Palo Alto Networks Certified Network Security Engineer PCNSE PCNSE Questions 76–150 | Page 2/7

Multi-Selectmedium

Which TWO conditions typically cause the firewall to bypass SSL decryption for a session? (Choose two.)

Select 2 answers

A.The firewall detects that the session is already decrypted (e.g., by another device).

B.The client and server negotiate a cipher suite not supported by the firewall.

C.The certificate presented by the server is not valid (e.g., expired, untrusted).

D.The traffic matches a 'no-decrypt' rule in the decryption policy.

E.The decrypted data exceeds a certain size threshold.

AnswersB, C

If the cipher is unsupported, the firewall cannot decrypt.

Why this answer

If the client and server negotiate a cipher suite that the firewall does not support, the firewall cannot decrypt the session. The firewall must be able to inspect the SSL/TLS handshake and match the cipher suite to its supported list; if the cipher suite is unsupported (e.g., TLS 1.3-only ciphers on an older firewall), decryption fails and the session is bypassed. Option C is correct because when the server presents an invalid certificate (expired, untrusted, or mismatched), the firewall cannot complete the SSL handshake with the client, so it bypasses decryption to avoid breaking the session.

Exam trap

The trap here is that candidates often confuse policy-based 'no-decrypt' rules (which are intentional exclusions) with technical conditions that force a bypass, or they mistakenly think that invalid certificates always cause decryption to fail when in fact the firewall can be configured to still decrypt with a warning or to bypass based on policy.

Full explanation →

MCQmedium

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

A.The traffic is being blocked because the 'From Zone' is trust

B.The session is being denied by a different rule

C.The firewall might be incorrectly identifying the application as web-browsing when it is something else

D.The session is not being logged correctly

AnswerC

Application misidentification can cause partial loading if the firewall blocks embedded objects.

Why this answer

When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Exam trap

Palo Alto Networks often tests the nuance that a session being 'established' does not guarantee full application functionality; candidates mistakenly assume that if the session is up, all traffic is passing, but App-ID misclassification can cause partial content delivery.

How to eliminate wrong answers

Option A is wrong because the 'From Zone' being trust does not inherently block traffic; zone-based policies are evaluated based on the rulebase, and a session being established indicates that a rule allowed the initial handshake. Option B is wrong because if the session is established, it has already matched a rule that permits the session; a different rule denying the session would prevent establishment entirely, not cause partial loading. Option D is wrong because logging is a reporting function and does not affect whether traffic is allowed or blocked; incorrect logging would not cause incomplete page loading.

Full explanation →

MCQeasy

A medium-sized enterprise recently deployed a PA-5250 firewall in a data center as the primary internet gateway. The network team configured the security policies to allow all outbound web traffic (HTTP/HTTPS) from the internal trust zone to the untrust zone, with URL filtering and threat prevention enabled. After the deployment, users complain that some legitimate websites, such as banking and healthcare portals, are being blocked. The team checks the URL filtering logs and sees that these sites are categorized as 'web-hosting' or 'dynamic-dns', which are in the block list. The company's compliance requires that all web traffic be inspected. What should the network engineer do to resolve the issue without reducing security?

A.Add the specific URLs to the 'Allow List' in the URL filtering profile

B.Set the URL filtering profile action for 'web-hosting' to 'alert' instead of 'block'

C.Create a URL category override for each legitimate site to reclassify it as 'business-economy' or 'health-medicine'

D.Remove the 'web-hosting' and 'dynamic-dns' categories from the block list

AnswerC

Override changes the category for specific URLs, so they are no longer blocked by the 'web-hosting' or 'dynamic-dns' categories, while still being subject to other security checks.

Why this answer

URL category overrides allow you to reclassify specific URLs into a more appropriate category (e.g., 'health-medicine') without altering the global block action for 'web-hosting' or 'dynamic-dns'. This preserves the security posture by keeping the broad categories blocked for unknown or risky sites, while permitting the legitimate sites that were miscategorized by the Palo Alto Networks URL filtering database.

Exam trap

The trap here is that candidates often choose to add URLs to an allow list (Option A) without realizing that this bypasses all security inspections, failing the compliance requirement for full traffic inspection.

How to eliminate wrong answers

Option A is wrong because adding specific URLs to the 'Allow List' in the URL filtering profile would bypass all URL filtering and threat prevention for those URLs, violating the compliance requirement that all web traffic be inspected. Option B is wrong because setting the action for 'web-hosting' to 'alert' would allow all sites in that category, including potentially malicious ones, reducing security by permitting unvetted traffic. Option D is wrong because removing 'web-hosting' and 'dynamic-dns' from the block list would globally allow all sites in those categories, including malicious ones, which undermines the security policy and compliance requirements.

Full explanation →

MCQmedium

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

A.The source and destination zones are misconfigured

B.The rule is disabled

C.The user's IP is in a block list

D.The firewall is in transparent mode

AnswerA

If the rule's source or destination zone does not match the traffic zones, it won't match.

Why this answer

When a firewall logs 'No rule matched' despite a security policy rule existing, the most common cause is a zone mismatch. In Palo Alto Networks firewalls, security rules are evaluated based on source and destination zones; if the rule specifies different zones than the traffic's ingress and egress zones, the rule will not apply, resulting in a deny. Misconfigured zones prevent the rule from being considered, even if all other attributes (IP, port, application) match.

Exam trap

The trap here is that candidates often focus on rule order or IP addresses, overlooking that zone misconfiguration is the primary reason a rule is skipped entirely, as Palo Alto Networks firewalls enforce zone-based policy matching before any other rule attributes are checked.

How to eliminate wrong answers

Option B is wrong because if the rule were disabled, the firewall would still log 'No rule matched' only if no other rule matched, but the question states the rule should match; disabling a rule removes it from evaluation entirely, but the symptom is the same as a zone mismatch, making it less likely given the rule is intended to match. Option C is wrong because a block list (e.g., External Dynamic List or custom block IP) would cause a deny with a different log reason, such as 'Denied by block list' or 'Denied by URL filtering', not 'No rule matched'. Option D is wrong because transparent mode (Layer 2) does not affect security rule matching; the firewall still evaluates rules based on zones (which are configured for virtual wire interfaces), and 'No rule matched' can still occur if zone configuration is incorrect, so transparent mode is not a direct cause.

Full explanation →

Multi-Selecteasy

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Select 2 answers

A.Active/active eliminates the need for failover

B.Active/active requires enabling asymmetric routing support

C.Active/active allows both firewalls to process traffic simultaneously

D.Active/active automatically synchronizes configuration changes

E.Active/active is the default and most commonly deployed mode

AnswersB, C

Needed to handle return traffic on different firewall.

Why this answer

In active/active HA mode, both firewalls can process traffic simultaneously, which requires enabling asymmetric routing support to handle traffic that may arrive at either firewall for the same session. This is necessary because active/active mode does not enforce a single path for traffic, unlike active/passive mode where only one firewall actively processes traffic.

Exam trap

The trap here is that candidates often assume active/active mode eliminates the need for failover or is the default mode, but in reality, failover is still required and active/passive is the default; the key differentiator is the need for asymmetric routing support in active/active mode.

Full explanation →

Multi-Selecthard

Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)

Select 3 answers

A.The server sends a TCP RST packet to the client.

B.The firewall's application override is incorrectly matching the traffic.

C.The session reaches the configured idle timeout.

D.A decryption error occurs during SSL handshake.

E.The firewall runs out of session resources and starts dropping new sessions.

AnswersA, B, D

The firewall records the RST as the session end reason.

Why this answer

A TCP RST packet from the server indicates that the server has abruptly terminated the connection, often due to an application-layer error or a protocol violation. The firewall logs this as 'tcp-rst-from-server' in the session end reason, reflecting that the reset originated from the server side.

Exam trap

The trap here is that candidates may confuse session termination reasons, assuming any abnormal end is due to resource exhaustion or timeouts, but the question specifically targets TCP RST flags, which are tied to endpoint behavior, not firewall resource management.

Full explanation →

Multi-Selecthard

Which TWO conditions can cause an HA pair to enter an 'active/active' state? (Choose two.)

Select 2 answers

A.Loss of HA keepalive on both sides

B.License expiration on one firewall

C.Session synchronization failure

D.Configuration mismatch between peers

E.HA1 link failure

AnswersA, E

If keepalives are lost, each firewall assumes the other is dead and becomes active.

Why this answer

A is correct because when both firewalls lose the HA keepalive (sent over HA1 link), each firewall assumes the peer is dead and transitions to active state to ensure traffic continuity. This is a fail-safe mechanism: without keepalive, each unit independently becomes active, resulting in an active/active condition that can cause duplicate IP addresses and traffic loops.

Exam trap

The trap here is that candidates often think only a complete HA1 link failure (option E) causes active/active, but they overlook that loss of keepalive on both sides (option A) is the underlying mechanism—and both conditions are correct because HA1 link failure directly causes loss of keepalive on both sides.

Full explanation →

MCQhard

A medium-sized enterprise has two Palo Alto Networks PA-5250 firewalls configured in an active/passive HA pair with session synchronization and configuration synchronization enabled. The HA1 link is a direct copper cable, and the HA2 link is also a direct copper cable. The firewalls are connected to two upstream routers (R1 and R2) and two downstream switches (S1 and S2). The network uses OSPF for dynamic routing. The active firewall (FW-A) is connected to R1 and S1, while the passive firewall (FW-P) is connected to R2 and S2. The OSPF cost is set symmetrically on both sides. During a maintenance window, the network team shuts down the HA1 and HA2 links on both firewalls to test failover behavior. After the links are brought back up, the firewalls are in a state of 'non-functional' and 'suspended'. The team suspects the HA configuration is broken. What is the most likely cause and the best course of action to restore HA?

A.Upgrade both firewalls to the same software version and then re-initialize HA

B.Change the HA mode to active/active and enable asymmetric routing

C.Reboot both firewalls after verifying the HA configuration and that the links are operationally up

D.Configure a dedicated management interface for HA1 communication and ensure HA2 is on a different subnet

AnswerC

Rebooting recovers from suspended state; links are up now.

Why this answer

When both HA1 and HA2 links are simultaneously shut down on both firewalls, the active/passive pair loses all communication and session synchronization. Upon restoration, the firewalls enter a 'non-functional' and 'suspended' state because the HA control plane cannot re-establish a quorum or verify the peer's state without a full reset of the HA state machine. Rebooting both firewalls after verifying the HA configuration and that the links are operationally up forces a clean initialization of the HA process, clearing the suspended state and allowing the pair to renegotiate roles correctly.

Exam trap

The trap here is that candidates assume re-establishing the HA links alone will automatically restore the HA pair, but PAN-OS requires a full reboot of both firewalls to clear the suspended state after a simultaneous HA link failure, as the state machine does not have a built-in recovery mechanism for this scenario.

How to eliminate wrong answers

Option A is wrong because upgrading software versions is irrelevant to the immediate issue; the firewalls were already running the same version before the test, and the problem is a state machine lockup, not a version mismatch. Option B is wrong because changing to active/active mode does not resolve a suspended state caused by HA link disruption; it would require a different configuration and does not address the core issue of HA state recovery. Option D is wrong because dedicating a management interface for HA1 or changing subnets does not fix the current suspended state; HA1 and HA2 were already on direct copper cables, and the problem is not about subnet overlap but about the HA process needing a full restart after simultaneous link loss.

Full explanation →

MCQeasy

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

A.Ensure that the administrator account has superuser privileges.

B.Verify that the firewall's PAN-OS version is supported by the Panorama version.

C.Check that the firewall is connected to the internet for cloud services.

D.Review the system logs on the firewall for disk space errors.

AnswerB

Incompatible versions between Panorama and firewalls can cause template validation failures during push.

Why this answer

The 'template validation error' during a commit indicates that the configuration templates being pushed are incompatible with the target firewall's PAN-OS version. Panorama templates may include features or syntax not supported by older firewall versions, causing the validation to fail. Therefore, verifying that the firewall's PAN-OS version is within the supported matrix for the Panorama version is the first logical step.

Exam trap

The trap here is that candidates often assume a 'validation error' is due to permissions or connectivity, but in the context of a Panorama commit, it almost always points to a version mismatch between Panorama and the managed firewall.

