Palo Alto Networks Certified Network Security Engineer PCNSE PCNSE Questions 226–300 | Page 4/7

226

MCQmedium

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

A.App-ID can only handle 1024 KB of packet data per session.

B.The firewall can buffer up to 1024 KB of packet data for App-ID analysis.

C.The firewall logs the first 1024 KB of every session for App-ID.

D.The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

AnswerB

This buffer stores packets for deep inspection when needed.

Why this answer

The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Exam trap

The trap here is confusing the buffer size with a per-session data limit or a logging threshold, when in fact it is a temporary storage mechanism for App-ID analysis.

How to eliminate wrong answers

Option A is wrong because App-ID does not have a hard limit of 1024 KB of packet data per session; the buffer size is a configurable limit for buffering, not a processing limit. Option C is wrong because the firewall does not log the first 1024 KB of every session; it buffers the data for analysis, not for logging purposes. Option D is wrong because App-ID processing is not offloaded to a dedicated buffer; the buffer is part of the firewall's normal packet processing pipeline and is used for temporary storage during signature matching.

Full explanation →

227

MCQeasy

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

A.The web server is not running.

B.The host is not in the allowed IP list.

C.The firewall is in FIPS mode.

D.HTTP/HTTPS is not enabled in the interface management profile.

AnswerD

The management profile must explicitly allow HTTP/HTTPS.

Why this answer

The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Exam trap

The trap here is that candidates assume a reachable IP (via ping) implies all management services are accessible, but Palo Alto separates ICMP from HTTP/HTTPS in the management profile, so ping success does not guarantee web access.

How to eliminate wrong answers

Option A is wrong because the web server (management web interface) is a built-in service that is always running on the firewall; the issue is not that the server is down, but that access is blocked by the management profile. Option B is wrong because the allowed IP list is a separate access control mechanism that restricts which source IPs can reach the management interface, but the question states the host can ping the interface, so the host is reachable; the problem is that HTTP/HTTPS services are not permitted in the profile, not that the host is excluded from an allow list. Option C is wrong because FIPS mode affects cryptographic algorithms and disables weaker protocols, but it does not prevent HTTP/HTTPS access entirely; if FIPS mode were enabled, HTTPS would still work with FIPS-compliant ciphers, so this would not cause a complete inability to access the web interface.

Full explanation →

228

MCQhard

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

A.The traffic matched a security rule that explicitly denies it

B.A threat prevention profile detected and blocked the session

C.The traffic was blocked because the application is not allowed

D.The destination URL is categorized as prohibited

AnswerA

The log clearly indicates rule 'deny-rule' matched, causing the drop.

Why this answer

The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Exam trap

The trap here is that candidates may confuse a security rule's 'deny' action with a block caused by a security profile (like Threat Prevention or URL Filtering), but the log explicitly shows the rule matched is 'deny-rule', indicating the drop is from the rule itself, not from any profile-based inspection.

How to eliminate wrong answers

Option B is wrong because a threat prevention profile blocking a session would be logged with a different action (e.g., 'reset-both' or 'drop') and would reference a specific threat ID or vulnerability signature, not simply show a rule match of 'deny-rule'. Option C is wrong because if the application were not allowed, the firewall would typically log an 'application not allowed' or 'deny' action with a different rule match, but the log explicitly shows the rule 'deny-rule' as the matched rule, indicating the deny is due to the rule itself, not an application-based policy. Option D is wrong because URL filtering blocks would be logged with a URL filtering profile action (e.g., 'block' or 'override') and would reference a URL category, not simply show a rule match of 'deny-rule'; the log does not indicate any URL filtering profile involvement.

Full explanation →

229

MCQmedium

A team uses the Panorama API to generate custom reports. They need to retrieve a list of all rules that have logging at session end enabled. Which API endpoint should be used?

A.GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules

B.GET /api/?type=op&cmd=<show><log></log></show>

C.GET /api/?type=config&action=get&xpath=/config/shared/log-settings

D.GET /api/?type=report&reporttype=predefined

AnswerA

This xpath retrieves security rules, including the log-end attribute.

Why this answer

The Panorama API endpoint GET /api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules retrieves the XML configuration of all security rules. Under each rule, the 'log-start' and 'log-end' elements indicate logging settings. To find rules with logging at session end enabled, one would check for the presence of a 'log-end' element with value 'yes'.

Option B is incorrect because it attempts to run an operational command to show logs, not retrieve rule configuration. Option C retrieves log forwarding profiles, not rules. Option D runs a predefined report, which is not suitable for retrieving rule-specific logging settings.

Full explanation →

230

MCQmedium

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

A.Decrease the path monitoring interval

B.HA1 backup link

C.Enable pre-emptive mode

D.Use link monitoring instead of path monitoring

AnswerD

Link monitoring only detects physical link failures, so temporary router unreachability would not trigger failover.

Why this answer

Link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described.

Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.

Exam trap

The trap here is that candidates often assume path monitoring is always superior because it checks end-to-end connectivity, but they fail to recognize that it can cause unnecessary failovers during transient network issues, whereas link monitoring is more stable for scenarios where only physical link state matters.

How to eliminate wrong answers

Option A is wrong because decreasing the path monitoring interval would make the firewall check for router reachability more frequently, increasing the likelihood of detecting a temporary unreachability and triggering a false failover, not preventing it. Option B is wrong because the HA1 backup link is used for control link redundancy between the firewalls in an HA pair; it does not affect how the firewall monitors upstream router connectivity or prevent false failovers due to router unreachability. Option C is wrong because pre-emptive mode controls whether the previously active firewall automatically resumes active role after it recovers from a failure; it does not address the root cause of false failovers caused by temporary router unreachability.

Full explanation →

231

Multi-Selectmedium

Which THREE are valid methods to collect logs from a firewall to Panorama? (Choose three.)

Select 3 answers

A.Configuring the firewall to send syslog to Panorama's log collector.

B.Using a dedicated Log Collector (in Panorama 10.0+).

C.Using the Panorama collector agent on the Panorama server.

D.Using the REST API to pull logs from the firewall to Panorama.

E.Logging to a remote syslog server and importing CSV files to Panorama.

AnswersA, B, C

Firewalls can forward logs via syslog to Panorama's collector.

Why this answer

A firewall can be configured to send syslog data directly to Panorama's log collector, which is a standard method for centralized logging. This leverages the syslog protocol to forward logs, allowing Panorama to aggregate and analyze them without requiring additional infrastructure.

Exam trap

The trap here is that candidates may confuse the REST API's management capabilities with log collection, or assume CSV import is a valid method, when in fact Panorama only supports real-time log forwarding via syslog or dedicated collectors.

Full explanation →

232

MCQmedium

A firewall is configured with two ISPs for load balancing. Traffic from certain sources should always egress via ISP-1. What is the correct configuration?

A.Multiple virtual routers

B.ECMP with route metrics

C.Policy-based forwarding (PBF) with source criteria

D.Subinterfaces per ISP

AnswerC

PBF can match source IP and forward to a specific next hop.

Why this answer

Policy-based forwarding (PBF) allows you to override the routing table for specific traffic based on criteria such as source IP, destination IP, or application. By configuring a PBF rule with source criteria, you can force traffic from certain sources to always egress via ISP-1, regardless of the load-balancing configuration. This is the correct method for source-based path selection in a multi-ISP setup.

Exam trap

The trap here is that candidates often confuse ECMP load balancing with source-based path selection, assuming that route metrics or multiple virtual routers can achieve deterministic egress control, when in fact only PBF provides the necessary policy override for specific source traffic.

How to eliminate wrong answers

Option A is wrong because multiple virtual routers are used to maintain separate routing tables for different network segments or administrative domains, not to selectively forward traffic from specific sources to a particular ISP. Option B is wrong because ECMP with route metrics distributes traffic across multiple equal-cost paths based on a hash algorithm (e.g., source-destination IP), but it cannot guarantee that traffic from specific sources always uses ISP-1; it is designed for load balancing, not deterministic source-based routing. Option D is wrong because subinterfaces per ISP are used to segment traffic at Layer 2 or for VLAN tagging, not to enforce egress path selection based on source criteria; they do not influence the routing decision.

Full explanation →

233

MCQmedium

A company wants to decrypt traffic to productivity and collaboration sites but avoid decrypting traffic to financial and healthcare sites due to compliance. How should the SSL decryption policy be configured?

A.Add all financial and healthcare sites to a custom URL list and exclude them.

B.Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

C.Create a rule to decrypt based on URL categories except financial and healthcare.

D.Use time-based rules to apply decryption only during business hours.

AnswerC

Allows targeted decryption based on categories.

Why this answer

Palo Alto Networks' SSL decryption policy can use URL categories to specify which traffic to decrypt. Creating a rule that decrypts traffic based on URL categories except for financial and healthcare ensures compliance by never decrypting those sensitive categories. Option A is wrong because maintaining a custom URL list is inefficient and prone to errors compared to using built-in categories.

Option B is wrong because a decrypt-all rule with exceptions would initially decrypt all traffic, including financial and healthcare, before the exception is applied, which could violate compliance. Option D is wrong because decryption policy does not support time-based rules.

Exam trap

The trap is assuming a decrypt-all rule with exceptions provides acceptable compliance. In reality, the decrypt-all action still decrypts all traffic momentarily, which may breach compliance requirements for protected categories.

Full explanation →

234

MCQhard

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

A.The service 'application-default' does not match port 443; a custom service must be used.

B.The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.

C.The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

D.SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

AnswerB

Although not shown here, if an application-group containing 'ssl' is in a deny rule higher in the order, it would deny the traffic.

Why this answer

The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Exam trap

The trap here is that candidates assume a more specific allow rule will automatically override a broader deny rule, but PAN-OS uses first-match logic, so rule order determines the outcome, not specificity.

How to eliminate wrong answers

Option A is wrong because the service 'application-default' automatically matches the default port for the identified application (SSL uses port 443 by default), so no custom service is needed. Option C is wrong because disabling logging at session start does not affect whether traffic is allowed or denied; it only suppresses the log entry, and the session would still be permitted if the rule matched. Option D is wrong because SSL decryption is not required for the firewall to identify the application as 'ssl'; the firewall can identify SSL based on the TLS handshake without decryption, and the question states the application was correctly identified as 'ssl'.

Full explanation →

235

Multi-Selectmedium

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Select 2 answers

A.The traffic is allowed by a security policy rule.

B.An application override policy is configured for the traffic.

C.SSL decryption is not enabled for the traffic.

D.The application is not in the Palo Alto Networks application database.

E.The firewall is using port-based application identification.

AnswersC, D

Without SSL decryption, App-ID cannot inspect encrypted traffic, leading to incorrect or failed identification.

