does not address the need to match the specific port 8080 traffic; the firewall would still need a service or application definition for port 8080.

Practice this question →
37
MCQeasy

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

A.The rule order is incorrect; the allow rule is below the 'Deny All' rule.
B.The application 'web-browsing' is not being properly identified by App-ID.
C.The source address object for the allow rule is misconfigured with a wrong subnet mask.
D.The User-ID agent is overriding the allow rule and triggering a block action.
AnswerA

Since the logs show the traffic matches the deny rule, the allow rule must be positioned lower in the rulebase.

Why this answer

In Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Practice this question →
38
MCQmedium

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

A.The TCP sequence numbers are out of order, causing the packets to be out of the expected window.
B.The NAT policy is misconfigured, causing the source IP to not be translated correctly.
C.The security policy uses an incorrect service object that doesn't match the application.
D.Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.
AnswerD

Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.

Why this answer

When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Exam trap

The trap here is that candidates often confuse 'tcp-non-syn' with TCP sequence number issues or NAT problems, but the key is recognizing that this drop occurs only when the firewall has no session state, which points directly to asymmetric routing.

How to eliminate wrong answers

Option A is wrong because out-of-order sequence numbers cause 'tcp-out-of-window' drops, not 'tcp-non-syn'; the firewall tracks sequence numbers within the established session window. Option B is wrong because a misconfigured NAT policy would typically cause translation failures or session timeouts, not a 'tcp-non-syn' drop; the firewall would still see the SYN and create a session. Option C is wrong because an incorrect service object would cause a policy match failure or application misidentification, but the firewall would still process the SYN and create a session if the traffic is allowed; the 'tcp-non-syn' drop specifically indicates no prior SYN was seen.

Practice this question →
39
Multi-Selectmedium

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Select 2 answers
A.Captive Portal
B.Kerberos Authentication
C.LDAP Synchronization
D.XML API
E.User-ID Agent
AnswersA, E

Captive Portal authenticates users directly and maps IPs.

Why this answer

Options A and E are correct. Captive Portal authenticates users directly by requiring them to log in, and User-ID Agent collects user-to-IP mappings from directory services like Active Directory. Option B (Kerberos Authentication) is a protocol used for authentication but not a dedicated User-ID method.

Option C (LDAP Synchronization) is a method for synchronizing directory data, not for identifying users in real time. Option D (XML API) is an interface for configuration, not a standard User-ID identification method.

Practice this question →
40
MCQhard

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

A.The security rule uses application 'ssl' but not 'web-browsing' for the traffic.
B.The firewall is missing the latest content updates for WildFire.
C.The decryption exclusion list includes the domain of the malware source.
D.The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.
AnswerD

The default profile uses only local signatures; without WildFire analysis, new or customized malware can bypass.

Why this answer

The Anti-Malware profile set to 'default' relies on known signatures and may not detect malware using a custom packer that is not recognized. The default profile does not include advanced analysis like WildFire, which could identify unknown threats. Option A is incorrect because using application 'ssl' is appropriate for decrypted SSL traffic; the traffic is correctly identified.

Option B is incorrect because while content updates for WildFire are important, the primary issue is the profile not leveraging WildFire analysis; the default profile may not send samples to WildFire even with latest updates. Option C is incorrect because the decryption exclusion list does not include the domain; the malware source is not in the financial services category.

Practice this question →
41
MCQhard

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

A.Rely on the browser's security settings to prevent decryption.
B.Disable SSL Decryption globally when the user visits sensitive sites.
C.Use a policy to decrypt only HTTP traffic.
D.Create a decryption exclusion rule for specific URLs or categories.
AnswerD

Decryption exclusion rules allow you to bypass decryption for sensitive destinations.

Why this answer

Decryption exclusion rules allow you to specify URLs or URL categories (e.g., banking sites) that should not be decrypted, ensuring sensitive traffic remains encrypted. Option A is incorrect because browser security settings cannot prevent the firewall from decrypting traffic; decryption is controlled at the firewall level. Option B is impractical because disabling SSL Decryption globally would affect all traffic, not just sensitive sites.

Option C is incorrect because HTTP traffic is already plaintext and does not need decryption; SSL Decryption is specifically for HTTPS traffic.

Practice this question →
42
MCQhard

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

A.A zone protection profile is blocking ICMP packets.
B.The virtual router does not have a default route to the external network.
C.The decryption policy is blocking the traffic because it is not decrypted.
D.The NAT policy is missing for the outbound traffic.
AnswerB

Without a route, the firewall cannot forward packets to the destination.

Why this answer

The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.

Exam trap

The trap here is that candidates often confuse routing issues with security policy or NAT problems, but the firewall must have a viable route in the virtual router before it can forward any traffic, regardless of policy allowances.

How to eliminate wrong answers

Option A is wrong because a zone protection profile blocks ICMP at the zone level, but the user can already ping the management IP, indicating ICMP is not blocked globally; the issue is routing, not ICMP filtering. Option C is wrong because decryption policies apply to SSL/TLS traffic, not to ICMP ping traffic, and the question states the user is pinging, so decryption is irrelevant. Option D is wrong because a missing NAT policy would affect source address translation but not prevent the firewall from routing the packet; the firewall can still forward traffic without NAT if the destination is reachable, but the core problem here is the lack of a route.