How to eliminate wrong answers

Option A is wrong because administrator privileges (superuser or otherwise) do not affect template validation errors; these errors are version-related, not permission-related. Option C is wrong because internet connectivity for cloud services is unrelated to template validation during a commit; cloud services are used for features like threat updates, not configuration pushes. Option D is wrong because disk space errors on the firewall would typically cause commit failures with specific 'disk full' messages, not a generic 'template validation error'; the error points to a version mismatch, not storage issues.

Full explanation →

Multi-Selecteasy

Which three are valid security policy rule actions on a Palo Alto Networks firewall? (Choose three.)

Select 3 answers

A.Deny

B.Log

C.Drop

D.Allow

E.Forward

AnswersA, C, D

Deny drops traffic and can generate logs.

Why this answer

(Deny) is correct because security policy rules on Palo Alto Networks firewalls use 'Deny' as a valid action to silently discard traffic without sending a TCP RST or ICMP unreachable message. This action is used when you want to block traffic while providing no feedback to the sender, which is common for stealth or compliance policies.

Exam trap

The trap here is that candidates often confuse 'Log' as an action because it appears in the rule configuration, but it is merely a log setting, not a traffic disposition action like Allow, Deny, or Drop.

Full explanation →

MCQeasy

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

A.The application 'ssl' is not allowed in any security rule.

B.The session ended with TCP FIN, causing the firewall to deny.

C.The destination IP is blacklisted.

D.The security rule 'default-deny' explicitly blocks this traffic.

AnswerA

The traffic matched the built-in default-deny rule because no user-defined rule allowed the application.

Why this answer

The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Exam trap

The trap here is that candidates assume a port-based rule (e.g., allowing TCP/443) is sufficient, but Palo Alto's App-ID requires the application itself to be explicitly allowed, not just the port.

How to eliminate wrong answers

Option B is wrong because a TCP FIN flag does not cause a firewall to deny traffic; it is part of a normal session teardown and would not result in a deny action. Option C is wrong because there is no indication in the question that the destination IP is blacklisted, and blacklisting is typically done via external feeds or manual entries, not implied by a simple deny. Option D is wrong because while a 'default-deny' rule exists at the end of the rulebase, the question asks for the 'most likely' reason, and the specific denial of SSL traffic points to an application-based restriction rather than a generic catch-all rule.

Full explanation →

MCQhard

An administrator wants to ensure that all traffic from the 'Trust' zone to the 'Untrust' zone is inspected by WildFire. Which configuration is required?

A.Create a separate WildFire rule.

B.Enable WildFire on the security rule.

C.Configure a WildFire profile and attach it to the security rule.

D.Enable WildFire globally under Device > Setup.

AnswerC

A WildFire profile must be added to the security rule's profile section.

Why this answer

WildFire inspection is applied via a security rule using a WildFire Analysis profile. The profile defines the file types and verdict actions (e.g., alert, block) for files submitted to WildFire. Attaching this profile to the security rule that governs Trust-to-Untrust traffic ensures all matching traffic is inspected by WildFire.

Exam trap

The trap here is that candidates confuse WildFire's global registration settings (Device > Setup > WildFire) with the per-rule profile attachment required for actual traffic inspection, leading them to select the global enablement option.

How to eliminate wrong answers

Option A is wrong because WildFire does not use separate rules; it is a profile-based feature attached to security rules. Option B is wrong because there is no toggle to 'enable WildFire on the security rule' directly; you must configure and attach a WildFire Analysis profile. Option D is wrong because WildFire is not enabled globally under Device > Setup; global settings for WildFire are configured under Objects > WildFire Analysis Profiles or Device > WildFire, but the inspection itself requires profile attachment to a security rule.

Full explanation →

MCQhard

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

A.The firewall is using a forward trust certificate that is expired.

B.The decryption policy is not applied to the correct security rule.

C.The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.

D.The decryption policy is set to 'no-decrypt' for the traffic.

AnswerC

Correct. Clients must trust the firewall's issuing CA to avoid certificate warnings.

Why this answer

In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.

Exam trap

The trap here is that candidates often confuse the forward trust certificate (used to sign per-session certificates) with the root CA certificate that must be trusted by clients, leading them to focus on expiration or policy placement rather than the fundamental trust chain requirement.

How to eliminate wrong answers

Option A is wrong because an expired forward trust certificate would cause certificate errors, but the scenario explicitly states the decryption certificate is self-signed, and the most common issue is the missing root CA trust, not an expired leaf certificate. Option B is wrong because the decryption policy is applied to a decryption rule, not a security rule; misapplication to a security rule would not cause certificate errors—it would simply not decrypt traffic. Option D is wrong because a 'no-decrypt' policy would result in no decryption at all, meaning users would see normal HTTPS traffic without certificate errors, not the reported errors.

Full explanation →

MCQmedium

An administrator wants to apply different security policies for different applications that may use the same IP addresses and ports. Which firewall configuration feature should be used?

A.Application Override

B.Quality of Service (QoS) policy

C.Security policy with App-ID

D.Decryption policy

AnswerC

Security rules can match on application identity, allowing per-application policies.

Why this answer

App-ID is the correct feature because it enables the firewall to identify and enforce security policies based on the application, regardless of the IP address or port used. This allows different security policies for different applications even when they share the same IP and port, such as HTTP and FTP both using TCP/80.

Exam trap

The trap here is that candidates may confuse Application Override with App-ID, thinking that manually overriding application classification is the solution, when in fact App-ID automatically identifies applications and allows policy differentiation without manual intervention.

How to eliminate wrong answers

Option A is wrong because Application Override is used to manually classify traffic when App-ID cannot identify it, but it does not enable different policies for different applications on the same IP/port—it simply forces a specific application label. Option B is wrong because Quality of Service (QoS) policy manages bandwidth allocation and prioritization, not security policy differentiation based on application identity. Option D is wrong because Decryption policy controls whether traffic is decrypted for inspection, but it does not directly apply different security policies for different applications using the same IP/port.

Full explanation →

MCQeasy

An administrator notices that URL filtering is not blocking a specific category as configured. What is the first troubleshooting step?

A.Verify the security policy order

B.Review the URL filtering profile

C.Check the URL filtering license

D.Check the PAN-DB version

AnswerA

If a policy with a different URL filtering profile matches first, the configuration may not be applied as intended.

Why this answer

The most common reason URL filtering fails to block a specific category is that a security policy with a lower priority (higher order number) is matching the traffic before the policy with the correct URL filtering profile. Since security policies are evaluated top-down, the first match is applied, and if an earlier policy allows the traffic without URL filtering, the configured block action is never reached. Therefore, verifying the security policy order is the first and most logical troubleshooting step.

Exam trap

Palo Alto Networks often tests the misconception that a misconfigured profile or license is the primary cause, when in reality the issue is almost always policy order and the first-match rule in security policy evaluation.

How to eliminate wrong answers

Option B is wrong because reviewing the URL filtering profile is a secondary step; the profile may be correctly configured but never applied if a higher-priority policy matches first. Option C is wrong because a missing or expired URL filtering license would typically prevent the firewall from performing any URL filtering at all, not cause a specific category to be unblocked while others work. Option D is wrong because checking the PAN-DB version is relevant when categories are missing or outdated, but it does not explain why a configured block action is not being enforced on traffic that is already matching a policy.

Full explanation →

MCQeasy

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

A.Create a new application and define the default port.

B.Create a new application group.

C.Create a new custom application tag.

D.Create a new application filter.

AnswerA

Correct: Creating the application object with its default port is the foundational step.

Why this answer

To create a custom application for a proprietary database protocol using TCP port 7890, the first step is to create a new application and define the default port. In App-ID, custom applications are defined by specifying the application name, the protocol (TCP/UDP), and the default port number, which allows the firewall to identify traffic for that application based on the port. This is the foundational step before any additional properties like timeouts or advanced settings can be configured.

Exam trap

The trap here is that candidates often confuse the order of operations and think they need to first create an application group or tag to organize the custom application, but the actual first step is always to create the application object itself with its default port.

How to eliminate wrong answers

Option B is wrong because an application group is used to logically group multiple applications for policy enforcement, not to define a new application or its port. Option C is wrong because a custom application tag is a label for organizing applications, not a method to define the application itself or its port. Option D is wrong because an application filter is used to select applications based on predefined criteria (e.g., category, technology), not to create a new application with a specific port.

Full explanation →

MCQmedium

Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?

A.The identity provider's metadata must be imported into the firewall.

B.A certificate from a public CA for the SAML identity provider.

C.The firewall must be configured as a SAML identity provider.

D.User-ID must be configured to poll the SAML identity provider.

AnswerA

The metadata includes the IdP's public key, endpoints, and binding information needed for SAML communication.

Why this answer

For SAML-based single sign-on (SSO) with a Palo Alto Networks firewall acting as the service provider (SP), the firewall must trust the identity provider (IdP). This trust is established by importing the IdP's SAML metadata (which includes the IdP's entity ID, single sign-on URL, and signing certificate) into the firewall. Without this metadata, the firewall cannot validate SAML assertions from the IdP, making authentication impossible.

Exam trap

The trap here is that candidates often assume a public CA certificate is required for SAML trust (Option B), but in reality, SAML uses a direct trust model where the SP explicitly trusts the IdP's self-signed certificate via metadata import, not through a public PKI hierarchy.

How to eliminate wrong answers

Option B is wrong because the certificate used for SAML signing by the IdP does not need to come from a public CA; it can be a self-signed certificate, as the trust is established via the metadata import, not via a public CA chain. Option C is wrong because the firewall is acting as the service provider (SP), not the identity provider (IdP); configuring it as an IdP would be for scenarios where the firewall itself authenticates users, not for SP-initiated SSO. Option D is wrong because User-ID does not need to poll the SAML IdP; SAML SSO provides user identity information directly in the SAML assertion, which the firewall can use to map to a User-ID without polling.

Full explanation →

MCQhard

During a network incident, an engineer notices that after an HA failover, some sessions are not active on the new active firewall. The 'show session all' command shows the sessions with state 'half-closed'. What is the most likely cause?

A.The firewall failed to properly synchronize the TCP sessions before the failover

B.The HA2 link failover timer is set too low

C.The ARP timeout on the next-hop router is too short

D.Asymmetric routing is causing the firewall to see only one direction of traffic

AnswerA

Incomplete sync leads to half-closed sessions.

Why this answer

The 'half-closed' session state indicates that the firewall has only one side of the TCP handshake (FIN or RST) recorded, which typically occurs when session synchronization fails during an HA failover. In an active/passive HA pair, TCP session state information is synchronized via the HA2 link; if synchronization is incomplete or interrupted before the failover, the new active firewall will have partial session data, leading to half-closed sessions. This is a common symptom of a synchronization failure, not a timeout or routing issue.

Exam trap

The trap here is that candidates confuse 'half-closed' with 'incomplete' or 'asymmetric routing' symptoms, but 'half-closed' specifically indicates a TCP state where one side has initiated closure, which in an HA context points to incomplete session synchronization rather than a routing or ARP issue.

How to eliminate wrong answers

Option B is wrong because the HA2 link failover timer controls how quickly the passive firewall detects a failure of the active firewall, not the synchronization of session states; a low timer might cause premature failover but does not directly cause half-closed sessions. Option C is wrong because the ARP timeout on the next-hop router affects layer 2 reachability and could cause traffic black-holing after failover, but it does not impact the TCP session state stored on the firewall; half-closed sessions are a session table issue, not an ARP issue. Option D is wrong because asymmetric routing would cause the firewall to see only one direction of traffic, leading to sessions in a 'half-baked' or 'incomplete' state (not 'half-closed'), and it is not directly related to HA failover synchronization; asymmetric routing is a network design problem, not a post-failover session state issue.

Full explanation →

MCQeasy

When configuring an authentication policy, which match criteria is required to trigger authentication?

A.Application must be 'web-browsing'.

B.Destination address must be the server IP.

C.Source user must be set to 'any'.

D.Source zone must be specified.

AnswerD

Source zone is a required parameter in authentication policy to define the inbound traffic zone.