Why this answer

App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Exam trap

The trap here is that candidates may think an application override policy ensures correct identification, but in reality it bypasses App-ID entirely, so it does not cause App-ID to fail—it prevents App-ID from running at all.

Full explanation →

236

Multi-Selecthard

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Select 3 answers

A.Matching IKE version and encryption algorithms

B.Same firewall model

C.Same certificate authority

D.Matching proxy IDs (local/remote subnets)

E.Matching pre-shared keys or certificates

AnswersA, D, E

These are phase 1 parameters that must match.

Why this answer

IKE (Internet Key Exchange) is the protocol that establishes the security association (SA) for an IPsec VPN. Both firewalls must agree on the IKE version (v1 or v2) and the encryption algorithms (e.g., AES-256, 3DES) during Phase 1 negotiation; a mismatch will cause the tunnel to fail to establish.

Exam trap

The trap here is that candidates often assume hardware or CA compatibility is required, but the PCNSE exam tests that only IKE parameters, authentication credentials, and proxy IDs must match—not the firewall model or a shared CA.

Full explanation →

237

MCQhard

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

A.Run 'request high-availability sync-to-remote' from the active firewall

B.Restart the HA process on the passive firewall with 'debug software restart high-availability'

C.Failover the active firewall to force re-sync

D.Upgrade both firewalls to the same PAN-OS version

AnswerA

This synchronizes the active configuration to the passive without downtime.

Why this answer

The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Exam trap

The trap here is that candidates often assume a 'non-functional' state requires a restart or failover, but the specific 'configuration mismatch' reason points to a sync issue that can be resolved non-disruptively with a configuration push from the active firewall.

How to eliminate wrong answers

Option B is wrong because restarting the HA process on the passive firewall does not resolve a configuration mismatch; it only restarts the HA state machine and may temporarily disrupt HA communication without syncing the configuration. Option C is wrong because failing over the active firewall would force a traffic disruption by switching the active role to the passive unit, which is in a non-functional state, potentially causing a full outage. Option D is wrong because the issue is a configuration mismatch, not a PAN-OS version mismatch; upgrading both firewalls would not fix the configuration discrepancy and could introduce unnecessary downtime.

Full explanation →

238

MCQmedium

A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?

A.The server is sending a FIN/RST prematurely due to application layer issues.

B.A deny all security policy is blocking the traffic.

C.Asymmetric routing is causing the session to be torn down.

D.Packet buffer exhaustion on the firewall is causing drops.

AnswerA

A CLOSE state indicates a normal termination, often due to FIN or RST from one side.

Why this answer

When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.

Exam trap

The trap here is that candidates often assume a 'CLOSE' state means the firewall is actively dropping traffic due to a policy or resource issue, but the correct interpretation is that the session was properly terminated and the firewall is simply enforcing that closure by dropping subsequent packets.

How to eliminate wrong answers

Option B is wrong because a 'deny all' security policy would cause the firewall to drop traffic at the policy lookup stage, not after a session is established and then closed; the session state would not show 'CLOSE' but rather the traffic would never create a session. Option C is wrong because asymmetric routing typically causes the firewall to see only one direction of traffic, leading to session setup failures or 'half-open' states, not a clean 'CLOSE' state; the firewall would drop packets due to no matching session, but the session state would not be 'CLOSE' unless a proper teardown occurred. Option D is wrong because packet buffer exhaustion causes random drops or session setup failures, not a specific 'CLOSE' state; the firewall would likely show session states like 'INIT' or 'ACTIVE' with drops, not a clean teardown.

Full explanation →

239

MCQhard

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

A.SSL decryption must be enabled for the firewall to correctly identify SSL traffic.

B.The firewall is not seeing the full SSL handshake due to asymmetric routing.

C.The default interzone rule is blocking the SSL identification packets.

D.The security policy allows 'web-browsing' before 'ssl' in the rule order.

AnswerB

Asymmetric routing can prevent the firewall from seeing the SSL handshake, causing it to identify the traffic as HTTP.

Why this answer

When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Exam trap

The trap here is that candidates assume SSL decryption is mandatory for SSL identification, but the firewall can identify HTTPS without decryption by inspecting the TLS handshake; the real issue is that asymmetric routing prevents the firewall from seeing the complete handshake, causing App-ID to fall back to port-based classification.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not required for App-ID to identify SSL traffic; the firewall can identify HTTPS by inspecting the TLS handshake metadata (e.g., SNI, certificate) without decrypting the payload. Option C is wrong because interzone rules control traffic flow between zones, not the identification process; App-ID operates before policy enforcement, so a default interzone rule would not prevent the firewall from seeing the SSL handshake packets. Option D is wrong because security policy rule order affects which action is taken on traffic, not how App-ID classifies it; App-ID identifies the application first, then matches it against the policy, so rule order does not cause misidentification.

Full explanation →

240

MCQhard

A site-to-site IPsec tunnel between two Palo Alto Networks firewalls is not passing traffic. The administrator runs the 'show vpn ipsec-sa' command and sees the output in the exhibit. The remote peer is configured to use IKEv2 only. Based on the configuration, what is the most likely cause of the tunnel being in 'init' state?

A.The IKE version is incompatible.

B.The pre-shared key is incorrect.

C.The proxy IDs are mismatched with the peer.

D.The IPsec crypto profile lifetime is too short.

AnswerA

Local uses IKEv1, remote expects IKEv2; Phase 1 negotiation fails, resulting in 'init' state.

Why this answer

The 'init' state in the 'show vpn ipsec-sa' output indicates that the IPsec Security Association (SA) has not been established because the IKE phase 1 negotiation failed. Since the remote peer is configured to use IKEv2 only, and the local firewall is likely configured for IKEv1 (or both, but not matching), the IKE version mismatch prevents the initial key exchange. This is the most direct cause of the tunnel remaining in 'init' state.

Exam trap

The trap here is that candidates often assume 'init' state always indicates a pre-shared key mismatch or proxy ID issue, but in this scenario the IKE version mismatch is the root cause because the tunnel never progresses past the initial IKE exchange.

How to eliminate wrong answers

Option B is wrong because an incorrect pre-shared key would cause IKE authentication failure, which typically results in an 'IKE phase 1 failure' or 'auth fail' status, not a persistent 'init' state. Option C is wrong because mismatched proxy IDs (traffic selectors) would cause IPsec phase 2 negotiation to fail, but the tunnel would still complete IKE phase 1 and show an 'active' or 'partial' state, not 'init'. Option D is wrong because a short IPsec crypto profile lifetime would cause the IPsec SA to expire and renegotiate, but the tunnel would initially establish and show 'active' before rekeying; it would not remain stuck in 'init'.

Full explanation →

241

MCQhard

An HA pair is configured with active/active mode and session sync enabled. After a failover, a network administrator notices that some new TCP connections fail. The firewall logs show no drops. What is the most likely issue?

A.The ARP cache on the firewalls is stale

B.Flow-based routing is misconfigured

C.Session synchronization is not functioning for TCP

D.Asymmetric routing is causing the SYN packet to be processed by one firewall and the SYN-ACK by the other

AnswerD

Active/active requires careful design to ensure symmetric traffic flows.

Why this answer

In an active/active HA pair with session sync enabled, asymmetric routing can occur after a failover if the traffic flow changes such that the SYN packet is processed by one firewall and the SYN-ACK by the other. Since session sync only synchronizes established sessions, not half-open ones, the firewall receiving the SYN-ACK does not have a session entry for the SYN, causing it to drop the SYN-ACK as a non-SYN packet without a session. The firewall logs show no drops because the drop occurs at the session lookup stage and may not be logged by default, or the drop counter is not incremented for this specific scenario.

Exam trap

The trap here is that candidates assume session sync covers all TCP packets, including the initial handshake, but in reality, session sync only replicates established sessions, not half-open ones, making asymmetric routing during the handshake a critical failure point.

How to eliminate wrong answers

Option A is wrong because stale ARP cache would cause connectivity issues for all traffic, not just new TCP connections, and would typically result in drops or timeouts visible in logs. Option B is wrong because flow-based routing is not a standard feature in Palo Alto Networks firewalls; routing decisions are based on the routing table, not flow-based, and misconfiguration would affect all traffic, not specifically new TCP connections after failover. Option C is wrong because session synchronization is functioning for TCP by design in active/active mode, but it only synchronizes established sessions after the three-way handshake completes; the issue is that the SYN and SYN-ACK are not synchronized because they occur before the session is established.

Full explanation →

242

Multi-Selecthard

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Select 3 answers

A.Application signatures and decrypted content

B.Protocol (TCP/UDP)

C.Source and destination port numbers

D.Destination IP address of the packet

E.Source IP address of the packet

AnswersA, B, C

Signatures and content inspection are key to accurate identification.

Why this answer

App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.

Exam trap

The trap here is that candidates often assume IP addresses are used in application identification, but App-ID relies solely on transport and application-layer data, not network-layer addressing.

Full explanation →

243

Drag & Dropmedium

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for enabling and configuring GlobalProtect on a Palo Alto Networks firewall starts with configuring the portal, which handles authentication and client settings. Next, the gateway is configured to manage VPN connections. Then, the GlobalProtect agent (client configuration) is set up to push settings to endpoints.

Finally, security policies are applied to allow GlobalProtect traffic. Following this order ensures dependencies are satisfied and reduces configuration errors.

Full explanation →

244

MCQeasy

An administrator wants to see only the candidate configuration changes that have not yet been committed. Which CLI command should be used?

A.show configuration running

B.show configuration sessions all

C.show configuration sessions changes

D.show configuration candidate

AnswerC

This displays only the uncommitted changes.

Why this answer

The 'show configuration sessions changes' command displays the uncommitted candidate configuration changes for the current administrative session. This is the correct command because it specifically shows only the modifications that have been made to the candidate config but not yet committed to the running configuration on a Palo Alto Networks firewall.

Exam trap

The trap here is that candidates confuse 'show configuration candidate' (which is not a valid command) with the correct 'show config candidate' command, or they mistakenly think 'show configuration running' or 'show configuration sessions all' will show uncommitted changes, when in fact only 'show configuration sessions changes' provides the diff of pending modifications.

How to eliminate wrong answers

Option A is wrong because 'show configuration running' displays the currently active running configuration, not the uncommitted candidate changes. Option B is wrong because 'show configuration sessions all' lists all active configuration sessions and their metadata, but does not show the actual configuration changes. Option D is wrong because 'show configuration candidate' is not a valid CLI command on Palo Alto Networks firewalls; the correct command to view the entire candidate configuration is 'show config candidate' (without 'uration'), but this shows the full candidate config, not just the uncommitted changes.