Practice this question →
43
MCQeasy

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

A.Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.
B.Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.
C.Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.
D.Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.
AnswerA

This uses App-ID to precisely allow only web and SSL traffic, blocking everything else by default.

Why this answer

Using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad.

Option D allows all traffic.

Practice this question →
44
MCQhard

Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?

A.Create a single rule with both allow and deny actions based on source.
B.Place the specific servers in a different zone and create a new policy for that zone.
C.Add a new allow rule above the deny rule that matches the specific traffic.
D.Modify the existing deny rule to allow all traffic.
AnswerC

The allow rule will be evaluated first and permit the traffic before reaching the deny rule.

Why this answer

The correct approach is to add a new allow rule above the existing deny rule. In a security policy, rules are evaluated from top to bottom, and the first matching rule determines the action. By placing a more specific allow rule for the critical application's traffic (matching the special IP range) before the general deny rule, only that traffic is permitted, while all other traffic continues to be blocked by the deny rule.

This is a standard method of creating an exception to a broader deny rule.

Practice this question →
45
MCQmedium

A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.

A.The log forwarding profile only includes 'traffic' logs and not 'threat' logs.
B.The firewall is logging only at session end and the deny sessions are not completing.
C.The log forwarding profile is not configured to forward logs for denied sessions.
D.The SIEM is not configured to receive syslog messages for deny actions.
AnswerC

Log forwarding profiles can filter by action (e.g., allow, deny). If deny is not included, denied traffic logs won't be forwarded.

Why this answer

The most likely cause is that the log forwarding profile is not configured to forward logs for denied sessions. Even though the profile includes 'traffic' logs, it may have a filter that excludes logs with a deny action. Option A is incorrect because the profile does include traffic logs; denied traffic logs are a subset of traffic logs, but the profile's filter might exclude deny actions.

Option B is incorrect because deny sessions do complete (they are dropped) and logging at session end still generates a log. Option D is incorrect because the SIEM is receiving syslog messages for allowed traffic, so the syslog configuration is fine.

Practice this question →
46
Matchingmedium

Match each PAN-OS component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Handles configuration and logging

Processes traffic and enforces policies

Manages routing and session setup

Aggregates logs from multiple firewalls

Why these pairings

The three PAN-OS planes are Management, Data, and Control. The Management Plane handles configuration and logging, the Data Plane forwards traffic, and the Control Plane manages routing and sessions. Common mistakes include swapping the roles of Management and Data planes.

Practice this question →
47
MCQeasy

A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?

A.Rule 2: no-nat-for-servers
B.Both rules are applied.
C.No NAT rule matches; traffic is not translated.
D.Rule 1: source-nat-1
AnswerD

Rule 1 matches the source and destination, and since rule 2's destination does not match, rule 1 is applied.

Why this answer

Rule 1 matches first because the source 10.0.0.5 falls within the source range (10.0.0.0/8) and the destination 8.8.8.8 is not excluded by the exception rule (which only excludes 192.168.1.0/24). Therefore, Rule 1 is applied and performs source NAT to the interface IP. Option A is incorrect because Rule 2 is a no-NAT rule that would only apply if the destination matched 192.168.1.0/24, which it does not.

Option B is incorrect because only the first matching rule is applied; NAT rules are processed in order. Option C is incorrect because Rule 1 does match.

Practice this question →
48
MCQeasy

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

A.URL filtering profile only.
B.Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.
C.No profile is needed; default settings suffice.
D.Antivirus profile only.
AnswerB

A security profile group provides layered protection and is optimized for performance.

Why this answer

A security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Practice this question →
49
MCQmedium

A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?

A.The profiles are set to 'alert' instead of 'block' for the critical threat categories.
B.The antivirus signatures are outdated.
C.The security profiles are not attached to any security rule.
D.The profile groups are applied in the wrong order.
AnswerA

Alert only logs, does not block.

Why this answer

If Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) are set to 'alert' instead of 'block' for critical threat categories, the firewall will generate alerts but will not block the malware. This is a common misconfiguration that allows malware to pass through. Option B is incorrect because while outdated signatures can reduce effectiveness, the question specifically asks about a common misconfiguration, and alert vs. block is a more frequent oversight.

Option C is incorrect because if profiles are not attached to any security rule, they would not be applied at all, but the scenario implies they are attached. Option D is incorrect because the order of profile groups within a rule does not affect blocking; all profiles are applied simultaneously.

Practice this question →
50
MCQmedium

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

A.SSL Decryption with a dedicated decryption broker.
B.SSL Forward Proxy with decryption mirroring.
C.Decryption port mirroring.
D.TLS 1.3 decryption.
AnswerA

A decryption broker offloads SSL/TLS decryption to a dedicated appliance, reducing firewall load while maintaining visibility.

Why this answer

The decryption broker feature allows offloading decryption to a dedicated appliance while maintaining visibility for the firewall. Option B, SSL Forward Proxy with decryption mirroring, mirrors decrypted traffic but does not offload decryption. Option C, decryption port mirroring, is not a standard feature for offloading.

Option D, TLS 1.3 decryption, refers to supporting a protocol version, not a decryption offloading solution.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Pcnsa Securing Traffic questions.

Start 20-question session