Why this answer

In a PAN-OS authentication policy, the source zone is a required match criterion because the firewall must know which ingress zone the traffic is coming from to apply the correct authentication profile and enforce the policy. Without a specified source zone, the policy cannot be evaluated, as zone-based forwarding is fundamental to how the firewall processes traffic. This ensures that authentication is triggered only for traffic entering through a designated zone, such as an untrust or internal zone.

Exam trap

The trap here is that candidates often assume the source user must be 'any' to match all users, but the correct required match is the source zone, as authentication policies are zone-based and the source user field is typically left as 'unknown' to trigger authentication for unauthenticated traffic.

How to eliminate wrong answers

Option A is wrong because the application 'web-browsing' is not a required match criterion; authentication policies can be triggered for various applications, and the policy matches traffic based on zone, user, and destination, not a specific application. Option B is wrong because the destination address is optional; while you can specify a server IP to narrow the scope, authentication can be triggered without it, and the policy can match any destination. Option C is wrong because source user set to 'any' is not required; in fact, authentication policies are designed to match unauthenticated users (source user 'unknown') to trigger authentication, and setting it to 'any' would include already-authenticated users, defeating the purpose.

Full explanation →

MCQeasy

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

A.Link failure

B.Active/Active

C.Passive/Passive

D.Split brain

AnswerD

Correct. When both firewalls in an active/passive pair show active due to loss of heartbeat, this is called split brain.

Why this answer

In a Palo Alto Networks active/passive HA configuration, if the heartbeat fails, both firewalls assume the other is down and both transition to 'active' state. This unintended condition is called split brain. It is not a valid configuration like Active/Active, which is intentionally configured and requires separate virtual routers or security zones.

Exam trap

The trap is that candidates may think both firewalls being active indicates Active/Active mode, but in an active/passive pair, this is a split-brain failure condition.

How to eliminate wrong answers

Option A is wrong because a link failure is a potential cause of split brain, not the condition itself. Option C is wrong because passive/passive is not a valid HA state in Palo Alto Networks firewalls; the supported modes are active/passive and active/active (for specific use cases). Option D is wrong because split brain is the correct term for both firewalls being active simultaneously, not a separate option.

Full explanation →

MCQhard

You are a network security engineer for a multinational corporation with users in different regions. The company uses GlobalProtect for remote access and requires multi-factor authentication (MFA) using a mobile app for all users. Recently, users in the Asia-Pacific region have reported intermittent failures when authenticating via GlobalProtect. The symptoms include: after entering credentials on the GlobalProtect portal, the authentication challenge from the MFA provider times out after 30 seconds, and the user is disconnected. Users in other regions do not experience this issue. The GlobalProtect gateways and portals are configured with Authentication Profile that uses an LDAP server for primary authentication and an MFA vendor as authentication sequence. The MFA provider sends push notifications to users' mobile devices. The firewall logs show no errors related to LDAP or MFA, but the GlobalProtect logs indicate authentication timeouts. The firewall is located in the central data center, and the MFA provider's servers are in the United States. What should you do to resolve this issue?

A.Change the authentication sequence to use a shorter MFA method like SMS instead of push notifications.

B.Disable MFA for the Asia-Pacific region users temporarily until the MFA provider improves their latency.

C.Increase the authentication timeout in the GlobalProtect portal and gateway configuration from 30 seconds to 60 seconds.

D.Deploy a secondary MFA server instance in the Asia-Pacific region to reduce latency.

AnswerC

Increasing the timeout accommodates the higher latency for users in Asia-Pacific, allowing the MFA push to complete.

Why this answer

The authentication timeout in the GlobalProtect portal and gateway configuration defaults to 30 seconds, which is insufficient when high latency exists between the firewall (central data center) and the MFA provider's servers (United States). Users in the Asia-Pacific region experience additional network latency, causing the MFA push notification challenge to exceed the 30-second timeout. Increasing the timeout to 60 seconds accommodates this latency without altering the authentication method or requiring additional infrastructure.

Exam trap

The trap here is that candidates often assume the issue is with the MFA method or provider latency, leading them to choose option A or D, when in fact the problem is a misconfigured timeout value that is easily adjustable within the GlobalProtect portal and gateway settings.

How to eliminate wrong answers

Option A is wrong because changing from push notifications to SMS does not address the root cause—latency-induced timeout; SMS may actually introduce additional delays due to carrier routing and is less secure. Option B is wrong because disabling MFA for a region violates security policy and leaves those users vulnerable; it is a temporary workaround that does not solve the underlying latency issue. Option D is wrong because deploying a secondary MFA server instance in the Asia-Pacific region is an expensive and complex solution that is unnecessary when simply increasing the authentication timeout resolves the problem, and the MFA provider's servers are not under the company's control.

Full explanation →

MCQmedium

A network engineer configures an IPSec tunnel with multiple proxy IDs for different subnets. After committing, only one proxy ID establishes IPsec SAs. What should the engineer check?

A.The number of concurrent tunnels allowed.

B.The IPSec crypto profile.

C.The IKE gateway mode.

D.The tunnel monitor settings.

AnswerA

Correct. The firewall may limit concurrent SAs per gateway.

Why this answer

Palo Alto Networks firewalls have a default limit on the number of concurrent IPsec tunnels. When multiple proxy IDs are configured, each proxy ID requires its own IPsec security association (SA). If the tunnel limit is reached, only the first proxy ID establishes SAs, and subsequent ones fail.

Checking and increasing the 'Number of Tunnels' setting under the tunnel interface or global IPSec configuration resolves this.

Exam trap

The trap here is that candidates often assume the issue is with crypto profile mismatches or IKE gateway settings, but Palo Alto specifically tests the knowledge that each proxy ID consumes a separate tunnel slot, and the tunnel count limit is a common misconfiguration that causes only one proxy ID to work.

How to eliminate wrong answers

Option B is wrong because the IPSec crypto profile defines encryption, authentication, and DH group parameters for the SA, but it does not control how many SAs can be established per tunnel; a misconfigured crypto profile would cause all proxy IDs to fail, not just one. Option C is wrong because the IKE gateway mode (main or aggressive) affects Phase 1 negotiation but does not limit the number of Phase 2 SAs; all proxy IDs use the same IKE SA. Option D is wrong because tunnel monitor settings control path monitoring and failover, not the establishment of multiple SAs; they would not prevent additional proxy IDs from forming SAs.

Full explanation →

MCQhard

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

A.The firewall will automatically redistribute the route to VR-B if needed.

B.The firewall will perform a reverse path forwarding (RPF) check on the source IP.

C.The packet will be dropped because the destination is not in the same VR as the ingress interface.

D.The firewall will use the zone of the egress interface to determine the security policy.

AnswerB

RPF ensures the source IP is reachable via the incoming interface; if not, the packet may be dropped.

Why this answer

When a packet enters a Palo Alto Networks firewall, after a successful route lookup, the firewall performs an RPF check on the source IP address to ensure that the source is reachable via the ingress interface. This is a fundamental security mechanism to prevent spoofed traffic. Since the ingress interface is in VR-A and the route lookup succeeded, the RPF check verifies that the source IP of the packet is reachable through that same interface; if not, the packet is dropped.

Exam trap

The trap here is that candidates often assume the packet will be dropped because the destination is in a different VR (Option C), but they overlook that the route lookup succeeded in the ingress VR, meaning the egress interface is within the same VR, and the real security mechanism is the RPF check on the source IP.

How to eliminate wrong answers

Option A is wrong because Palo Alto Networks firewalls do not automatically redistribute routes between virtual routers; redistribution must be explicitly configured using route redistribution policies or a shared virtual router. Option C is wrong because the packet is not dropped due to the destination being in a different VR; the route lookup succeeded in VR-A, meaning the destination is reachable within VR-A, and the egress interface could be in the same VR. Option D is wrong because the security policy lookup uses the zone of the ingress interface (trust), not the egress interface; the egress interface's zone is irrelevant for policy matching.

Full explanation →

Matchingmedium

Match each Palo Alto Networks product to its primary use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Next-generation firewall for enterprise

Virtual firewall for cloud environments

Container firewall for Kubernetes

Cloud-delivered security for remote users

Extended detection and response for endpoints

Why these pairings

The correct matches are: NGFW for network security, Panorama for central management, Cortex XDR for endpoint detection, and Prisma Cloud for cloud security. Common confusions include mistaking Panorama's management role for NGFW or assigning cloud security to Cortex XDR.

Full explanation →

100

MCQmedium

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

A.Increase the HA keepalive failover threshold to tolerate temporary packet loss

B.Decrease the HA1 hello interval

C.Enable link monitoring on all interfaces

D.Increase the session synchronization rate

AnswerA

Higher threshold allows brief outage without triggering failover.

Why this answer

Increasing the HA keepalive failover threshold allows the firewalls to tolerate a brief network outage without triggering a split-brain scenario. By requiring more missed heartbeats before declaring the peer dead, the firewalls avoid both becoming active simultaneously due to transient packet loss. This directly addresses the root cause—premature failover during temporary connectivity issues.

Exam trap

The trap here is that candidates often confuse increasing the failover threshold with making HA less reliable, when in fact it adds tolerance to temporary network blips, preventing the split-brain condition that occurs when both firewalls assume the other is dead.

How to eliminate wrong answers

Option B is wrong because decreasing the HA1 hello interval would make the firewalls send heartbeats more frequently, increasing sensitivity to packet loss and making split-brain more likely, not less. Option C is wrong because enabling link monitoring on all interfaces monitors physical link status, not HA keepalive failures; it would not prevent split-brain caused by a brief network outage that does not bring down interfaces. Option D is wrong because increasing the session synchronization rate affects how quickly session tables are synced between peers, not the detection of peer failure or split-brain prevention.

Full explanation →

101

Multi-Selecthard

Which TWO of the following are valid considerations when designing an SSL Forward Proxy decryption deployment in a Palo Alto Networks firewall?

Select 2 answers

A.Decryption is applied globally to all traffic; selective decryption is not possible.

B.The firewall can decrypt all TLS sessions regardless of client certificate authentication.

C.When deploying SSL Forward Proxy, the firewall must generate a certificate for each decrypted session to re-encrypt traffic to the client.

D.Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

E.The firewall uses a decryption policy to determine which traffic to decrypt.

AnswersC, E

The firewall acts as a proxy, generating a certificate signed by a trusted CA to re-encrypt traffic to the client.

Why this answer

In an SSL Forward Proxy deployment, the firewall acts as a man-in-the-middle: it terminates the client's TLS connection, inspects the decrypted traffic, and then initiates a new TLS connection to the server. To re-encrypt the traffic back to the client, the firewall must dynamically generate a certificate for each session, signed by a trusted CA certificate installed on the client devices. This ensures the client sees a valid certificate chain and does not generate a certificate warning.

Exam trap

The trap here is that candidates often assume SSL Forward Proxy can decrypt all TLS traffic, including sessions with client certificate authentication, but the firewall cannot possess the client's private key and thus must skip decryption for such sessions.

Full explanation →

102

MCQmedium

A remote user reports they cannot connect to the corporate network via GlobalProtect. The GlobalProtect client shows 'Connection failed. Unable to establish a secure connection.' The portal and gateway are configured with certificate authentication. The administrator verifies that the portal/gateway certificates are valid and not expired, and the common name matches the portal's FQDN. The client's machine time is synchronized. Which configuration misconfiguration is most likely the cause?

A.The client's GlobalProtect app is an older version that does not support TLS 1.2.

B.The gateway authentication profile is set to use RADIUS instead of certificate.

C.The portal is configured with an incorrect server certificate common name (CN) that does not match the portal's FQDN.

D.The GlobalProtect gateway is configured to require HIP match, but the user's endpoint does not meet the HIP profile.

AnswerA

An older client may not support TLS 1.2, causing the connection to fail if the gateway requires it.

Why this answer

The error 'Unable to establish a secure connection' indicates a TLS handshake failure. If the GlobalProtect client is an older version that does not support TLS 1.2, but the portal/gateway requires TLS 1.2 (as is common in modern PAN-OS configurations), the handshake will fail even though certificates are valid and time is synchronized. This is a classic version incompatibility issue where the client cannot negotiate a mutually supported TLS protocol version.

Exam trap

The trap here is that candidates often focus on certificate validity or time synchronization, but the real issue is a TLS protocol version mismatch caused by an outdated client, which is a common oversight in PAN-OS environments where TLS 1.2 is enforced.