Full explanation →

245

MCQmedium

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

A.show counter global | match ipsec

B.show log system

C.debug ike global on

D.debug flow basic

AnswerC

This command enables detailed IKE debug logs, showing negotiation steps.

Why this answer

'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Exam trap

The trap here is that candidates often confuse 'debug flow basic' (data-plane) with IKE debugging (control-plane), or assume 'show counter global' will reveal negotiation failures, when in fact counters only track post-establishment statistics and not the IKE handshake itself.

How to eliminate wrong answers

Option A is wrong because 'show counter global | match ipsec' displays aggregate IPsec packet counters (e.g., encaps/decaps, drops) but does not provide IKE negotiation details; it is useful for post-establishment traffic issues, not for debugging why SAs are missing. Option B is wrong because 'show log system' shows system-level events (e.g., admin logins, config changes) but does not capture IKE-specific debug messages; it lacks the granularity needed for protocol-level negotiation failures. Option D is wrong because 'debug flow basic' is used for debugging data-plane packet flow (e.g., session setup, NAT, routing) and does not cover IKE control-plane negotiation; it would not reveal why IKE Phase 1 or Phase 2 fails.

Full explanation →

246

MCQhard

During a security audit, it is discovered that the GlobalProtect gateway allows clients to use weak encryption algorithms. Which configuration object controls this?

A.The SSL/TLS service profile on the gateway.

B.The IPSec crypto profile associated with the gateway.

C.The GlobalProtect portal agent configuration.

D.The SSL/SSH service profile on the firewall.

AnswerB

Correct. Crypto profile defines algorithms for data encryption.

Why this answer

The GlobalProtect gateway uses IPSec to secure VPN tunnels between clients and the gateway. The IPSec crypto profile defines the encryption algorithms, authentication methods, and key exchange parameters for these tunnels. If weak encryption algorithms are allowed, it is because the IPSec crypto profile associated with the gateway is configured with those weak options.

Exam trap

The trap here is that candidates confuse the SSL/TLS service profile (used for portal/management encryption) with the IPSec crypto profile (which actually controls the VPN tunnel encryption between GlobalProtect clients and the gateway).

How to eliminate wrong answers

Option A is wrong because the SSL/TLS service profile controls the SSL/TLS settings for the management web interface and portal, not the IPSec encryption used by the GlobalProtect gateway for client VPN tunnels. Option C is wrong because the GlobalProtect portal agent configuration controls client settings like app version, timeout, and certificate validation, but does not define the encryption algorithms for the IPSec tunnel between client and gateway. Option D is wrong because the SSL/SSH service profile on the firewall controls decryption and SSH proxy settings for traffic inspection, not the IPSec encryption for GlobalProtect VPN connections.

Full explanation →

247

MCQmedium

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

A.Configure a port-based application override for port 4444.

B.Enable SSL decryption for the ERP traffic.

C.Create a custom application with a data pattern (signature).

D.Create an application override to allow the traffic without App-ID.

AnswerC

Custom applications with data patterns allow App-ID to identify proprietary protocols by inspecting payload content.

Why this answer

Creating a custom application with a data pattern (signature) allows the firewall to identify the ERP traffic based on its unique payload characteristics, without overriding or disabling the default App-ID engine. This approach uses a custom App-ID signature that matches the proprietary protocol's data pattern, ensuring accurate identification while the default engine continues to process other traffic normally.

Exam trap

The trap here is that candidates confuse 'application override' (which bypasses App-ID) with 'custom application signature' (which enhances App-ID), leading them to choose options that disable inspection rather than improve it.

How to eliminate wrong answers

Option A is wrong because a port-based application override statically maps all traffic on TCP 4444 to a specific application, which bypasses the default App-ID engine entirely and prevents it from learning or updating signatures for that port. Option B is wrong because SSL decryption is irrelevant for a proprietary protocol over TCP that does not use SSL/TLS encryption; it would not help identify the application and could introduce unnecessary overhead. Option D is wrong because an application override allows traffic without any App-ID inspection, which defeats the purpose of improving identification and can permit unwanted or malicious traffic to pass unchecked.

Full explanation →

248

MCQmedium

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

A.The LDAP server certificate has expired.

B.The RADIUS server is not reachable.

C.The authentication sequence changed after upgrade.

D.The GP portal certificate is not trusted by the client.

AnswerC

Upgrades can rearrange authentication profiles or require re-selection, leading to authentication failures.

Why this answer

After upgrading the GlobalProtect portal and gateway from version 5.0 to 5.1, the authentication sequence may have been reset or changed. If the authentication profile uses LDAP but the sequence now includes a RADIUS server that is unreachable or misconfigured, the user will fail to authenticate even though the LDAP bind works from the CLI. The error 'Unable to connect to gateway' combined with authentication failure points to a change in the authentication order, not a certificate or connectivity issue.

Exam trap

The trap here is that candidates assume the LDAP bind success from the CLI confirms the entire authentication path works, but they overlook that the authentication sequence may have changed after the upgrade, causing the firewall to attempt a different method (like RADIUS) before falling back to LDAP.

How to eliminate wrong answers

Option A is wrong because an expired LDAP server certificate would not prevent the administrator from successfully binding to the LDAP server from the CLI; the CLI bind uses a simple bind or StartTLS without requiring certificate validation by the firewall. Option B is wrong because the RADIUS server not being reachable would only matter if RADIUS is part of the authentication sequence, but the question states the authentication profile uses LDAP, and the administrator can bind to LDAP successfully. Option D is wrong because the GP portal certificate not being trusted by the client would cause a certificate warning or 'untrusted server' error on the client side, not an 'Unable to connect to gateway' error with authentication failure in the firewall logs.

Full explanation →

249

MCQmedium

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

A.The 'allow-list' is restricting authentication to only user1 and user2

B.The Kerberos server profile 'KDC-Profile' is misconfigured

C.The expiration time of 60 minutes is too short

D.The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

AnswerA

Only those two users are allowed; others are denied.

Why this answer

The authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Exam trap

The trap here is that candidates often assume 'user not found' always indicates a domain or Kerberos misconfiguration, overlooking the allow-list feature that explicitly blocks users not listed.

How to eliminate wrong answers

Option B is wrong because the Kerberos server profile 'KDC-Profile' being misconfigured would typically result in a different error, such as 'Kerberos authentication failed' or 'KDC unreachable', not 'user not found'. Option C is wrong because the expiration time of 60 minutes affects session timeout, not the initial authentication lookup; a short expiration would cause re-authentication prompts, not a 'user not found' error. Option D is wrong because the realm 'EXAMPLE.COM' and the domain 'EXAMPLE' are not required to match exactly; the realm is used for Kerberos, while the domain is a Windows domain name, and the firewall can map them via the authentication profile settings.

Full explanation →

250

MCQmedium

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

A.The static route in VR1 does not point to an interface or next hop that is reachable via VR2.

B.The firewall does not support multiple virtual routers.

C.The virtual routers are not connected to each other.

D.NAT is not configured on VR2.

AnswerA

Without route redistribution, VR1 cannot use VR2's routes.

Why this answer

Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.

Exam trap

The trap here is that candidates assume virtual routers are interconnected by default, similar to VLANs, but in Palo Alto firewalls they are fully isolated routing instances that require explicit route sharing to pass traffic between them.

How to eliminate wrong answers

Option B is wrong because Palo Alto Networks firewalls fully support multiple virtual routers (up to 25 on most models), enabling segmentation of routing domains. Option C is wrong because virtual routers are not physically connected; they are logical constructs within the same data plane, and traffic between them requires explicit route leaking or redistribution, not a direct link. Option D is wrong because NAT is not required for routing between virtual routers; the failure occurs at the routing level before any NAT processing would apply.

Full explanation →

251

MCQeasy

Given the security policy above, what will happen to an HTTP request from a user to a public website?

A.It will be allowed but then blocked by the threat profile.

B.It will be denied because web-browsing is not identified.

C.It will be denied because rule 2 blocks all.

D.It will be allowed because rule 1 matches and action is allow.

AnswerD

Correct: Rule 1 matches web-browsing traffic and allows it.

Why this answer

Rule 1 matches the HTTP request because it typically includes the application 'web-browsing' (or a broader application category) and the action is set to 'allow'. Since security policy evaluation in Palo Alto Networks firewalls is first-match, the traffic is permitted by rule 1 before reaching rule 2. The threat profile does not block the request unless it detects malicious content, which is not indicated in the question.

Exam trap

The trap here is that candidates assume rule 2's 'deny all' will catch the traffic, forgetting that the first-match rule (rule 1) with an 'allow' action takes precedence and terminates policy evaluation.

How to eliminate wrong answers

Option A is wrong because the threat profile only blocks traffic if it matches a threat signature; the question does not specify any threat, so the request is not blocked by the profile. Option B is wrong because web-browsing is identified by App-ID as HTTP traffic to a public website, so it is not denied for lack of identification. Option C is wrong because rule 2 is only evaluated if rule 1 does not match; since rule 1 matches and allows the traffic, rule 2 is never reached.

Full explanation →

252

MCQeasy

What is the most likely cause of Phase2 being down?

A.Mismatched IKE version

B.Mismatched IPSec encryption or authentication settings

C.Wrong tunnel interface IP address

D.Incorrect pre-shared key

AnswerB

'no matching proposal' indicates the IPsec proposal parameters do not match between peers.

Why this answer

Phase 2 of an IPsec VPN tunnel establishes the IPsec security associations (SAs) for encrypting and authenticating data traffic. If the Phase 2 parameters, such as encryption algorithm (e.g., AES-256 vs. AES-128), authentication algorithm (e.g., SHA-256 vs.

SHA-1), or DH group (e.g., group 14 vs. group 2), do not match between peers, the IKEv2 or IKEv1 Quick Mode negotiation will fail, leaving Phase 2 down. This is the most common cause of a successful Phase 1 (IKE SA) but a failed Phase 2.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 failures, incorrectly assuming that any mismatch in authentication or encryption settings (including pre-shared keys or IKE version) will cause Phase 2 to fail, when in fact those affect Phase 1, and only IPsec-specific transform set mismatches cause Phase 2 to be down while Phase 1 remains up.

How to eliminate wrong answers

Option A is wrong because a mismatched IKE version (e.g., IKEv1 vs. IKEv2) would cause Phase 1 to fail, not Phase 2, as the IKE version is negotiated during the initial IKE SA exchange. Option C is wrong because a wrong tunnel interface IP address (e.g., on a Palo Alto Networks firewall) would prevent the tunnel from being established at all or cause routing issues, but it does not specifically cause Phase 2 to be down while Phase 1 is up; Phase 2 uses the IP addresses already established in Phase 1.