How to eliminate wrong answers

Option B is wrong because the gateway authentication profile being set to RADIUS instead of certificate would cause authentication failure, not a TLS handshake failure; the error message specifically indicates a secure connection (TLS) issue, not an authentication rejection. Option C is wrong because the administrator has already verified that the common name matches the portal's FQDN, so this misconfiguration is ruled out by the question's premise. Option D is wrong because a HIP mismatch would result in the client being denied access after the tunnel is established, not a failure to establish a secure connection; the error occurs before any HIP check can occur.

Full explanation →

103

MCQmedium

An organization runs a pair of Palo Alto Networks firewalls in an active/passive HA configuration. During a maintenance window, the active firewall experiences a link down event on one of its data interfaces. The passive firewall does not assume the active role. What is the most likely reason?

A.HA is configured in active/active mode, which does not support failover on link failure.

B.The passive firewall has lost its heartbeat connection to the active firewall.

C.The active firewall has a higher priority value.

D.Path monitoring is not configured on the interfaces.

AnswerD

Correct. Path monitoring monitors the status of data interfaces and triggers failover on link loss.

Why this answer

In an active/passive HA configuration, a link down event on a data interface does not automatically trigger a failover unless path monitoring is configured. Path monitoring allows the firewall to monitor the link state of specific data interfaces and initiate a failover when those interfaces go down. Without path monitoring, the passive firewall remains passive because it only monitors the HA heartbeat and the active firewall's health via the control link, not the data plane link state.

Exam trap

The trap here is that candidates often assume any link failure on a data interface will automatically trigger an HA failover, but Palo Alto Networks firewalls require explicit path monitoring configuration to initiate failover based on data plane link state.

How to eliminate wrong answers

Option A is wrong because the scenario explicitly states active/passive HA, not active/active, and even in active/active mode, failover on link failure can occur if path monitoring is configured. Option B is wrong because if the passive firewall had lost its heartbeat connection, it would assume the active role (due to loss of hello messages) or enter a non-functional state, not remain passive. Option C is wrong because a higher priority value on the active firewall makes it more likely to be active, but it does not prevent failover when a link down event occurs; priority determines which firewall becomes active during initial election or when both are healthy, not whether failover happens on a link failure.

Full explanation →

104

Multi-Selecteasy

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Select 2 answers

A.The client certificate must be issued by a CA trusted by the firewall.

B.The GlobalProtect portal must have a certificate for SSL.

C.The user's browser must have the firewall's root CA certificate.

D.The firewall must have the client certificate's public key.

E.The client must have a valid username and password.

AnswersA, B

Correct. The firewall trusts the CA to validate the client certificate.

Why this answer

Certificate authentication requires the firewall to validate the client certificate against a trusted Certificate Authority (CA). The firewall maintains a list of trusted CA certificates; if the client certificate is not signed by one of these CAs, the authentication fails. This ensures the client certificate is genuine and issued by an authority the firewall trusts.

Exam trap

The trap here is that candidates often confuse certificate authentication with SSL/TLS certificate validation for the portal/gateway, thinking the client needs the firewall's root CA, or they mistakenly believe the firewall must store the client's public key, when in fact it only needs the CA's public key to verify the certificate signature.

Full explanation →

105

MCQhard

Refer to the exhibit. A user at 10.1.1.100 reports that they cannot access a website at 10.2.2.200 over HTTPS. The firewall shows the session is allowed with application web-browsing, but the security policy rule "Allow-Web" has application set to ssl. What is the most likely cause?

A.The application override is configured incorrectly.

B.The security policy rule order is incorrect.

C.The SSL decryption policy is not configured.

D.The service is set to application-default.

AnswerC

Without decryption, App-ID sees only the SSL handshake and identifies the traffic as web-browsing on port 443, not as the more specific ssl application.

Why this answer

The session is allowed with application web-browsing, but the security policy rule 'Allow-Web' has application set to ssl. This indicates that the firewall is not decrypting the HTTPS traffic, so App-ID sees only the encrypted TCP handshake and incorrectly identifies it as web-browsing (HTTP) rather than ssl (HTTPS). Without an SSL decryption policy to decrypt the traffic, App-ID cannot inspect the encrypted payload to correctly identify the application as ssl, causing a mismatch between the policy rule's application requirement and the session's identified application.

Exam trap

Palo Alto Networks often tests the misconception that a security policy rule with application set to ssl will automatically match HTTPS traffic, but without SSL decryption, App-ID cannot identify the application as ssl, causing the rule to not apply.

How to eliminate wrong answers

Option A is wrong because an application override would force the application to a specific value regardless of App-ID, but the session shows web-browsing, not ssl, indicating no override is in effect. Option B is wrong because the security policy rule order is irrelevant when the session is allowed by the rule 'Allow-Web' — the issue is that the rule's application condition (ssl) is not met, not that a different rule is matching first. Option D is wrong because the service set to application-default is not the cause; the service (TCP/443) is correctly matched, but the application identification (web-browsing vs. ssl) is the problem, and application-default does not affect App-ID's ability to identify the application.

Full explanation →

106

MCQeasy

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

A.Drop.

B.Reset-both.

C.Allow with antivirus profile.

D.Deny.

AnswerD

Correct: Deny blocks the traffic and sends a TCP reset.

Why this answer

The standard action to block traffic in a security policy rule is 'deny'. 'Drop' also blocks but does not send a TCP reset, while 'deny' sends a reset. 'Allow' would permit the traffic, and 'reset-both' is a type of deny, but 'deny' is the typical best practice.

Full explanation →

107

MCQmedium

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

A.The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

B.The authentication sequence should be reversed to 'LDAP, PingID'.

C.The PingID server certificate is not trusted; import the CA certificate.

D.The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.

AnswerD

Correct: If PingID allows fallback, the firewall will proceed to LDAP without MFA.

Why this answer

The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Exam trap

The trap here is that candidates assume MFA bypass is always due to firewall misconfiguration (like sequence order or certificate issues), when in reality the PingID agent's fallback behavior can silently skip MFA even when the firewall and network connectivity are correctly configured.

How to eliminate wrong answers

Option A is wrong because the authentication policy action 'require MFA' is not a valid setting; authentication policies use actions like 'allow' or 'deny', and MFA enforcement is controlled by the authentication profile's sequence, not a policy-level MFA toggle. Option B is wrong because reversing the sequence to 'LDAP, PingID' would cause LDAP to be attempted first, and if successful, the firewall would not proceed to PingID MFA, which would still bypass MFA; the correct sequence is 'PingID, LDAP' to ensure MFA is attempted before LDAP fallback. Option C is wrong because the PingID server certificate trust issue would cause a certificate validation error, not a silent skip of MFA; the firewall would log an authentication failure or error, not a successful LDAP-only authentication.

Full explanation →

108

MCQeasy

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

A.DNS resolution failure

B.Asymmetric routing

C.Security policy configured with service 'any'

D.Incomplete TCP three-way handshake

AnswerB

Asymmetric routing causes the firewall to see packets that don't match existing sessions, leading to drops or session re-creation.

Why this answer

Asymmetric routing causes the firewall to see only one direction of a TCP session, leading to session timeouts despite active session entries. When traffic from the client to the database server traverses one firewall and return traffic takes a different path, the firewall cannot properly track the TCP state, resulting in dropped packets and intermittent connectivity.

Exam trap

The trap here is that candidates see 'active sessions' in the table and assume the firewall is working correctly, overlooking that asymmetric routing can leave stale entries while actual data flow is disrupted.

How to eliminate wrong answers

Option A is wrong because DNS resolution failure would prevent the initial connection entirely, not cause intermittent timeouts with active sessions in the table. Option C is wrong because a security policy with service 'any' would allow all traffic, not cause timeouts; it might increase security risk but does not disrupt established sessions. Option D is wrong because an incomplete TCP three-way handshake would prevent session establishment, not cause intermittent timeouts after sessions are already active in the table.

Full explanation →

109

MCQhard

A firewall in a high-availability pair shows that App-ID signatures are not syncing between units. Sessions are failing over but application identification is incorrect on the passive unit. What should the administrator verify?

A.Ensure both units have the same App-ID license installed.

B.Configure session distribution for symmetric return.

C.Verify that application override policies are replicated via HA configuration sync.

D.Check that sessions are established on both units.

AnswerA

Correct. The App-ID license is required to receive App-ID signatures. If the passive unit lacks this license, it won't have the same signatures as the active unit, leading to incorrect App-ID after failover.

Why this answer

App-ID signatures are part of the content (App-ID and threat) updates, which require the App-ID license. If both units do not have the same App-ID license installed, the passive unit may lack the necessary signatures, causing incorrect application identification after failover. Verifying that both units have the same license ensures they are eligible to receive the same content updates.

Exam trap

Candidates often confuse application override policies (configuration) with App-ID signature updates (content). The question specifically states 'App-ID signatures are not syncing,' which points to content synchronization and licensing, not configuration replication.

How to eliminate wrong answers

Option A is wrong because App-ID signatures are not tied to a separate license; they are included in the Threat Prevention subscription or the base URL filtering license, and both units must have the same set of content updates (e.g., via dynamic updates), not a specific App-ID license. Option B is wrong because session distribution for symmetric return is a feature for active/active HA or asymmetric routing, not related to App-ID signature sync between HA units. Option D is wrong because sessions failing over correctly indicates that session establishment is working; the issue is specifically with App-ID signature synchronization, not session state.

Full explanation →

110

MCQeasy

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

A.Configure decryption settings per interface to distribute load.

B.Disable SSL decryption entirely to avoid performance issues.

C.Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.

D.Enable decryption on all traffic to ensure complete visibility.

AnswerC

Reduces decryption overhead while maintaining security for risky traffic.

Why this answer

Creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Exam trap

The trap here is that candidates may think distributing decryption per interface (Option A) is a valid load-balancing technique, but Palo Alto Networks firewalls do not support interface-level decryption configuration, and the correct approach is to use exclusion rules to selectively bypass decryption for low-risk traffic.

How to eliminate wrong answers

Option A is wrong because decryption settings are not configured per interface to distribute load; SSL decryption is applied globally via decryption policies, and load distribution is handled by the firewall's hardware architecture, not interface-level settings. Option B is wrong because disabling SSL decryption entirely eliminates visibility into encrypted threats, which defeats the purpose of a security firewall and is not a best practice for minimizing performance impact while maintaining security. Option D is wrong because enabling decryption on all traffic would cause unnecessary performance degradation and latency, especially for high-volume, low-risk traffic that does not require inspection, violating the principle of selective decryption.

Full explanation →

111

Multi-Selecthard

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Select 3 answers

A.SSL decryption is not enabled.

B.The application signature is outdated.

C.The custom application uses a non-standard port.

D.Application Override policy is incorrectly configured.

E.The firewall is in tap mode.

AnswersB, C, D

An outdated signature may not recognize the custom application.

Why this answer

If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Exam trap

The trap here is that candidates may assume SSL decryption is always needed for application identification, but App-ID can identify many applications without decryption using techniques like TLS fingerprinting and SNI inspection.

Full explanation →

112

Multi-Selecteasy

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Select 2 answers

A.GlobalProtect client package assigned to macOS

B.Enable Automatic Tunnel

C.Gateway IP Pool configured

D.PanGPS (Pan GlobalProtect Service) enabled

E.Specify a Tunnel Interface

AnswersB, E

This setting must be enabled in the portal to allow automatic tunnel configuration.

Why this answer

Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients.

Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Full explanation →

113

MCQmedium

A company wants to forward logs from a firewall to a SIEM system with high reliability. Which log forwarding method ensures that logs are not lost if the SIEM is temporarily unreachable?

A.Email (SMTP) for each log.

B.Syslog over TCP with buffering enabled in the log forwarding profile.

C.Syslog over UDP with a log forwarding profile.

D.Syslog over SSL without optional buffering.

AnswerB

TCP provides reliable delivery, and buffering prevents loss during downtime.

Why this answer

Syslog over TCP with buffering enabled in the log forwarding profile ensures reliable delivery because TCP provides acknowledgment and retransmission of lost segments, while the buffering mechanism stores logs locally on the firewall when the SIEM is unreachable and retransmits them once connectivity is restored. This combination prevents log loss during temporary network or SIEM outages.

Exam trap

The trap here is that candidates often assume Syslog over TCP alone guarantees delivery, but without buffering enabled in the log forwarding profile, the firewall will drop logs if the TCP connection fails, making buffering the key differentiator for reliability.

How to eliminate wrong answers

Option A is wrong because email (SMTP) is not designed for high-volume, real-time log forwarding and can easily fail or queue indefinitely without reliable retransmission guarantees. Option C is wrong because Syslog over UDP is connectionless and inherently unreliable; logs are silently dropped if the SIEM is unreachable, with no buffering or retransmission. Option D is wrong because Syslog over SSL without optional buffering provides encryption but no local storage or retransmission mechanism; if the SIEM is unreachable, the TCP connection fails and logs are lost without buffering.

Full explanation →

114

MCQeasy

An administrator needs to generate a report showing all traffic denied by the firewall over the past week. Which type of report in the firewall web interface should be used?

A.Application Report

B.Threat Report

C.URL Filtering Report

D.Traffic Report

AnswerD

Traffic Report allows filtering by action (allow/deny) to show denied traffic.

Why this answer

The Traffic Report is the correct choice because it provides detailed logs of all traffic passing through the firewall, including both allowed and denied sessions. By filtering the report to show only denied traffic over the past week, the administrator can generate the exact report needed. Other report types focus on specific categories like applications, threats, or URLs, not general traffic denials.

Exam trap

The trap here is that candidates confuse 'denied traffic' with specific security features like threat prevention or URL filtering, but the Traffic Report is the only one that captures all policy-based denials regardless of the application or threat involved.

How to eliminate wrong answers

Option A is wrong because the Application Report focuses on application usage and bandwidth consumption, not on traffic that was denied by security policies. Option B is wrong because the Threat Report logs only traffic that triggered threat prevention signatures (e.g., exploits, malware), not all denied traffic (e.g., policy denials without threats). Option C is wrong because the URL Filtering Report logs only web traffic that was allowed or blocked based on URL categories, not all denied traffic (e.g., non-web traffic or policy-based denials).

Full explanation →

115

MCQhard

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

A.The route lookup for the destination requires a larger MTU.

B.The firewall is not performing TCP MSS clamping on the traffic.

C.The firewall is using jumbo frames on the internal interface.

D.The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.

AnswerD

Encapsulation adds headers; if the original packet is near MTU, the encapsulated packet exceeds it.

Why this answer

When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Exam trap

The trap here is that candidates assume the firewall drops the packet before encapsulation because the original packet matches the MTU, but the drop occurs after encapsulation adds overhead, making the final frame too large.

How to eliminate wrong answers

Option A is wrong because the route lookup determines the next hop and outgoing interface, but it does not change the packet size; a larger MTU on the route would not cause a drop of a 1500-byte packet on a 1500-MTU interface. Option B is wrong because TCP MSS clamping reduces the TCP segment size to avoid fragmentation, but the drop occurs after routing/encapsulation, and MSS clamping would not prevent the encapsulation overhead from exceeding the MTU. Option C is wrong because jumbo frames (typically >9000 bytes) on an internal interface would allow larger packets, not cause drops; the issue is on the egress interface where the MTU is 1500.

Full explanation →

116

Drag & Dropmedium

Arrange the steps to deploy a new Panorama template to a managed firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for deploying a new Panorama template to a managed firewall is: first, create the template; second, add configuration objects such as interfaces and zones; third, assign the template to the relevant device group; and finally, commit the template to push the configuration to the managed firewalls. This order ensures that the template exists, contains the desired settings, is linked to the correct devices, and is then applied.

Full explanation →

117

MCQeasy

A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?

A.Create a security policy to allow RADIUS traffic from the firewall to the RADIUS server.

B.Enable MFA in the User-ID agent configuration.

C.Create an authentication profile using RADIUS with MFA enabled and assign it to the admin accounts.

D.Configure an authentication enforcement rule in the authentication policy.

AnswerC

The authentication profile defines how the firewall authenticates users. By using RADIUS with MFA, the firewall will prompt for the second factor.

Why this answer

To enforce MFA for administrative access using a RADIUS server with MFA capability, you must create an authentication profile that specifies RADIUS as the authentication method with MFA enabled. This authentication profile is then assigned to each admin account or to the admin role. Option A is incorrect because a security policy is not required for the firewall to communicate with the RADIUS server; the firewall's management interface initiates outbound RADIUS traffic, which is typically allowed by default.

Option B is incorrect because User-ID agent configuration is for user mapping, not admin authentication. Option D is incorrect because authentication enforcement rules are for end-user traffic, not administrative access.

Full explanation →

118

MCQmedium

An engineer notices a decrease in network performance and wants to verify if a specific security policy is being triggered frequently. Which CLI command will show the hit count for a specific policy?

A.show security-rulebase

B.show rule-usage

C.show running security-policy hit-count

D.show running security-policy

AnswerC

This shows hit counts for all security policies, and can be filtered to a specific rule.

Why this answer

The 'show running security-policy hit-count' command displays the hit count for each security policy rule, allowing the engineer to identify which specific policy is being triggered frequently. This command directly shows the number of times a rule has matched traffic, which is essential for diagnosing performance issues related to policy usage.

Exam trap

The trap here is that candidates may confuse 'show running security-policy' (which shows configuration) with 'show running security-policy hit-count' (which shows usage statistics), or they may incorrectly recall non-existent commands like 'show rule-usage' from other vendors.

How to eliminate wrong answers

Option A is wrong because 'show security-rulebase' is not a valid CLI command on Palo Alto Networks firewalls; the correct command to view the rulebase is 'show running security-policy'. Option B is wrong because 'show rule-usage' is not a valid command; the correct command to view rule usage statistics is 'show running security-policy hit-count'. Option D is wrong because 'show running security-policy' displays the current security policy configuration but does not include hit counts, so it cannot show how frequently a policy is triggered.

Full explanation →

119

MCQeasy

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

A.The configuration sync operation has failed

B.One firewall is not running

C.HA1 link failure between 10.1.1.1 and 10.1.1.2

D.The configuration on the two firewalls is not identical

AnswerD

Configuration mismatch directly causes non-functional state.

Why this answer

The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Exam trap

The trap here is that candidates often confuse 'non-functional' with a link failure or peer down state, but the 'non-functional' state is uniquely tied to configuration synchronization issues, not connectivity or hardware failures.

How to eliminate wrong answers

Option A is wrong because a configuration sync operation failure is a symptom, not the primary cause; the root cause is the configuration mismatch itself. Option B is wrong because if one firewall were not running, the HA state would show 'down' or 'disconnected', not 'non-functional'. Option C is wrong because an HA1 link failure would result in a 'suspended' or 'down' state for the HA link, not a 'non-functional' state for the HA pair; the HA pair can still be functional with a single HA link if HA2 is available.

Full explanation →

120

MCQhard

A company has deployed a Palo Alto Networks firewall in an active/passive high-availability (HA) pair. The firewall uses BGP for dynamic routing with two upstream ISPs to provide load-balanced internet connectivity. After an HA failover event, the network team notices that outbound traffic from internal hosts is now using only one of the two ISPs, even though BGP sessions are established on both firewalls and the passive firewall has learned the same routes as the active one. The security policy permits all outbound traffic. No changes were made to the BGP configuration. Which of the following is the most likely cause of this behavior, and what is the appropriate solution?

A.The firewall's asymmetric routing detection is dropping traffic; disable asymmetric routing enforcement.

B.The HA configuration has ECMP disabled; enable ECMP in the dataplane settings on the active firewall.

C.The BGP configuration on the passive firewall is not identical to the active one; apply the same BGP configuration to both.

D.The passive firewall is not advertising routes to the ISPs because HA state synchronization is not enabled; enable state synchronization.

AnswerB

ECMP allows the firewall to use multiple equal-cost routes for load balancing; it must be enabled.

Why this answer

B is correct because in an active/passive HA pair, ECMP (Equal-Cost Multi-Path) is disabled by default on the dataplane. Even though BGP sessions are established and routes are learned, the active firewall will only install a single best path per prefix unless ECMP is explicitly enabled in the dataplane settings. This causes outbound traffic to use only one ISP after failover, as the firewall is not load-balancing across the two equal-cost BGP routes.

Exam trap

The trap here is that candidates assume BGP sessions being established and routes being learned automatically results in load balancing, but PAN-OS requires explicit ECMP enablement in the dataplane to use multiple equal-cost paths for forwarding.

How to eliminate wrong answers

Option A is wrong because asymmetric routing detection is a feature that drops traffic when packets arrive on an interface different from the one they exited, but it does not cause the firewall to use only one ISP path; the issue is about route selection, not asymmetric flow. Option C is wrong because the BGP configuration on the passive firewall does not need to be identical to the active one in an active/passive HA pair—the passive firewall does not forward traffic and its BGP configuration is synchronized via HA; the problem is that ECMP is not enabled on the active firewall. Option D is wrong because HA state synchronization is enabled by default in active/passive pairs and is required for session failover, but it does not control route load-balancing; the passive firewall does not need to advertise routes to ISPs since it is not the active forwarding unit.

Full explanation →

121

Multi-Selecteasy

Which TWO authentication methods are supported for captive portal on a Palo Alto Networks firewall?

Select 3 answers

A.SAML

B.TACACS+

C.RADIUS

D.Local Database

E.Kerberos

AnswersA, C, D

SAML is supported and often used for federated SSO.

Why this answer

SAML enables browser-based SSO using an external IdP. RADIUS is widely used for network authentication and integrates with existing RADIUS servers. Local Database allows authentication against local user entries on the firewall.

All three methods are supported for captive portal; the question requires any two.

Exam trap

A common trap is assuming only SAML and RADIUS are supported. Local Database is also a valid method, so if the question asks for two, any combination of SAML, RADIUS, and Local Database qualifies. TACACS+ and Kerberos are not supported for captive portal.

Full explanation →

122

MCQmedium

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

A.Floating static routes were not configured on the passive firewall.

B.Static routes were not synchronized.

C.OSPF routes were not synchronized.

D.BGP routes were not synchronized.

AnswerA

Floating static routes are not synchronized and must be configured on both firewalls.

Why this answer

In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Exam trap

The trap here is that candidates assume all routes are synchronized in HA, but PAN-OS only synchronizes dynamic routing protocol states and not static route configuration, requiring explicit configuration on both peers.

How to eliminate wrong answers

Option B is wrong because static routes are not synchronized by default in PAN-OS HA; they must be configured independently on each peer. Option C is wrong because OSPF routes are dynamically learned and would be re-established after failover via neighbor adjacencies, not missing due to synchronization issues. Option D is wrong because BGP routes are also dynamically learned and would be re-established via BGP sessions after failover, not missing from a synchronization failure.

Full explanation →

123

MCQhard

An organization needs to enforce authentication for application-based policies. Users are in multiple AD groups. Which authentication enforcement method best scales and minimizes administrative overhead?

A.Single Sign-On with Kerberos

B.Captive Portal with RADIUS

C.SSL Decryption with User-ID

D.GlobalProtect with client certificate

E.Authentication Policy with user group mapping

AnswerE

Authentication Policy can match source-user groups from LDAP, scaling easily with group membership.

Why this answer

Authentication Policy with user group mapping (Option E) is the correct answer because it allows the firewall to enforce authentication based on user group membership without requiring per-user credentials at the firewall. By integrating with Active Directory via LDAP or Kerberos, the firewall can map users to groups and apply authentication policies that scale across thousands of users, minimizing administrative overhead as group changes are automatically reflected.

Exam trap

The trap here is that candidates often confuse User-ID (which passively maps users to IPs) with Authentication Policy (which actively enforces authentication), leading them to choose SSL Decryption or Kerberos SSO as the enforcement mechanism rather than the policy that triggers the authentication challenge.

How to eliminate wrong answers

Option A is wrong because Single Sign-On with Kerberos provides seamless authentication for users but does not inherently enforce authentication for application-based policies; it relies on the firewall already having user identity, and Kerberos alone does not trigger an authentication challenge for policy enforcement. Option B is wrong because Captive Portal with RADIUS requires users to manually authenticate via a web portal, which does not scale well for large AD groups and adds administrative overhead for managing RADIUS attributes and group mappings. Option C is wrong because SSL Decryption with User-ID is used for decrypting SSL traffic to identify users, not for enforcing authentication; User-ID can identify users passively but does not enforce authentication challenges.