Option D is wrong because an incorrect pre-shared key would cause Phase 1 authentication to fail (e.g., during Main Mode or Aggressive Mode), preventing Phase 2 from ever being attempted.

Full explanation →

253

MCQmedium

A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?

A.The authentication policy is misconfigured.

B.The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.

C.The IdP session timeout is set too short.

D.The IdP certificate has expired.

AnswerB

The gateway's SAML cookie timeout determines how long the authenticated session persists; if too short, users are redirected to the IdP frequently.

Why this answer

When SAML authentication succeeds but the user is repeatedly redirected to the IdP login page, the most likely cause is that the GlobalProtect gateway's SAML cookie expiration timeout is set too short. This timeout controls how long the gateway retains the SAML authentication assertion; once it expires, the gateway treats the session as unauthenticated and forces a new SAML authentication flow, even though the IdP session may still be valid. The symptom of repeated redirects after successful login points to the gateway-side timeout, not the IdP-side timeout.

Exam trap

The trap here is that candidates often assume the issue is with the IdP (session timeout or certificate) because the symptom involves the IdP login page, but the root cause is actually the GlobalProtect gateway's SAML cookie expiration timeout being too short, which is a gateway-side setting, not an IdP-side setting.

How to eliminate wrong answers

Option A is wrong because a misconfigured authentication policy would typically prevent authentication from succeeding at all or would deny access, not cause repeated redirects after successful authentication. Option C is wrong because if the IdP session timeout were too short, the user would be prompted to re-authenticate at the IdP level, but the symptom here is repeated redirects to the IdP login page even after successful authentication, which indicates the gateway is not honoring the already-established SAML session. Option D is wrong because an expired IdP certificate would cause SAML assertion validation failures and authentication errors, not repeated successful authentications followed by redirects.

Full explanation →

254

MCQmedium

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

A.TLS 1.1

B.TLS 1.0

C.TLS 1.3

D.TLS 1.2

AnswerA

The profile explicitly blocks TLS 1.1.

Why this answer

The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Exam trap

Palo Alto Networks often tests the ability to read the exhibit carefully—candidates may assume that because TLS 1.1 is a deprecated protocol, the question is about which version is allowed, or they might confuse the 'Block' list with the 'Allow' list, leading them to pick TLS 1.0 or TLS 1.2 as the blocked version.

How to eliminate wrong answers

Option B is wrong because TLS 1.0 is not selected in the exhibit; only TLS 1.1 is checked, so TLS 1.0 remains allowed unless explicitly blocked. Option C is wrong because TLS 1.3 is not listed in the block options (the exhibit only shows TLS 1.0, 1.1, and 1.2), and it is not selected. Option D is wrong because TLS 1.2 is not checked in the exhibit; it is allowed by default unless explicitly blocked.

Full explanation →

255

MCQhard

A user from subnet 10.0.1.0/24 accesses a website categorized as 'Finance'. Based on the exhibit, what will be the result?

A.The traffic will not be decrypted because Rule 3 matches.

B.The traffic will be decrypted by Rule 2.

C.The traffic will be blocked because no matching rule exists.

D.The traffic will be decrypted by Rule 1.

AnswerB

Rule 2 is a catch-all that will match and decrypt.

Why this answer

Rule 2 matches traffic from subnet 10.0.1.0/24 to the 'Finance' category and has an action of 'decrypt'. The exhibit shows Rule 2 with source 10.0.1.0/24, destination category 'Finance', and action 'decrypt'. Since the user's traffic matches all criteria in Rule 2, it will be decrypted.

Rule 3 is not evaluated because Rule 2 matches first and has a higher priority (lower rule number).

Exam trap

Palo Alto Networks often tests the rule evaluation order in decryption policies, where candidates mistakenly think a later rule (like Rule 3) overrides an earlier matching rule (Rule 2) due to a more specific category or action, but in reality, the first match wins regardless of specificity.

How to eliminate wrong answers

Option A is wrong because Rule 3 matches a different source subnet (10.0.2.0/24) and a different category ('Health'), so it does not apply to this traffic; the traffic will not be decrypted by Rule 3. Option C is wrong because a matching rule (Rule 2) exists, so the traffic will not be blocked due to no matching rule. Option D is wrong because Rule 1 has an action of 'no-decrypt' and matches a different source subnet (10.0.0.0/24), so it does not decrypt the traffic.

Full explanation →

256

MCQeasy

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

A.A configuration error causes duplicate SAs.

B.Multiple Phase 2 tunnels are established.

C.Multiple Phase 1 proposals are accepted.

D.The firewall is under DDoS attack.

AnswerA

Correct. Multiple IKE SAs for the same peer indicate a configuration error, such as duplicate IKE gateways. When two or more IKE gateways are configured with identical peer IP settings, each gateway establishes its own IKE SA, resulting in multiple SAs.

Why this answer

In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway.

Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.

Exam trap

A common misconception is that multiple IKE SAs for the same peer always indicate multiple Phase 2 tunnels. In reality, Phase 2 tunnels do not create extra IKE SAs. Instead, multiple IKE SAs are caused by multiple IKE gateway configurations for the same peer, which is often a configuration error.

How to eliminate wrong answers

Option A is wrong because duplicate IKE SAs are not a configuration error; they are a normal result of multiple Phase 2 tunnels. Option C is wrong because multiple Phase 1 proposals are negotiated during a single IKE SA establishment, not resulting in separate IKE SAs; only one proposal is selected per IKE SA. Option D is wrong because a DDoS attack would typically cause a flood of half-open or invalid SAs, not multiple established IKE SAs for the same peer with valid Phase 2 tunnels.

Full explanation →

257

MCQmedium

Which of the following is NOT a valid method to identify users for User-ID on a Palo Alto Networks firewall?

A.XML API

B.LDAP sync

C.Terminal Services Agent (TS Agent)

D.Captive Portal

AnswerA

The XML API is used for configuration and data retrieval, not for user identification.

Why this answer

The XML API is not a method for identifying users for User-ID; it is a management interface used to configure, monitor, and retrieve data from the firewall programmatically. User-ID relies on mechanisms that actively map IP addresses to usernames, such as LDAP sync, Terminal Services Agent, and Captive Portal, none of which involve the XML API.

Exam trap

The trap here is that candidates may confuse the XML API's ability to retrieve user information (via the User-ID API) with being a direct identification method, but the XML API itself does not perform the identification—it only exposes data already collected by other User-ID agents.

How to eliminate wrong answers

Option A is wrong because the XML API is a management and automation interface, not a user identification method; it cannot perform real-time IP-to-username mapping. Option B is wrong because LDAP sync is a valid User-ID method that periodically queries an LDAP directory to correlate user logon events with IP addresses. Option C is wrong because the Terminal Services Agent (TS Agent) is a valid User-ID method that monitors terminal server sessions to map users to IPs.

Option D is wrong because Captive Portal is a valid User-ID method that authenticates users via a web portal and directly associates their IP with their username.

Full explanation →

258

Multi-Selecthard

A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)

Select 3 answers

A.Use SAML SSO for cloud applications.

B.Implement user-ID via domain controller probing.

C.Use the same authentication profile for all traffic.

D.Configure multi-factor authentication for VPN access.

E.Deploy captive portal only for on-premises users.

AnswersA, B, D

SAML SSO provides seamless authentication for cloud applications.

Why this answer

SAML SSO enables centralized identity federation for cloud applications, allowing both on-premises and remote users to authenticate via a single identity provider (IdP) without exposing on-premises credentials to the cloud. This reduces password fatigue and improves security by leveraging token-based authentication (SAML 2.0 assertions) rather than shared secrets.

Exam trap

A common misconception is that captive portal should only be used for on-premises users, but in Palo Alto Networks environments, it should be applied consistently across all segments, including remote users connecting via GlobalProtect or other VPN clients.

Full explanation →

259

MCQhard

A network security engineer is troubleshooting an issue where certain VoIP traffic is being dropped by the firewall. The traffic logs show that the application is identified as 'voip' and the security rule allows 'voip'. However, the traffic is still being dropped. What should the engineer check next?

A.Confirm that the VoIP protocol is supported by App-ID.

B.Ensure that the security rule action is set to 'allow' and not 'deny'.

C.Verify that the application override is not set for this traffic.

D.Check if a vulnerability protection profile is dropping the traffic based on a threat signature.

AnswerD

Correct: Security profiles can drop traffic even if the security rule allows the application.

Why this answer

Even when App-ID correctly identifies the traffic as 'voip' and a security rule allows it, a vulnerability protection profile applied to the rule can still drop the traffic if it matches a threat signature. This is a common scenario where the firewall's threat prevention engine, not the security rule, is responsible for the drop. The engineer should inspect the threat logs for any matching signatures.

Exam trap

The trap here is that candidates assume a security rule 'allow' action guarantees traffic passage, overlooking that threat prevention profiles (vulnerability, anti-spyware, etc.) can independently drop traffic after the rule is matched.

How to eliminate wrong answers

Option A is wrong because the traffic logs already show the application is identified as 'voip', indicating App-ID successfully classified it; confirming protocol support is unnecessary. Option B is wrong because the security rule action is already set to 'allow' (as stated in the question), so checking this again would not resolve the drop. Option C is wrong because an application override would force a specific application label, but the logs show 'voip' is already correctly identified, and an override would not cause a drop unless misconfigured; the issue is likely a threat profile, not an override.

Full explanation →

260

MCQeasy

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

A.Mask the original source IP address for privacy.

B.Inspect encrypted traffic for malware, exploits, and data leakage.

C.Allow only inbound SSL traffic to be inspected.

D.Improve network performance by reducing encryption overhead.

AnswerB

Core function of SSL decryption.

Why this answer

SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Exam trap

The trap here is that candidates often confuse SSL decryption with performance optimization or privacy features, but the PCNSE exam emphasizes that its core purpose is to enable visibility and inspection of encrypted traffic for threat detection.

How to eliminate wrong answers

Option A is wrong because masking the original source IP address is the function of source NAT (SNAT) or privacy features like Private IP masking, not SSL decryption. Option C is wrong because SSL decryption can inspect both inbound and outbound traffic; it is not limited to inbound SSL traffic only. Option D is wrong because SSL decryption actually adds processing overhead due to the decryption/re-encryption cycle, it does not improve network performance or reduce encryption overhead.

Full explanation →

261

MCQeasy

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

A.Dynamic NAT (1:1 pool)

B.Static NAT (1:1)

C.Destination NAT

D.Source NAT with IP and port translation (PAT)

AnswerD

PAT enables many internal IPs to share a single public IP via port multiplexing.