Option D is wrong because GlobalProtect with client certificate authenticates the device or user via certificates, but it is designed for remote access VPN and does not efficiently scale for enforcing authentication on internal application-based policies across multiple AD groups without additional infrastructure.

Full explanation →

124

Drag & Dropmedium

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for packet capture on a Palo Alto Networks firewall is: first configure the capture filter to define which traffic to capture, then start the capture, generate the traffic, stop the capture to finalize the data, and finally download the capture file. This order ensures that the desired traffic is captured cleanly and the file is ready for analysis.

Full explanation →

125

MCQhard

Refer to the exhibit. A firewall administrator created a local user group named 'Engineering' and added two users. However, when applying a security policy that uses this group as the source user, only one user (asmith) is matched correctly. What is the most likely cause of this issue?

A.The group should be configured as 'local' and the users should be added manually via CLI.

B.The user-id agent timeout is too short; increase the timeout value.

C.The group type is set to 'local' but the users are sourced from LDAP; change the group type to 'ldap'.

D.The group must be imported from LDAP as a dynamic group.

AnswerC

Correct: The group type should match the source of the users. Local groups expect locally defined users; LDAP-sourced users require the group type to be 'ldap'.

Why this answer

When a local user group is created on the firewall, the group type must match the source of its members. If the group type is set to 'local', the firewall expects the users to be defined locally on the firewall itself. However, if the users are actually sourced from an external LDAP directory, the group type must be changed to 'ldap' so that the firewall queries the LDAP server for group membership.

The mismatch causes the firewall to fail to resolve the LDAP users as members of the local group, resulting in only locally defined users (like asmith) being matched correctly.

Exam trap

The trap here is that candidates assume adding LDAP usernames to a local group will work because the usernames are known, but they overlook that the group type must match the authentication source for the firewall to correctly resolve group membership.

How to eliminate wrong answers

Option A is wrong because local groups and users are already created via the GUI or CLI; the issue is not about the method of creation but about the group type mismatch. Option B is wrong because the user-id agent timeout affects how long user mappings are cached, not whether LDAP users are recognized as members of a local group. Option D is wrong because the group does not need to be imported as a dynamic group; static LDAP groups can be used by simply setting the group type to 'ldap' and referencing the LDAP group name.

Full explanation →

126

MCQeasy

A company needs to deploy a firewall in transparent inline mode to filter traffic between two switches without requiring any IP address changes on existing devices. Which interface type should be configured?

A.Virtual Wire

B.Tap

C.Layer3

D.Layer2

AnswerA

Virtual Wire bridges two ports without IP, providing transparent inline inspection.

Why this answer

Virtual Wire (VWire) is the correct interface type because it allows the firewall to operate in transparent inline mode without requiring any IP address changes on existing devices. In VWire mode, the firewall acts as a Layer 2 bump in the wire, forwarding traffic between two interfaces based on MAC addresses without participating in routing or requiring IP configuration on the firewall interfaces themselves.

Exam trap

The trap here is that candidates confuse Layer2 interfaces with Virtual Wire, assuming any transparent mode works the same, but Layer2 interfaces require bridge groups or VLAN configuration and do not provide the same zero-touch inline deployment as Virtual Wire.

How to eliminate wrong answers

Option B (Tap) is wrong because a Tap interface is used for passive monitoring only; it receives a copy of traffic but cannot actively filter or block traffic inline between switches. Option C (Layer3) is wrong because Layer3 interfaces require IP addresses and routing, which would necessitate IP address changes on existing devices and break the transparent requirement. Option D (Layer2) is wrong because while Layer2 interfaces can operate transparently, they require a VLAN tag or bridge configuration and do not inherently provide the same zero-configuration, bump-in-the-wire behavior as Virtual Wire, which is specifically designed for transparent inline deployment without any IP or VLAN changes.

Full explanation →

127

MCQeasy

Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?

A.Drop the traffic because no rule matches.

B.Allow the traffic because rule 2 matches.

C.Reset the traffic because of rule 1.

D.Deny the traffic because rule 1 matches first.

AnswerD

Rule 1 has source 10.0.0.0/8 which includes 10.1.1.100, so it matches first and denies the traffic.

Why this answer

The firewall processes security rules in top-down order. Rule 1 explicitly denies traffic from the internal zone to the destination zone 'untrust-L3' for destination IP 203.0.113.1, which matches the user's traffic. Since rule 1 is matched first, the firewall denies the traffic and does not evaluate subsequent rules.

Exam trap

The trap here is that candidates often assume the firewall will continue to evaluate subsequent rules (like rule 2) after a match, but the first-match logic means rule 1's deny action is applied immediately, preventing any further rule evaluation.

How to eliminate wrong answers

Option A is wrong because a rule does match (rule 1), so the traffic is not dropped due to a lack of matching rules. Option B is wrong because rule 2 would only be evaluated if rule 1 did not match; however, rule 1 matches first and denies the traffic, so rule 2 is never reached. Option C is wrong because rule 1 is configured to deny the traffic, not reset it; a reset action would require a specific 'reset' action in the rule, which is not indicated.

Full explanation →

128

MCQhard

A firewall receives traffic with IP options enabled. How does the firewall handle this traffic by default?

A.It drops the traffic

B.It forwards the traffic normally

C.It logs and alerts

D.It strips the IP options and forwards

AnswerA

This is the default security behavior to prevent potential attacks using IP options.

Why this answer

By default, Palo Alto Networks firewalls drop traffic with IP options enabled because IP options can be used to bypass security controls or evade inspection. The firewall treats such packets as a potential security risk and discards them to prevent IP option-based attacks, such as source routing or timestamp manipulation.

Exam trap

The trap here is that candidates may assume the firewall forwards or strips IP options like a router, but Palo Alto Networks firewalls prioritize security by default and drop such packets to prevent IP option-based attacks.

How to eliminate wrong answers

Option B is wrong because forwarding traffic with IP options normally would allow potential evasion of security policies and is not the default behavior. Option C is wrong because while logging and alerting may be configured, the default action is to drop, not just log. Option D is wrong because stripping IP options and forwarding is not a default behavior; the firewall does not modify IP headers by default and instead drops the packet.

Full explanation →

129

MCQhard

A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?

A.The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.

B.The threat was detected in decrypted traffic because the source was external.

C.The threat log is misconfigured.

D.The security policy is blocking the traffic before decryption.

AnswerB

Correct: The source is likely external, so the traffic is decrypted by rule 2, and the threat profile detected it.

Why this answer

The threat was detected because the decryption policy rule 'No-Decrypt-Internal' only applies to traffic where both the source and destination are internal (10.0.0.0/8). If the source is external, the traffic is decrypted by a higher-priority rule (e.g., 'Decrypt-All'), allowing the threat to be inspected and logged. The log entry shows the threat in SSL traffic to 10.0.0.5, but the source being external means the no-decrypt rule does not match, so decryption occurs.

Exam trap

The trap here is that candidates assume 'No-Decrypt-Internal' applies to all traffic to internal IPs regardless of source, but the rule's source zone or IP must also be internal for it to match; external sources cause decryption to occur.

How to eliminate wrong answers

Option A is wrong because the order of decryption rules is evaluated top-down; a 'No-Decrypt-Internal' rule should be placed before a 'Decrypt-All' rule to ensure internal traffic is excluded from decryption, not after. Option C is wrong because the threat log is not misconfigured; it correctly reflects the detection in decrypted traffic when the source is external. Option D is wrong because the security policy does not block traffic before decryption; decryption occurs before security policy evaluation, and a threat detected in decrypted traffic indicates decryption happened successfully.

Full explanation →

130

MCQeasy

A company is deploying a Palo Alto Networks firewall in an existing Layer 2 switched environment. They need to inspect traffic between VLAN 10 and VLAN 20 without changing the IP addresses of hosts and without performing any routing. Which firewall mode should be used?

A.Virtual Wire

B.Tap mode

C.Transparent (Layer 2)

D.Layer 3

AnswerC

Correct. Transparent mode bridges VLANs at Layer 2, enabling inspection without IP changes.

Why this answer

Transparent (Layer 2) mode allows the firewall to operate as a Layer 2 bridge, inspecting traffic between VLAN 10 and VLAN 20 without requiring any IP address changes or routing. The firewall forwards frames based on MAC addresses, preserving the existing IP subnet and host configurations, which is ideal for inserting security into an existing switched environment.

Exam trap

The trap here is that candidates often confuse Virtual Wire mode with Transparent mode, assuming Virtual Wire can handle VLANs, but Virtual Wire does not support VLAN subinterfaces or inter-VLAN inspection, making it unsuitable for this requirement.

How to eliminate wrong answers

Option A is wrong because Virtual Wire mode operates without any VLAN or MAC learning, passing traffic as a simple bump in the wire without the ability to inspect inter-VLAN traffic; it requires the firewall to be placed between two interfaces without any Layer 2 switching or VLAN segmentation. Option B is wrong because Tap mode only copies traffic for monitoring and does not allow the firewall to enforce security policies inline; it cannot block or modify traffic between VLANs. Option D is wrong because Layer 3 mode requires the firewall to perform routing between subnets, which would necessitate changing host IP addresses or default gateways, contradicting the requirement to avoid routing and IP changes.

Full explanation →

131

Multi-Selecthard

Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)

Select 2 answers

A.Both firewalls must have identical licenses.

B.Both firewalls must be the same hardware model.

C.Both firewalls must be in the same data center.

D.Both firewalls must have the same PAN-OS version.

E.The firewalls must be directly connected via a crossover cable for HA1.

AnswersB, D

Same model ensures compatibility for HA.

Why this answer

Palo Alto Networks high-availability (HA) active/passive pairs require both firewalls to be the same hardware model to ensure identical processing capabilities and interface configurations. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration synchronization and stateful failover compatibility; version mismatches can cause HA session sync failures or unexpected behavior.

Exam trap

The trap here is that candidates often assume a direct crossover cable is required for HA1, but Palo Alto Networks supports HA1 over any routable Layer 3 interface, including through switches, making option E a common distractor.

Full explanation →

132

MCQmedium

A company has a firewall with multiple virtual systems (vsys). The administrator wants to delegate management of one vsys to a junior administrator, allowing them to configure security policies but not access system settings or other vsys. Which administrative role should be assigned?

A.Virtual System Admin

B.Superuser

C.Device Admin

D.Role-Based Admin

AnswerA

Vsys admin can be scoped to a specific vsys with limited permissions.

Why this answer

A Virtual System Admin role is specifically designed to delegate administrative access to a single virtual system (vsys) within a Palo Alto Networks firewall. This role allows the junior administrator to configure security policies and objects within their assigned vsys, while explicitly preventing access to system settings, device-level configurations, or other virtual systems. This matches the requirement exactly.

Exam trap

The trap here is that candidates often confuse 'Virtual System Admin' with 'Role-Based Admin', thinking they need to create a custom role, when the predefined Virtual System Admin role is the exact fit for delegating per-vsys management.

How to eliminate wrong answers

Option B (Superuser) is wrong because a Superuser has full read-write access to all virtual systems and all system settings, which would grant the junior administrator access to other vsys and device-level configurations, violating the requirement. Option C (Device Admin) is wrong because a Device Admin has full access to the device's system settings and all virtual systems, again providing broader access than intended. Option D (Role-Based Admin) is wrong because it is a generic category for custom roles, but the specific predefined role that matches the requirement is Virtual System Admin; assigning a custom Role-Based Admin would require manually creating a role with the exact permissions, which is less direct and not the standard answer for this scenario.

Full explanation →

133

MCQhard

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

A.The GlobalProtect app's cookie integrity is corrupted.

B.The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.

C.The GlobalProtect client needs to be reinstalled.

D.The user-id agent is not resolving usernames correctly.

AnswerB

If the IKE rekey lifetime expires before the IPSec SA, the tunnel may be torn down unexpectedly.

Why this answer

The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Exam trap

The trap here is that candidates often assume client-side issues (like app corruption or reinstallation) are the cause, when the error is clearly a gateway-side IPsec rekey misconfiguration.

How to eliminate wrong answers

Option A is wrong because cookie integrity corruption would cause authentication or session validation failures, not a rekey failure during IPsec SA renewal. Option C is wrong because reinstalling the client would not resolve a misconfiguration in the gateway's IKE or IPsec lifetime settings; the issue is on the server side. Option D is wrong because the user-id agent's inability to resolve usernames affects user mapping and policy enforcement, not the IPsec tunnel rekey process.

Full explanation →

134

MCQeasy

A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?

A.Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.

B.Configure a 'Log Forwarding' profile with 'Buffering' enabled.

C.Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.

D.Use the 'High Availability' feature with active/passive.

AnswerB

Buffering queues logs locally and sends them when connectivity with Panorama is restored.

Why this answer

Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.

Exam trap

The trap here is that candidates confuse 'Log Forwarding' with simple log redirection, overlooking that 'Buffering' is the specific mechanism that ensures log delivery reliability during management plane outages, rather than relying on HA or external syslog servers.

How to eliminate wrong answers

Option A is wrong because 'Log at Session End' is a standard logging setting that does not provide buffering for log delivery failures, and 'Enhanced Application Logging' is unrelated to log forwarding reliability. Option C is wrong because 'Override' in Log Forwarding redirects logs to a syslog server instead of Panorama, but it does not inherently buffer logs if the syslog server is unreachable; buffering must be explicitly enabled. Option D is wrong because High Availability (active/passive) ensures firewall redundancy, not log forwarding reliability; it does not buffer logs for Panorama delivery.

Full explanation →

135

MCQmedium

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

A.Configure HA3 for stateful inspection.

B.Increase HA1 keepalive timer.

C.Enable config sync on HA1.

D.Enable session sync on HA2.

AnswerD

Session sync ensures sessions are replicated to the passive firewall.

Why this answer

Enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Exam trap

The trap here is confusing configuration synchronization (config sync) with session state synchronization (session sync), leading candidates to incorrectly select config sync on HA1 as the solution for preserving active connections during failover.

How to eliminate wrong answers

Option A is wrong because HA3 is the management link used for control-plane traffic like configuration synchronization and keepalives, not for session state synchronization; stateful inspection is a firewall feature unrelated to HA session sync. Option B is wrong because increasing the HA1 keepalive timer only affects how quickly the firewall detects a peer failure, but does not prevent session loss after failover; it may actually delay failover detection. Option C is wrong because config sync on HA1 synchronizes configuration objects (policies, objects) between peers, not dynamic session state; session tables are not part of configuration sync.

Full explanation →

136

MCQmedium

Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?

A.rule4

B.rule3

C.rule1

D.rule2

AnswerD

Rule2 allows SSL for anyone, so it matches the HTTPS traffic.

Why this answer

Rule2 is correct because it is the first rule in the security policy that matches the traffic from the trust zone (source zone trust) to the external server (destination zone untrust) for HTTPS (destination port 443). Palo Alto Networks firewalls evaluate rules in top-down order, and rule2 explicitly permits HTTPS traffic from trust to untrust, while rule1 only permits HTTP (port 80). Rule3 and rule4 do not match because they are either for different zones or deny the traffic.

Exam trap

Palo Alto Networks often tests the first-match rule evaluation order, where candidates mistakenly think a deny rule later in the policy (rule4) will block traffic, forgetting that a preceding permit rule (rule2) already matched and allowed the session.

How to eliminate wrong answers

Option A is wrong because rule4 denies all traffic from trust to untrust, but since rule2 matches first and permits the HTTPS traffic, rule4 is never evaluated. Option B is wrong because rule3 applies to traffic from the DMZ zone, not the trust zone, so it does not match the user's traffic. Option C is wrong because rule1 only permits HTTP (port 80), not HTTPS (port 443), so it does not match the HTTPS request.

Full explanation →

137

Multi-Selecteasy

Which TWO types of traffic should typically be excluded from SSL decryption for compliance or operational reasons? (Choose two.)

Select 2 answers

A.Traffic to social media websites.

B.Traffic between internal data center servers.

C.Traffic to healthcare portals and electronic medical records.

D.Traffic to financial services websites (e.g., banking, investment).

E.Traffic to external email services (e.g., Gmail).

AnswersC, D

HIPAA and other regulations may restrict decryption.

Why this answer

Options C and D are correct because traffic to healthcare portals (e.g., electronic medical records) and financial services websites (e.g., banking, investment) must often be excluded from SSL decryption to comply with regulations such as HIPAA and PCI DSS, which restrict inspection of sensitive data. Option A is incorrect because social media traffic is typically not subject to specific compliance requirements that mandate exclusion. Option B is incorrect because traffic between internal data center servers, while potentially sensitive, is not typically excluded solely for compliance reasons; it may be decrypted for security monitoring.

Option E is incorrect because external email services like Gmail can be decrypted for threat prevention, though some organizations may choose to exclude them for privacy, but it is not a standard compliance requirement.

Full explanation →

138

MCQhard

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

A.The service 'application-default' does not allow TCP port 443.

B.The packet is not logged properly.

C.The destination IP is not routable in the virtual router.

D.The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.

AnswerD

The firewall matches the application after identification; if it does not match the rule, the packet is dropped.

Why this answer

The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Exam trap

The trap here is that candidates assume a port-based rule (TCP 443) will allow HTTPS traffic, but Palo Alto Networks firewalls require the application to match the rule's application object, not just the port, so a rule allowing 'web-browsing' will drop HTTPS traffic identified as 'ssl'.

How to eliminate wrong answers

Option A is wrong because 'application-default' is a service setting that restricts the port to the default port for the application; for 'ssl', TCP 443 is the default, so it would allow the traffic if the application matched. Option B is wrong because logging is a reporting feature and does not cause a packet drop; a packet is dropped due to a security rule or policy, not logging configuration. Option C is wrong because 8.8.8.8 is a public IP and is routable in the virtual router unless a static or default route is missing; the question states the packet is dropped by a rule, not a routing issue.

Full explanation →

139

MCQeasy

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

A.The remote users' computers are not domain-joined.

B.The external gateway is not configured for Kerberos authentication.

C.The authentication profile is not configured on the gateway.

D.The GlobalProtect gateway certificate is not trusted by the client.

AnswerA

Kerberos authentication requires the client to be domain-joined to obtain a ticket.

Why this answer

Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Exam trap

The trap here is that candidates may assume Kerberos authentication can be used for external gateways or that the issue is certificate-related, but the key is understanding that Kerberos requires domain membership and cannot work for non-domain-joined remote clients.

How to eliminate wrong answers

Option B is wrong because the external gateway does not perform Kerberos authentication; Kerberos authentication is handled by the portal, and the gateway uses the authentication cookie issued by the portal after successful authentication. Option C is wrong because the authentication profile is configured on the portal, not the gateway; the gateway relies on the portal to validate the user and does not require its own authentication profile for Kerberos. Option D is wrong because while an untrusted gateway certificate can cause connection issues, it would typically produce a certificate warning or error, not a Kerberos authentication failure; the scenario specifically points to Kerberos authentication as the root cause.

Full explanation →

140

MCQhard

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

A.LDAP server profile for user lookup

B.Server certificate for the portal

C.Authentication profile referencing the SAML IdP profile

D.SSL decryption rule

AnswerC

The authentication profile defines the method (SAML) and must include the IdP profile.

Why this answer

SAML authentication for GlobalProtect requires an authentication profile that references a SAML identity provider (IdP) profile. The firewall uses this profile to redirect users to Azure AD for SAML-based MFA, then validates the SAML assertion returned. Without this profile, the firewall cannot initiate or complete the SAML exchange.

Exam trap

The trap here is that candidates often confuse the need for a server certificate (required for TLS) with the authentication method itself, or assume LDAP is needed for user identity, but SAML authentication is configured solely through the authentication profile and SAML IdP profile, not through LDAP or SSL decryption.

How to eliminate wrong answers

Option A is wrong because an LDAP server profile is used for direct user lookup or authentication against an LDAP directory, not for SAML-based authentication with Azure AD; SAML relies on token exchange, not LDAP binds. Option B is wrong because a server certificate for the portal is required for TLS encryption of the GlobalProtect portal, but it does not enable SAML authentication or MFA; it secures the transport layer only. Option D is wrong because SSL decryption rules are used to inspect encrypted traffic, not to configure authentication methods; they have no role in SAML or MFA integration.

Full explanation →

141

MCQmedium

An engineer is troubleshooting a security policy that is not matching traffic as expected. The traffic is from source IP 10.1.1.10 to destination 172.16.0.1 port 443. The policy has source zone 'Internal', destination zone 'DMZ', source address '10.1.1.0/24', destination address '172.16.0.0/24', application 'ssl'. The firewall shows the traffic hitting a different rule. What is the most likely cause?

A.The source zone is incorrectly assigned; traffic is coming from a different zone.

B.The destination address is not in the specified subnet due to NAT.

C.The application 'ssl' does not match because the traffic is actually using TLS 1.3.

D.The traffic is being matched by an earlier rule with broader criteria.

AnswerD

Rule order matters; a prior rule with broader source/destination/application may match before the intended rule.

Why this answer

The most likely cause is that an earlier rule in the security policy rulebase matches the traffic before the intended rule. Palo Alto Networks firewalls evaluate security rules in sequential order from top to bottom, and the first rule that matches all criteria (source/destination zone, source/destination address, application, etc.) is applied. If a rule with broader criteria (e.g., any/any or a less specific application) appears earlier, it will match the traffic, preventing the intended rule from being hit.

Exam trap

Palo Alto Networks often tests the misconception that application signatures are version-specific (e.g., TLS 1.3 vs. SSL), but Palo Alto Networks uses generic application signatures that match all versions of a protocol, so candidates incorrectly eliminate the correct answer due to a misunderstanding of application identification.

How to eliminate wrong answers

Option A is wrong because the traffic is from source IP 10.1.1.10, which is within the 10.1.1.0/24 subnet, and the policy specifies source zone 'Internal'; if the zone were incorrectly assigned, the traffic would not match any rule with that zone, but the firewall shows it hitting a different rule, not failing to match. Option B is wrong because NAT does not change the destination address in the security policy match; the firewall evaluates the pre-NAT destination address (172.16.0.1) against the destination address object (172.16.0.0/24), and 172.16.0.1 is within that subnet, so this is not a mismatch. Option C is wrong because the application 'ssl' in Palo Alto Networks is a generic signature that matches SSL/TLS traffic regardless of the TLS version (e.g., TLS 1.3), as the firewall identifies the application by protocol behavior and handshake patterns, not by the specific TLS version number.

Full explanation →

142

MCQmedium

After upgrading a PA-5250 from PAN-OS 9.1 to PAN-OS 10.1, the firewall fails to establish IPsec VPN tunnels with remote peers. The crypto profiles and IKE gateways appear unchanged. What is the most likely cause?

A.The default SSL/TLS service profile changed, affecting management access.

B.The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.

C.The upgrade reset the IKE gateway configuration to default.

D.The firewall's management IP address changed during the upgrade.

AnswerB

PAN-OS 10.1 enforces a minimum PSK length of 32 characters for IKEv2; shorter keys cause negotiation failure.

Why this answer

In PAN-OS 10.1, the default minimum pre-shared key length for IKEv2 was increased to 32 characters. If the existing PSK is shorter than 32 characters, the firewall will reject it during IKE negotiation, causing the tunnel to fail even though the crypto profiles and IKE gateways appear unchanged. This is a common compatibility issue when upgrading from PAN-OS 9.1, which had no such minimum length requirement.

Exam trap

The trap here is that candidates assume unchanged crypto profiles and IKE gateways mean no configuration issue, overlooking the silent enforcement of a new default PSK length requirement introduced in PAN-OS 10.1.

How to eliminate wrong answers

Option A is wrong because the default SSL/TLS service profile affects management access (e.g., web UI, API), not IPsec VPN tunnel establishment, which is a data-plane function. Option C is wrong because the upgrade does not reset IKE gateway configurations to default; the configuration is preserved during a standard upgrade. Option D is wrong because the management IP address is a separate configuration that does not change during an upgrade unless explicitly modified, and it does not impact IPsec VPN tunnel establishment with remote peers.