Why this answer

Source NAT with IP and port translation (PAT) allows 500 internal users to share a single public IP address by translating each private source IP:port combination to the public IP with a unique source port. This conserves public IPv4 addresses and is the standard method for large-scale internet access from a private network.

Exam trap

The trap here is that candidates confuse Dynamic NAT (which still requires a pool of public IPs) with PAT, assuming any 'dynamic' method can share a single IP, but only PAT performs port-level multiplexing to achieve this.

How to eliminate wrong answers

Option A is wrong because Dynamic NAT (1:1 pool) maps each internal IP to a unique public IP from a pool, requiring at least 500 public IPs, not a single one. Option B is wrong because Static NAT (1:1) provides a fixed one-to-one mapping between a private IP and a public IP, which also requires a public IP per user and does not scale. Option C is wrong because Destination NAT translates the destination IP/port of inbound traffic, not the source address of outbound traffic, and thus cannot provide internet access for internal users.

Full explanation →

262

MCQeasy

An organization uses GlobalProtect to provide VPN access to remote users. After connecting, users can access internal resources, but the firewall's User-ID does not show the usernames in the logs or policy matches. The GlobalProtect gateway is configured to use the authentication server for user mapping. The authentication server (LDAP) is reachable from the firewall. The firewall's User-ID settings have the 'GlobalProtect' mapping method enabled. What is the most likely reason that users are not being identified?

A.The firewall's security policies are not configured to use User-ID.

B.The GlobalProtect portal is not distributing the correct gateway list.

C.The authentication server profile is not configured with the correct bind password.

D.The GlobalProtect gateway is not configured to collect User-ID information.

AnswerD

The gateway must be enabled to collect and send user mappings to the firewall.

Why this answer

The GlobalProtect gateway must have the 'Collect User-ID Information' option enabled to send user mapping data to the firewall. Without this setting, the gateway does not forward the authenticated username to the firewall's User-ID agent, so even though the authentication server is reachable and the GlobalProtect mapping method is enabled, the firewall never receives the user-to-IP mapping. This is a common misconfiguration where the gateway authenticates users but fails to propagate the identity information.

Exam trap

The trap here is that candidates assume enabling the GlobalProtect mapping method on the firewall's User-ID settings is sufficient, but they overlook the separate requirement on the gateway to actually collect and forward the user identity information.

How to eliminate wrong answers

Option A is wrong because security policies do not need to explicitly 'use User-ID' as a configuration step; User-ID is a data-plane feature that populates the user-to-IP mapping table, and policies automatically match against that table when user-based conditions are set. Option B is wrong because the portal's gateway list distribution affects which gateways users connect to, not whether the gateway collects and forwards User-ID information. Option C is wrong because the authentication server profile's bind password is used for LDAP connectivity; the question states the LDAP server is reachable, so the bind password is correct, and the issue is specifically about the gateway not collecting User-ID data.

Full explanation →

263

MCQmedium

A firewall is configured with two ISPs for redundancy. The administrator wants to ensure that traffic from internal users is load-balanced across both links based on source IP. Which configuration method should be used?

A.Static routes with different metrics

B.Policy-Based Forwarding (PBF)

C.Path monitoring

D.ECMP with source IP hash

AnswerD

ECMP with source IP hash load-balances traffic across equal-cost paths.

Why this answer

D is correct because ECMP (Equal-Cost Multi-Path) with source IP hash enables the firewall to load-balance traffic across multiple equal-cost routes by hashing the source IP address, ensuring that all packets from the same source IP consistently use the same link. This method provides per-source-IP stickiness while distributing traffic across both ISPs, meeting the requirement for load balancing based on source IP.

Exam trap

The trap here is that candidates often confuse Policy-Based Forwarding (PBF) with load balancing, but PBF is for policy-based routing decisions, not for distributing traffic across equal-cost paths based on source IP hash.

How to eliminate wrong answers

Option A is wrong because static routes with different metrics create an active/passive failover scenario, not load balancing; traffic will only use the route with the lower metric unless it fails. Option B is wrong because Policy-Based Forwarding (PBF) is used for traffic steering based on policies (e.g., application, destination), not for load balancing based on source IP hash across equal-cost paths. Option C is wrong because path monitoring is a feature to detect link failures and trigger route changes, not a method for distributing traffic across multiple active links.

Full explanation →

264

Multi-Selecteasy

Which TWO are required for SNMP monitoring of a Palo Alto Networks firewall? (Choose two.)

Select 2 answers

A.Enable SNMP on the firewall (set snmp-server enable).

B.Specify an SNMP trap destination.

C.Define an SNMP v3 user with authentication.

D.Create an SNMP trap profile for high CPU.

E.Configure an SNMP community string (set snmp-server community public).

AnswersA, E

The SNMP service must be enabled.

Why this answer

SNMP monitoring requires the SNMP agent to be enabled on the firewall. The command 'set snmp-server enable' activates the SNMP service, allowing the firewall to respond to SNMP queries from a management station. Without this, no SNMP communication can occur regardless of other configurations.

Exam trap

The trap here is that candidates often confuse optional SNMP features (like traps or v3 authentication) with the mandatory prerequisites for basic SNMP monitoring, leading them to select unnecessary options like trap destinations or v3 users.

Full explanation →

265

MCQhard

An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?

A.The portal's authentication profile does not pass the OTP to the gateway

B.The RADIUS server does not return a session timeout

C.The firewall is not configured to allow RADIUS traffic

D.The gateway is not configured to use RADIUS

AnswerD

The gateway must have its own authentication profile; if not set, it may use default local authentication which fails.

Why this answer

When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.

Exam trap

The trap here is that candidates assume successful portal authentication implies the gateway inherits the same RADIUS configuration, but in GlobalProtect, the portal and gateway are separate authentication contexts requiring independent configuration.

How to eliminate wrong answers

Option A is wrong because the portal's authentication profile does not need to pass the OTP to the gateway; the gateway independently authenticates the user via its own RADIUS profile, and OTP is validated per session. Option B is wrong because a missing session timeout from RADIUS would not cause the gateway connection to fail; it would only affect session duration or re-authentication behavior. Option C is wrong because if the firewall were not configured to allow RADIUS traffic, the portal authentication would also fail, contradicting the scenario where portal authentication succeeds.

Full explanation →

266

MCQeasy

A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?

A.Authentication Policy requiring authentication for all traffic

B.GlobalProtect client certificate authentication

C.Security policy using source-user attribute

D.Captive Portal with cookie-based authentication

AnswerA

Authentication Policy forces users to authenticate before traffic is allowed, preventing IP-based bypass.

Why this answer

Authentication Policy enforces authentication for all traffic, ensuring that only authenticated users can access resources regardless of their IP address. This prevents bypassing by manually setting a different IP. Option B (GlobalProtect client certificate authentication) does not prevent IP spoofing as certificates are tied to devices, not IPs.

Option C (Security policy using source-user attribute) relies on User-ID mapping, which can be spoofed if the IP is changed before mapping. Option D (Captive Portal with cookie-based authentication) can be bypassed if the user does not go through the portal or if cookies are manipulated.

Full explanation →

267

MCQeasy

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

A.Panorama with Dedicated Log Collectors

B.Panorama with Log Collectors

C.Panorama without Log Collectors

D.Panorama in High Availability mode

AnswerC

Firewalls store logs locally; Panorama only manages configurations.

Why this answer

Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Exam trap

The trap here is that candidates often assume Panorama always requires log forwarding for centralized management, confusing the management plane (configuration/policy) with the data plane (logging), and thus overlook the 'without Log Collectors' mode as a valid deployment option.

How to eliminate wrong answers

Option A is wrong because Panorama with Dedicated Log Collectors requires logs to be sent from firewalls to dedicated collector hardware, not stored locally. Option B is wrong because Panorama with Log Collectors (using the built-in collector on the Panorama appliance) also forwards logs from firewalls to Panorama, not local storage. Option D is wrong because Panorama in High Availability mode is a redundancy configuration that can be used with or without log collectors, and does not inherently change where logs are stored; logs are still sent to Panorama if collectors are configured.

Full explanation →

268

MCQhard

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

A.Change the HA mode to Active/Passive

B.Adjust the session distribution algorithm to match traffic patterns

C.Increase the HA2 link bandwidth using link aggregation

D.Enable session synchronization for all sessions

AnswerB

Proper distribution reduces asymmetric routing.

Why this answer

In an Active/Active HA pair, session distribution is controlled by a hash-based algorithm that determines which firewall handles a given flow. When asymmetric routing and drops occur during high session utilization, the default algorithm may not distribute traffic evenly, causing one firewall to become overloaded. Adjusting the session distribution algorithm (e.g., from IP hash to round-robin or a weighted distribution) can better match the traffic patterns and balance the load, reducing asymmetry and drops.

Exam trap

The trap here is that candidates often assume increasing HA2 bandwidth or enabling session synchronization will fix load imbalance, but these address sync throughput, not the root cause of uneven session distribution.

How to eliminate wrong answers

Option A is wrong because changing to Active/Passive would eliminate the load-sharing benefit of Active/Active, leaving one firewall idle and potentially still causing drops on the active unit during a traffic spike. Option C is wrong because increasing HA2 link bandwidth (used for session synchronization and state propagation) does not affect how sessions are initially distributed; it only improves the throughput of sync traffic, not the load-balancing algorithm. Option D is wrong because session synchronization is already enabled by default in Active/Active mode to maintain state; enabling it for all sessions does not change the distribution algorithm and will not optimize how sessions are assigned to firewalls.

Full explanation →

269

Multi-Selectmedium

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Select 2 answers

A.Management Plane

B.Session Table

C.Threat Prevention Engine

D.Log Database

E.Packet Buffer

AnswersB, E

The session table is maintained by the dataplane for stateful inspection.

Why this answer

The Session Table is a core dataplane component because it stores stateful session information for all active traffic flows. The dataplane uses this table to perform fast-path forwarding, applying security policies and NAT translations without involving the management plane. Without the session table, the firewall would be unable to maintain stateful inspection, which is fundamental to its operation.

Exam trap

The trap here is that candidates often confuse the Management Plane with the dataplane, or mistakenly think that features like Threat Prevention are separate hardware components rather than software functions running on the dataplane.

Full explanation →

270

MCQeasy

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

A.Configuration log

B.Traffic log

C.Threat log

D.System log

AnswerB

Traffic logs show session details including the security rule that matched.

Why this answer

The Traffic log records every session that matches a security rule, including the rule ID, source/destination IPs, ports, and action (allow/deny). To verify that a specific security rule is being hit, you must examine the Traffic log, as it shows which rule processed each session. Configuration, Threat, and System logs do not contain per-session rule match data.

Exam trap

The trap here is that candidates confuse the Traffic log with the Threat log, thinking that only malicious traffic generates logs, but the Traffic log records all allowed and denied sessions regardless of threat status.

How to eliminate wrong answers

Option A is wrong because the Configuration log records administrative changes to the firewall (e.g., rule modifications, commits), not traffic matching events. Option C is wrong because the Threat log captures intrusion prevention, antivirus, or vulnerability exploits, not standard rule hits. Option D is wrong because the System log contains system-level events (e.g., HA state changes, disk errors, license expiry), not per-session rule match information.

Full explanation →

271

MCQhard

An administrator has applied the above configuration on a firewall. What will happen to traffic destined to TCP port 2525?

A.All traffic on TCP port 2525 will be classified as the application 'smtp'.

B.The firewall will perform deeper inspection to identify the application.

C.The traffic will be blocked because the application is unknown.

D.The traffic will be treated as generic TCP and passed without inspection.

AnswerA

The application override forces identification as SMTP.

Why this answer

The firewall's application override configuration explicitly maps TCP port 2525 to the application 'smtp'. When an application override is applied, the firewall bypasses App-ID and classifies all traffic matching the specified port and protocol as the defined application, regardless of the actual payload. This means any traffic on TCP port 2525 will be treated as SMTP traffic for policy enforcement and inspection purposes.

Exam trap

The trap here is that candidates may assume the firewall always performs deep packet inspection to identify applications, but application override explicitly disables App-ID for the specified traffic, forcing a static classification.

How to eliminate wrong answers

Option B is wrong because when an application override is configured, the firewall does not perform deeper inspection to identify the application; it skips App-ID entirely and uses the static mapping. Option C is wrong because the traffic will not be blocked due to an unknown application; the override ensures it is classified as 'smtp', so it will be allowed or denied based on security policy rules referencing that application. Option D is wrong because the traffic is not treated as generic TCP; the application override forces it to be identified as 'smtp', which means it will be subject to any application-specific security policies and threat inspections.

Full explanation →

272

MCQmedium

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

A.Users are manually selecting the wrong gateway from the client.

B.The gateways are not configured with priority settings.

C.The gateway selection rules on the portal do not match the users' source IP ranges.

D.The DNS resolution for the portal returns multiple IPs in round-robin.

AnswerC

If the source IP ranges in the rules are incorrect, users may be assigned to a non-optimal gateway.

Why this answer

GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Exam trap

The trap here is that candidates often confuse gateway priority (which controls load balancing within a region) with gateway selection rules (which control which region's gateway a user connects to), leading them to incorrectly choose Option B.

How to eliminate wrong answers

Option A is wrong because while manual selection is possible, the scenario describes users 'connecting to the wrong gateway,' which implies an automated selection failure, not user error; manual selection would require deliberate action and is not the 'most likely cause' in a multi-region deployment. Option B is wrong because priority settings on gateways control load balancing and failover order among gateways within the same region, not which region a user connects to; gateway selection is based on portal rules, not gateway priority. Option D is wrong because DNS round-robin for the portal would distribute users across multiple portal IPs, but the portal itself still enforces gateway selection rules; this would not cause users to connect to the wrong gateway unless the portal configuration is incorrect.

Full explanation →

273

Multi-Selectmedium

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Select 3 answers

A.Verify the routing table on both firewalls.

B.Check the firewall policies for the tunnel zone.

C.Increase the IPSec SA lifetime.

D.Verify the proxy IDs on both peers match.

E.Ensure the tunnel interface is placed in a virtual router.

AnswersA, B, D

Correct. Routing must direct traffic into the tunnel.

Why this answer

Even if the VPN tunnel is up (Phase 1 and Phase 2 SAs established), traffic may still fail if the firewall does not have a route to the destination network via the tunnel interface. Without a correct route in the routing table, the firewall will drop the packet or send it out the wrong interface. Verifying the routing table ensures that the tunnel interface is the next hop for the remote subnet.

Exam trap

The trap here is that candidates assume a tunnel being 'up' guarantees traffic flow, but the PCNSE exam tests that you must separately verify routing, security policies, and proxy IDs—each of which can block traffic independently of the tunnel's control-plane state.

Full explanation →

274

Matchingmedium

Match each security profile type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Detects and blocks malware in traffic

Prevents spyware and command-and-control traffic

Blocks exploits targeting known vulnerabilities

Controls access to websites based on category

Blocks specific file types from being transferred

Why these pairings

The correct matches are: Antivirus scans for malware, Anti-Spyware protects against spyware, Vulnerability Protection prevents exploitation. URL Filtering categorizes URLs, and File Blocking blocks file types. Options D and E swap these definitions.

Full explanation →

275

MCQhard

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

A.The traffic is blocked because the source-user is 'unknown'.

B.The traffic is allowed without authentication because the source-user is 'unknown'.

C.The user is prompted to authenticate via the configured authentication profile.

D.The user is redirected to the captive portal.

AnswerC

The 'allow-authentication' action initiates an authentication challenge for the user.

Why this answer

When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication.

Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Full explanation →

276

MCQmedium

Which best practice should be followed for certificate management when deploying SSL Forward Proxy decryption in a large enterprise?

A.Use an internal certificate authority (CA) and distribute the CA certificate to all clients via Group Policy.

B.Use a self-signed certificate and manually install it on each client.

C.Use a wildcard certificate from a public CA to simplify deployment.

D.Use a certificate from a public CA that is already trusted by clients.

AnswerA

Standard best practice for enterprise environments.

Why this answer

Using an internal CA and distributing its certificate via Group Policy ensures that all clients trust the decryption certificate used by the firewall to re-encrypt traffic. This avoids certificate warnings and allows seamless SSL Forward Proxy decryption. It also enables centralized management and revocation, which is critical for large enterprise deployments.

Exam trap

Palo Alto Networks often tests the misconception that a public CA certificate can be used directly for re-encryption, but the trap here is that the firewall must generate certificates on-the-fly, requiring an internal CA to sign them, not a public CA certificate that would expose the private key.

How to eliminate wrong answers

Option B is wrong because self-signed certificates are not trusted by clients by default, requiring manual installation on every client, which is impractical and insecure in a large enterprise. Option C is wrong because wildcard certificates from a public CA cannot be used for SSL Forward Proxy decryption; the firewall must generate a unique certificate per session, and a wildcard certificate would expose the private key to the firewall, violating security best practices. Option D is wrong because a public CA certificate already trusted by clients would not allow the firewall to decrypt traffic; the firewall needs to present a certificate that clients trust, but using a public CA certificate for re-encryption would require the firewall to hold the private key, which is a security risk and not scalable.

Full explanation →

277

MCQmedium

An administrator receives an alert that a firewall's disk usage is at 85%. The administrator wants to reduce disk usage by automatically deleting older log files. Which action should be taken?

A.Add an external disk to the firewall

B.Configure log export and auto-deletion in Log Settings

C.Disable logging for non-critical traffic

D.Manually delete logs from the CLI

AnswerB

Log Settings allow automatic deletion of old logs.

Why this answer

The firewall's log settings allow administrators to configure automatic log export and auto-deletion policies. By enabling log export to an external server (e.g., syslog) and setting a retention period or disk usage threshold, the firewall will automatically purge older log files when disk usage reaches a specified limit, such as 85%. This directly addresses the need to reduce disk usage without manual intervention or disabling logging.

Exam trap

The trap here is that candidates may confuse 'adding external storage' (Option A) as a solution for disk usage, but the question specifically asks for automatic deletion of older logs, not just expanding capacity.

How to eliminate wrong answers

Option A is wrong because adding an external disk does not automatically delete older logs; it only provides additional storage, which may delay but not solve the underlying issue of log growth. Option C is wrong because disabling logging for non-critical traffic reduces visibility and is not a targeted method for managing disk usage; it also violates best practices for security monitoring. Option D is wrong because manually deleting logs from the CLI is a reactive, non-automated approach that requires ongoing administrative effort and does not provide a sustainable solution for automatic log rotation.

Full explanation →

278

MCQhard

A Palo Alto Networks firewall is configured for SSL Forward Proxy decryption. The security team wants to ensure that decrypted traffic is also inspected by an external DLP appliance. How should this be achieved?

A.Configure the DLP appliance to decrypt traffic itself.

B.Configure a Decryption Policy to decrypt traffic and then use a Decryption Forwarding service to forward decrypted traffic to the DLP appliance.

C.Configure the firewall to re-encrypt traffic before sending to DLP.

D.Add a decryption policy on the firewall to exclude traffic to the DLP appliance.

AnswerB

This is the correct method using Decryption Forwarding feature.

Why this answer

The Palo Alto Networks firewall can be configured with a Decryption Forwarding service, which allows decrypted traffic to be forwarded to an external DLP appliance for additional inspection. This is achieved by defining a Decryption Forwarding profile that specifies the DLP appliance as the destination, ensuring that traffic decrypted by the SSL Forward Proxy is sent in clear text to the DLP appliance for content inspection.

Exam trap

The trap here is that candidates may think re-encrypting traffic (Option C) is necessary for security, but the correct approach is to forward decrypted traffic in clear text to the DLP appliance, as re-encryption would require the DLP to decrypt again, defeating the purpose of the inspection.

How to eliminate wrong answers

Option A is wrong because the DLP appliance decrypting traffic itself would require it to have access to the private keys or to perform a man-in-the-middle decryption, which is redundant and bypasses the firewall's decryption capabilities; the firewall is already performing SSL Forward Proxy decryption. Option C is wrong because re-encrypting traffic before sending to the DLP appliance would defeat the purpose of inspection, as the DLP appliance would need to decrypt it again to analyze the content, adding unnecessary complexity and latency. Option D is wrong because excluding traffic to the DLP appliance from decryption would mean the traffic sent to the DLP appliance remains encrypted, preventing the DLP appliance from inspecting the content; the decryption policy should include the traffic destined for the DLP appliance.

Full explanation →

279

Multi-Selecthard

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Select 2 answers

A.Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup

B.Check HA1 link utilization

C.Increase the packet buffer protection threshold

D.Review the session synchronization configuration for mismatched parameters (e.g., encryption, timeout)

E.Restart the HA process on both firewalls

AnswersA, D

If disabled, no sync occurs.

Why this answer

The two most effective troubleshooting steps are A and D. A is correct because if session synchronization is disabled, sessions will not sync. Under Device > High Availability > Setup, you must verify that session synchronization is enabled on both firewalls.