Full explanation →

143

MCQhard

Two firewalls in an active/passive HA configuration are not synchronizing sessions. The 'show high-availability state' command shows both peers as 'active' and 'passive' correctly, but session synchronization is not working. What is the most likely cause?

A.The HA3 link is not configured or is misconfigured.

B.The HA2 link is down.

C.The passive firewall does not have management API access.

D.The logging settings on both firewalls are different.

AnswerB

Correct. The HA2 link is responsible for session synchronization in active/passive mode. If it is down, sessions will not sync.

Why this answer

In an active/passive HA configuration on PAN-OS, session synchronization occurs over the HA2 link (control link). If the HA2 link is down, session synchronization will not work even though the HA state shows 'active' and 'passive' correctly. The HA3 link is used for packet forwarding in active/active mode, not for session sync in active/passive mode.

Exam trap

The trap here is that candidates often confuse the HA2 link (control link) with the HA3 link (session sync link), assuming that if HA state is correct and HA2 is up, session synchronization must also be working.

How to eliminate wrong answers

Option B is wrong because the HA2 link is used for control traffic (keepalives, configuration sync) and not for session synchronization; a down HA2 link would cause HA state issues, not just session sync failure. Option C is wrong because management API access on the passive firewall is unrelated to session synchronization; it controls administrative access, not data-plane session replication. Option D is wrong because differing logging settings between firewalls do not impact session synchronization; logging is a separate function from session table replication.

Full explanation →

144

MCQeasy

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

A.Disable application identification for SSL traffic.

B.Enable HTTP/2 protocol decoding.

C.Enable SSL decryption for the traffic.

D.Allow sessions with application 'incomplete' in policy.

AnswerC

Decryption reveals the underlying application.

Why this answer

The 'incomplete' application label indicates that the firewall could not fully identify the application because the traffic was encrypted. Enabling SSL decryption allows the firewall to inspect the decrypted payload, which is necessary for App-ID to accurately classify the application. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is often insufficient for SSL connections.

Exam trap

The trap here is that candidates may think enabling HTTP/2 decoding (Option B) will solve the issue, but HTTP/2 is a transport protocol, not a decryption mechanism; without SSL decryption, the firewall still cannot see the encrypted payload regardless of the HTTP version.

How to eliminate wrong answers

Option A is wrong because disabling application identification for SSL traffic would prevent any App-ID analysis, leaving all SSL sessions as 'incomplete' and defeating the purpose of improving accuracy. Option B is wrong because HTTP/2 protocol decoding is a feature for parsing HTTP/2 traffic, but it does not address the root cause of encryption; without decryption, the firewall still cannot inspect the payload to identify the application. Option D is wrong because allowing sessions with application 'incomplete' in policy does not improve App-ID accuracy; it merely bypasses security controls, leaving the traffic unidentified and potentially risky.

Full explanation →

145

MCQhard

A security engineer is troubleshooting a connectivity issue where traffic from a specific internal host is allowed by security policy but fails to establish a connection to an external server. The firewall logs show the session was created, but no response packets are seen. What is the most likely cause?

A.The destination NAT is configured incorrectly.

B.The security policy is missing the return traffic rule.

C.The firewall is in FIPS mode.

D.The source NAT is not configured.

AnswerD

Without source NAT, the packet's source IP remains private, and the server replies to that private IP, which may not return to the firewall.

Why this answer

When traffic from an internal host is allowed by security policy and the session is created but no response packets are seen, the most likely cause is that source NAT (also known as outbound NAT or PAT) is not configured. Without source NAT, the firewall forwards the packet with the internal private IP address as the source, and the external server sends responses back to that private address, which is not routable over the public internet. The firewall sees the session as created because it matched the security policy and forwarded the initial packet, but the return traffic never reaches the firewall, so no response packets are logged.

Exam trap

The trap here is that candidates often assume a session being 'created' means the connection is fully established, but in Palo Alto Networks, a session is created as soon as the first packet matches a security rule, even if NAT is not configured, leading to the misconception that the issue must be a missing return traffic rule or a routing problem.

How to eliminate wrong answers

Option A is wrong because destination NAT is used to translate the destination IP address (typically for inbound traffic to internal servers), not for outbound traffic from an internal host to an external server; misconfigured destination NAT would affect how the firewall forwards the initial packet, but the symptom here is missing response packets, not a failure to create the session. Option B is wrong because Palo Alto Networks firewalls use a stateful inspection model where return traffic is automatically allowed if the session was created by a security policy rule; there is no need for a separate return traffic rule, so missing one is not a valid concept. Option C is wrong because FIPS mode enforces cryptographic standards and disables non-approved algorithms, but it does not prevent the firewall from performing source NAT or forwarding packets; if the session was created, FIPS mode is not the cause of missing response packets.

Full explanation →

146

MCQeasy

A multinational corporation uses Palo Alto Networks NGFWs to secure user access to cloud-based productivity applications. Users authenticate via SAML using an external identity provider. Recently, the helpdesk has received multiple complaints that when users log in to the first application in the morning, they are prompted for SAML authentication. After authenticating successfully, if they navigate to a different application (e.g., from email to document editing) within the same browser tab, they are again prompted to re-authenticate, which disrupts their workflow. The firewall authentication logs show that each application access triggers a new SAML authentication request, even though the user’s session is still active. The administrator has verified that the SAML identity provider is properly configured, and the authentication profile on the firewall uses a unique identifier per user. The company wants to minimize re-authentication prompts while maintaining security. Which action should the administrator take?

A.Enable Single Logout (SLO) on the identity provider and configure the firewall to accept SLO requests.

B.Configure a session token lifetime in the authentication profile so that the firewall can reuse the same authentication token across multiple applications.

C.Reduce the authentication timeout value in the authentication profile to force more frequent re-authentication.

D.Remove the authentication enforcement from the security rules for these applications and rely on user-IP mapping.

AnswerB

Setting a session token lifetime allows the firewall to cache the SAML token and reuse it for subsequent authentications within the specified period, thus reducing redundant prompts.

Why this answer

Configuring a session token lifetime in the authentication profile allows the firewall to cache the SAML authentication token and reuse it for subsequent application requests within the same user session. This prevents redundant SAML re-authentication prompts when the user navigates between different cloud applications in the same browser tab, as the firewall can validate the existing token against the configured lifetime instead of initiating a new SAML flow.

Exam trap

The trap here is that candidates often confuse session token reuse with Single Logout (SLO) or think that reducing timeout values improves performance, when in fact the correct solution is to extend the token caching duration to avoid redundant SAML handshakes.

How to eliminate wrong answers

Option A is wrong because enabling Single Logout (SLO) is designed to terminate all active sessions when a user logs out, which would not reduce re-authentication prompts; it would actually increase them by forcing logout and re-login. Option C is wrong because reducing the authentication timeout value would force more frequent re-authentication, exacerbating the problem rather than solving it. Option D is wrong because removing authentication enforcement and relying solely on user-IP mapping bypasses SAML-based identity verification, weakening security and potentially allowing unauthorized access if IP addresses change or are shared.

Full explanation →

147

Multi-Selecthard

Which TWO are prerequisites for using Authentication Policy? (Choose two.)

Select 2 answers

A.User-ID is configured

B.The firewall is in transparent mode

C.SSL decryption is enabled

D.A security policy rule exists with user attributes

E.An authentication profile is configured

AnswersA, E

User-ID is required to map users to IP addresses and use user attributes in policies.

Why this answer

User-ID must be configured because Authentication Policy relies on user identity information to enforce access controls based on who the user is, not just IP addresses. Without User-ID, the firewall cannot map users to traffic, making authentication policies ineffective. This prerequisite ensures the firewall can identify users via agents, captive portal, or other methods.

Exam trap

The trap here is that candidates often confuse prerequisites with features that enhance security (like SSL decryption) or confuse the order of configuration steps, thinking a security rule with user attributes must exist before the authentication policy can be used.

Full explanation →

148

MCQeasy

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

A.Use user-ID on the GlobalProtect gateway.

B.Configure group mapping on the GlobalProtect portal.

C.Create a HIP profile and assign it to the gateway.

D.Configure a security policy with user-ID matching the required users.

AnswerD

Security policies can use user-ID to allow or deny traffic based on authenticated user.

Why this answer

The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Exam trap

The trap here is that candidates often confuse the portal and gateway functions, thinking that user or group restrictions configured on the portal (like group mapping) will control application access, when in fact the security policy on the firewall is the only place to enforce which users can access specific internal resources.

How to eliminate wrong answers

Option A is wrong because user-ID on the GlobalProtect gateway is used to map IP addresses to usernames for visibility and policy enforcement, but it does not itself restrict access; it merely provides identity information. Option B is wrong because group mapping on the GlobalProtect portal is used to define which user groups can authenticate and download the portal configuration, but it does not control access to specific internal applications after the tunnel is established. Option C is wrong because a HIP profile is used to enforce endpoint compliance (e.g., antivirus, disk encryption) and is not a method to restrict access based on specific user identity; it checks the health of the client device, not the user.

Full explanation →

149

MCQhard

A network engineer configures a Source NAT policy on a Palo Alto Networks firewall to translate internal private IP addresses to the public IP of the external interface. The NAT rule is configured with source zone 'internal', destination zone 'external', and uses 'interface address' as the translated address. The associated security rule allows traffic from 'internal' to 'external' with the translated IP as the source. After committing, users cannot access the internet. Traceroute from an internal host to 8.8.8.8 shows: Hop 1: 192.168.1.1 (firewall internal IP), Hop 2: * * * (no response). The firewall's external interface has a public IP and is in the 'external' zone. What is the most likely cause of the issue?

A.The security rule's action is set to 'deny' for the translated IP.

B.The NAT rule's source zone is configured as 'external' instead of 'internal'.

C.The firewall's default route is missing.

D.The NAT rule is configured with destination zone 'any' but should be 'external'.

AnswerB

If the source zone is 'external', the internal traffic will not match the NAT rule, so no source translation occurs.

Why this answer

The NAT rule's source zone must match the zone of the incoming traffic. If the source zone is set to 'external' instead of 'internal', the firewall will not apply the NAT rule to traffic arriving from the internal zone. As a result, packets are forwarded without translation, and the security rule expecting the translated IP as the source will not match, causing traffic to be dropped.

The traceroute showing no response beyond the firewall's internal IP confirms that packets are not being translated or forwarded correctly.

Exam trap

The trap here is that candidates often focus on the destination zone or security rule configuration, overlooking that the NAT rule's source zone must match the actual traffic ingress zone, not the zone of the translated address.

How to eliminate wrong answers

Option A is wrong because the security rule is explicitly stated to allow traffic with the translated IP as the source; a deny action would be inconsistent with the scenario and would not explain the traceroute behavior. Option C is wrong because a missing default route would cause the firewall to have no path to the internet, but the traceroute shows the firewall's internal interface responding, indicating the firewall is reachable and routing is likely present. Option D is wrong because setting the destination zone to 'any' would actually broaden the match and not prevent NAT from being applied; the issue is with the source zone, not the destination zone.

Full explanation →

150

MCQmedium

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

A.Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.

B.Enable unknown application identification in the security rule.

C.Use the default application override for port 4444 to allow traffic.

D.Change the security rule to use 'application-default' as the service to rely on port-based identification.

AnswerA

Custom App-IDs allow identification of proprietary protocols by defining signatures.

Why this answer

App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Exam trap

The trap here is that candidates often confuse 'application override' (which bypasses App-ID) with 'custom App-ID' (which enhances App-ID), leading them to choose option C, thinking it will force identification when it actually disables App-ID for that traffic.

How to eliminate wrong answers

Option B is wrong because enabling unknown application identification only allows the firewall to treat unidentified traffic as 'unknown-tcp' or 'unknown-udp', but it does not create a specific signature to identify custom-db-sync; the traffic would still not be recognized as that custom application. Option C is wrong because an application override bypasses App-ID entirely, forcing the firewall to treat all traffic on port 4444 as a specified application, which defeats the purpose of using App-ID to correctly identify the custom protocol. Option D is wrong because using 'application-default' as the service only changes the port binding to the default port for the identified application, but since custom-db-sync is not identified at all, this action does not enable its recognition; App-ID must first identify the application before 'application-default' can be relevant.

Full explanation →

Palo Alto Networks Certified Network Security Engineer PCNSE (PCNSE) — Questions 76–150