D is correct because mismatched parameters such as encryption, timeout, or other session sync settings can prevent synchronization. B is wrong because HA1 link utilization does not directly affect session synchronization; HA1 is for control traffic, and session data is sent over HA2 or HA3. C is wrong: increasing the packet buffer protection threshold is for buffer exhaustion issues, not session synchronization.

E is wrong: restarting the HA process is a disruptive step and should only be attempted after verifying other settings; it is not a primary troubleshooting step.

Full explanation →

280

MCQmedium

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

A.The tunnel interface is not assigned to a security zone.

B.Dead peer detection (DPD) is not configured.

C.The local and peer IP addresses are swapped on one side.

D.The MTU on the WAN interface is set too low.

AnswerC

If the local and peer IPs are reversed, the IKE negotiation will fail because the peer expects the opposite.

Why this answer

If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Exam trap

The trap here is that candidates assume matching pre-shared keys and encryption algorithms guarantee tunnel establishment, overlooking the fundamental requirement that the IKE gateway's local and peer IP addresses must be correctly mirrored on both sides.

How to eliminate wrong answers

Option A is wrong because a tunnel interface not assigned to a security zone would prevent traffic from being processed by security policies, but it does not prevent the IKEv2 tunnel from establishing at the IKE/Phase 1 level. Option B is wrong because Dead Peer Detection (DPD) is used to monitor the liveliness of an established tunnel, not to bring it up; a missing DPD configuration does not block the initial IKE negotiation. Option D is wrong because an MTU set too low on the WAN interface could cause fragmentation issues for encapsulated packets, but it would not prevent the IKEv2 handshake from starting; the tunnel would likely come up but experience packet drops for larger payloads.

Full explanation →

281

MCQhard

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

A.The 'interface-address' option requires a specific translated address.

B.The rule is missing a 'from' zone specification.

C.The rule should be under 'destination-nat' instead of 'source-nat'.

D.The 'to-interface' should be 'any'.

AnswerB

Source NAT rules must include the source zone to determine when to translate.

Why this answer

A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Exam trap

The trap here is that candidates often assume source NAT rules only need a source IP range and an egress interface, overlooking the mandatory 'from' zone specification that PAN-OS requires for rule matching.

How to eliminate wrong answers

Option A is wrong because the 'interface-address' option does not require a specific translated address; it dynamically uses the IP address of the egress interface (ethernet1/1) as the translated source address, which is valid. Option C is wrong because the scenario describes source NAT (translating source IP of outbound traffic), not destination NAT (which translates destination IP of inbound traffic), so placing it under 'destination-nat' would be incorrect. Option D is wrong because setting 'to-interface' to 'any' would not fix the missing 'from' zone; the 'to-interface' specifies the egress interface for the translated traffic, and ethernet1/1 is appropriate for internet-bound traffic.

Full explanation →

282

Multi-Selecteasy

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Select 2 answers

A.Set the Source Zone and Destination Zone.

B.Enable Threat Prevention.

C.Set the Service to 'application-default'.

D.Configure Logging at session start.

E.Set the Application to the specific application.

AnswersC, E

application-default restricts the rule to the application's default port.

Why this answer

To ensure a security policy rule matches only when a specific application is detected on its standard port, two settings are required: Set the Application to the specific application to match that application's traffic, and set the Service to 'application-default' to restrict matching to the standard port used by that application. This prevents other applications using the same port from triggering the rule. The other options are not directly related to this requirement: Source and Destination zones are necessary for any rule but not specific to application/port matching; Threat Prevention is a separate feature; logging at session start is optional and does not affect matching.

Full explanation →

283

MCQeasy

A company has configured a security policy that allows HTTP traffic from the internal network 10.0.0.0/8 to the internet. However, users from subnet 10.2.0.0/24 are unable to access external websites. The firewall logs show that traffic from 10.2.0.100 to 203.0.113.1 on port 80 is being denied. Which action should the administrator take to resolve the issue?

A.Modify the existing allow rule to include the entire 10.2.0.0/24 subnet in the source.

B.Change the destination zone of the allow rule to 'any'.

C.Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.

D.Delete the deny rule that is blocking the traffic.

AnswerC

A rule placed higher in the order matches first. Adding an allow rule above the deny rule will permit the traffic.

Why this answer

In a stateful firewall like Palo Alto Networks, security rules are evaluated in order from top to bottom, and the first matching rule is applied. If a deny rule exists above any allow rule for the 10.2.0.0/24 subnet, traffic from that subnet will be denied. Adding a new allow rule for 10.2.0.0/24 and placing it above the existing deny rule ensures that HTTP traffic from that subnet is permitted before reaching the deny rule.

Exam trap

The trap here is that candidates assume modifying the existing allow rule or deleting the deny rule will fix the issue, but they overlook the fundamental principle of rule order in a first-match firewall, where a higher-priority deny rule will block traffic even if a lower-priority allow rule exists.

How to eliminate wrong answers

Option A is wrong because the existing allow rule already permits traffic from 10.0.0.0/8, which includes 10.2.0.0/24; the issue is that a deny rule is matching before the allow rule, so modifying the source is unnecessary and does not address the rule order. Option B is wrong because changing the destination zone to 'any' would not resolve the issue, as the problem is not zone-based but rather the rule order and a specific deny rule blocking the traffic. Option D is wrong because deleting the deny rule may be too aggressive and could remove necessary security controls; the proper approach is to add a more specific allow rule above it to override the deny only for the intended subnet.

Full explanation →

284

MCQmedium

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

A.The security policy rule's logging setting

B.The interface management profile

C.The log retention settings

D.The system log severity level

AnswerA

The rule may have 'Log at Session End' set to 'None' instead of 'Enabled', which would suppress logs.

Why this answer

Even though the security policy rule has 'Log at Session End' enabled, logs may still not be generated if the setting is not correctly applied to the rule or if a logging profile overrides it. The engineer should verify the rule's logging configuration to ensure it is properly set and that no other rule or logging profile is suppressing the logs. Option A is correct because checking the logging setting on the rule is the first step to troubleshoot missing logs.

Exam trap

The trap here is that candidates often confuse 'Log at Session End' with other logging mechanisms (like system logs or interface management) and assume logs are generated by default for allowed traffic, when in fact they must be explicitly enabled per security policy rule.

How to eliminate wrong answers

Option B is wrong because the interface management profile controls administrative access (e.g., ping, SSH, HTTPS) to the firewall interface, not the generation of traffic logs for allowed sessions. Option C is wrong because log retention settings determine how long logs are stored (e.g., on disk or forwarded to an external collector), not whether logs are initially generated for a session. Option D is wrong because the system log severity level filters system-level events (e.g., critical, warning) sent to syslog, not the generation of traffic logs for allowed sessions, which are controlled by the security policy rule's logging configuration.

Full explanation →

285

MCQeasy

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

A.The source and destination zones in the security policy

B.The firewall's DNS settings

C.The server's SSL certificate

D.The interface management profile

AnswerA

Mismatched zones are a common reason for policy not matching traffic.

Why this answer

The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct.

This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Exam trap

The trap here is that candidates often jump to checking DNS or certificates (common web server issues) instead of first verifying the fundamental zone-based policy matching, which is unique to Palo Alto Networks firewalls and a frequent cause of silent traffic drops.

How to eliminate wrong answers

Option B is wrong because DNS settings on the firewall affect only the firewall's own name resolution (e.g., for FQDN objects or external services), not the ability for users to reach an internal web server; client-side DNS resolution is independent of the firewall's DNS configuration. Option C is wrong because the server's SSL certificate is irrelevant to basic connectivity; certificate issues cause browser warnings or TLS handshake failures, not a complete inability to reach the server (which would be a network-layer problem). Option D is wrong because the interface management profile controls administrative access (e.g., HTTPS, SSH, ping) to the firewall interface itself, not the forwarding of user traffic through the firewall.

Full explanation →

286

Multi-Selecthard

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Select 2 answers

A.TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

B.TLS 1.3 decryption is supported in PAN-OS 9.0 and later.

C.TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

D.TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

E.TLS 1.3 decryption is supported for both forward proxy and inbound inspection.

AnswersB, E

Palo Alto Networks introduced TLS 1.3 decryption starting from PAN-OS 9.0.

Why this answer

TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Exam trap

The trap here is that candidates often assume TLS 1.3 decryption requires the same proxy ciphers as TLS 1.2 or is limited to inbound inspection, but Palo Alto Networks explicitly supports both forward proxy and inbound inspection with distinct cipher suite handling starting in PAN-OS 9.0.

Full explanation →

287

Multi-Selecthard

Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)

Select 3 answers

A.Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.

B.Update the URL filtering database to ensure the site is categorized correctly.

C.Verify that the firewall's decryption certificate is trusted by the client.

D.Disable decryption globally to see if the sites become accessible.

E.Use the packet capture tool to analyze the SSL handshake between client, firewall, and server.

AnswersA, C, E

Logs provide specific error hints.

Why this answer

The decryption log provides direct visibility into SSL/TLS handshake failures. Errors like 'ssl_decrypt_unsupported_cipher' indicate the firewall cannot negotiate a cipher it supports, while 'ssl_decrypt_cert_verify_failed' points to certificate validation issues, such as an untrusted or expired server certificate. These logs are the primary diagnostic tool for pinpointing why decryption fails for specific HTTPS sites.

Exam trap

The trap here is that candidates often confuse decryption failures with URL filtering or policy issues, leading them to select option B, when in fact decryption logs and certificate trust are the direct troubleshooting steps for SSL decryption problems.

Full explanation →

288

MCQeasy

A company with multiple branch offices connects to headquarters using IPSec VPN tunnels terminated on PA-220 firewalls. Users at one branch report intermittent connectivity issues when accessing critical applications hosted at HQ. Ping tests to HQ servers succeed consistently, but TCP-based applications (e.g., file transfers, web access) frequently drop connections after a few seconds, particularly when transferring large data. The VPN tunnel status shows 'active' with no rekeys. Security policies are configured to allow all required application traffic. Interface statistics show no discards or errors. Which action should be taken to resolve the issue?

A.Disable TCP checksum offloading on the clients.

B.Change the IPSec encryption algorithm from AES-256 to AES-128.

C.Increase the TCP timeout value in the security policy.

D.Reduce the MTU on the branch firewall's WAN interface to 1400.

AnswerD

MTU mismatch across VPN can cause packet fragmentation and reassembly issues, leading to drops for large packets. Reducing MTU ensures packets fit within the tunnel.

Why this answer

The symptoms—consistent pings but TCP drops on large transfers—strongly point to a Path MTU Discovery (PMTUD) failure. When the VPN tunnel encapsulates packets with IPsec headers, the effective MTU shrinks. If the WAN interface MTU remains at the default 1500, large TCP segments get fragmented or dropped, causing TCP connections to stall.

Reducing the MTU on the branch firewall's WAN interface to 1400 ensures that the total packet size (including IPsec overhead) stays within the path's physical MTU, allowing PMTUD to work correctly and preventing silent packet drops.

Exam trap

The trap here is that candidates see 'VPN tunnel active' and 'no errors' and assume the issue is application-layer or security-policy-related, overlooking the classic symptom of PMTUD failure where pings succeed (small packets) but TCP transfers fail (large packets).

How to eliminate wrong answers

Option A is wrong because disabling TCP checksum offloading on clients addresses NIC-level checksum errors, not MTU or fragmentation issues; the interface statistics show no errors, ruling out checksum problems. Option B is wrong because changing the encryption algorithm from AES-256 to AES-128 does not affect packet size or fragmentation—both add the same IPsec overhead (block size difference is negligible) and would not resolve PMTUD failures. Option C is wrong because increasing the TCP timeout in the security policy only extends how long the firewall keeps a session open without traffic; it does not fix the underlying packet loss caused by oversized packets being silently dropped.

Full explanation →

289

MCQmedium

Refer to the exhibit. A firewall administrator configures an IPSec tunnel. After committing, the tunnel never becomes active. What is the most likely reason?

A.The tunnel interface is not in a zone.

B.The IKE gateway configuration is missing.

C.The proxy-id protocol should be set to '0' for all.

D.The crypto profile name is invalid.

AnswerB

Correct. Without a valid IKE gateway, the tunnel cannot establish.

Why this answer

B is correct because an IPSec tunnel requires both an IKE gateway configuration and an IPSec crypto profile to establish Phase 1 and Phase 2 security associations. Without the IKE gateway, the firewall has no peer address, authentication method, or pre-shared key to initiate IKEv1/v2 exchanges, so the tunnel remains down. The exhibit likely shows a tunnel interface and crypto profile but omits the IKE gateway object, which is mandatory for tunnel activation.

Exam trap

The PCNSE exam often tests the misconception that configuring a tunnel interface and crypto profile is sufficient for an IPSec tunnel. However, the IKE gateway is a mandatory prerequisite for Phase 1 negotiation; its absence is a frequent root cause of inactive tunnels on Palo Alto firewalls.

How to eliminate wrong answers

Option A is wrong because a tunnel interface can be placed in a zone after the tunnel is established; the zone assignment does not prevent the tunnel from becoming active, as the tunnel interface is a virtual interface that only needs a zone for policy enforcement. Option C is wrong because setting the proxy-id protocol to '0' for all would disable traffic selection and cause the tunnel to match no traffic, but the tunnel can still come up with a mismatched proxy-id; the issue here is the missing IKE gateway, not proxy-id values. Option D is wrong because an invalid crypto profile name would cause a commit error or a warning, but the tunnel would still attempt to come up if the IKE gateway existed; the question states the tunnel never becomes active, implying a missing mandatory component, not a name mismatch.

Full explanation →

290

Multi-Selecteasy

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Select 2 answers

A.LDAP

B.Local Database

C.Kerberos

D.RADIUS

E.SAML

AnswersC, E

Kerberos provides transparent SSO for domain users.

Why this answer

Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Exam trap

The trap here is that candidates often assume RADIUS or LDAP support SSO because they are common authentication protocols, but neither provides the ticket or assertion exchange required for true single sign-on; only Kerberos and SAML implement SSO mechanisms in Palo Alto firewalls.

Full explanation →

291

MCQhard

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

A.HA2 heartbeat link is down, preventing the passive from detecting the active's failure.

B.The fail-holdup timer is set to 0, causing immediate failover but not triggered.

C.Link monitoring is enabled but not configured to monitor the specific interface that failed.

D.Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.

AnswerC

Link monitoring must include the interface; otherwise, its state change is ignored for failover decisions.

Why this answer

Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Exam trap

The trap here is that candidates confuse link monitoring (local interface state) with path monitoring (remote reachability) or assume the HA2 heartbeat link is responsible for failure detection, when in fact HA1 keepalives handle that and link monitoring is the feature that must explicitly include the failed interface.

How to eliminate wrong answers

Option A is wrong because the HA2 heartbeat link is used for session synchronization and state propagation, not for detecting link failures; the passive detects active failure via HA1 keepalive packets, not HA2. Option B is wrong because the fail-holdup timer (default 0) controls how long the passive waits before taking over after detecting a failure, but it does not prevent detection of the failure itself; the issue here is that the failure was never detected. Option D is wrong because path monitoring is a separate feature that monitors connectivity to specific destination IP addresses (e.g., next-hop routers), not the state of local interfaces; disabling path monitoring would not prevent the passive from detecting a local interface failure, which is the domain of link monitoring.

Full explanation →

292

MCQmedium

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

A.The IKE phase 1 proposal is mismatched.

B.The proxy IDs (interesting traffic) are not configured correctly.

C.The IPSec crypto profile uses AES-256 and the peer uses 3DES.

D.The tunnel interface MTU is set too low.

AnswerB

Correct. Mismatched proxy IDs cause the firewall to not encrypt traffic.

Why this answer

When the IPSec tunnel is up but no traffic passes, the most common cause is misconfigured proxy IDs (also called interesting traffic selectors). Proxy IDs define which source/destination subnets are permitted through the tunnel; if they don't match on both peers, the tunnel may establish (IKE and IPsec SAs are created) but the firewall will not encrypt or forward traffic because it does not match the defined selectors. Since the firewall policy allows any-any, the issue is not a policy block, pointing directly to proxy ID mismatch.

Exam trap

The trap here is that candidates assume a tunnel being 'up' means all traffic should work, but in Palo Alto Networks, the tunnel state only reflects IKE and IPsec SA establishment, not the correctness of proxy IDs which control traffic selection.

How to eliminate wrong answers

Option A is wrong because an IKE phase 1 proposal mismatch would prevent the tunnel from coming up at all—the tunnel being up indicates phase 1 completed successfully. Option C is wrong because an IPSec crypto profile mismatch (e.g., AES-256 vs 3DES) would cause the tunnel to fail during phase 2 negotiation, not allow the tunnel to be up with no traffic. Option D is wrong because a low tunnel interface MTU would cause fragmentation or packet drops for large packets, but ICMP traffic (typically small packets) would still pass; it would not cause a complete failure of all traffic.

Full explanation →

293

Multi-Selectmedium

When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

Select 2 answers

A.less mp-log authd.log

B.show running security-policy

C.show user user-id count

D.show authentication rule matching traffic from the user's IP

E.show system resources

AnswersA, D

This log file contains detailed authentication daemon messages including failures and mismatches.

Why this answer

The `authd.log` file contains detailed authentication daemon logs, including credential challenges, authentication successes, and failures. When users are not prompted for credentials, this log reveals whether the firewall is even attempting to authenticate the user or if the request is being bypassed due to policy misconfiguration. Option D is correct because the `show authentication rule matching traffic from the user's IP` command allows you to test which authentication policy rule applies to a specific user's traffic, helping identify if the rule is missing, misordered, or incorrectly configured to skip credential prompting.

Exam trap

A common misconception in Palo Alto Networks environments is that security policies control authentication prompts, when in fact authentication is governed by a separate authentication policy that must be explicitly configured to trigger credential challenges.

Full explanation →

294

Multi-Selectmedium

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Select 2 answers

A.TCP sequence number mismatch due to packet reordering

B.Firewall interface speed mismatch

C.Security policy change after session creation

D.DNS resolution failure

E.Asymmetric routing

AnswersA, E

Reordering can cause the firewall to drop packets as out-of-state.

Why this answer

TCP sequence number mismatches can occur when packets are reordered, causing the firewall's TCP state engine to see an unexpected sequence number and drop the session. The firewall tracks TCP sequence numbers to validate that packets belong to an established session; if a packet arrives with a sequence number that does not match the expected window, the firewall may interpret it as a spoofed or invalid packet and terminate the session.

Exam trap

The trap here is that candidates often confuse session drops caused by policy changes (Option C) with stateful inspection issues, but Palo Alto firewalls do not retroactively apply policy changes to existing sessions unless explicitly configured to do so.

Full explanation →

295

MCQeasy

A network administrator notices that traffic logs are not being sent to the external Syslog server. The log forwarding profile is configured correctly. Which CLI command should be used to verify the Syslog server connectivity from the firewall?

A.show log forwarding

B.show system setting

C.test syslog

D.ping <syslog_server_ip>

AnswerC

This command sends a test Syslog message to confirm reachability and configuration.

Why this answer

The 'test syslog' command is specifically designed to verify Syslog server connectivity from the firewall by sending a test message and confirming receipt. Even if the log forwarding profile is correctly configured, network issues or server unavailability can prevent logs from being sent, and this command directly tests the Syslog transport (UDP 514 or TCP 6514) without relying on other services.

Exam trap

The trap here is that candidates confuse basic network connectivity (ping) with application-layer service verification, assuming a successful ping means Syslog will work, but Syslog requires the specific port to be open and the service to be running.

How to eliminate wrong answers

Option A is wrong because 'show log forwarding' displays the log forwarding profile configuration (e.g., server IP, port, format) but does not actively test connectivity or send a test message. Option B is wrong because 'show system setting' shows general system parameters (e.g., hostname, time zone) and has no capability to test Syslog server reachability. Option D is wrong because 'ping' tests ICMP echo requests to the server IP, which only verifies basic network layer reachability; it does not confirm that the Syslog service (UDP/TCP port) is listening or that the firewall can send Syslog messages to it.

Full explanation →

296

MCQmedium

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

A.The firewalls that are not receiving the template are not included in the same template stack.

B.The device group has not been committed.

C.The firewalls are not licensed for Panorama management.

D.The template is in 'preview' mode.

AnswerA

Correct. A template stack groups firewalls that share the same template configurations.

Why this answer

In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Exam trap

The trap here is that candidates often confuse device groups (which manage policy) with template stacks (which manage network configuration), assuming that membership in a device group automatically applies all associated templates.

How to eliminate wrong answers

Option B is wrong because the device group commit is separate from template commit; templates are committed as part of the Panorama configuration push, and a missing device group commit would affect policy, not template settings. Option C is wrong because Panorama management does not require a separate license for firewalls; it is a built-in capability of the firewall platform. Option D is wrong because Panorama does not have a 'preview' mode for templates; templates are either committed or not, and preview is a concept for policy rules, not network templates.

Full explanation →

297

MCQmedium

What does the session state 'SYN_SENT' indicate about this traffic flow?

A.The session has been torn down by the server.

B.The firewall has sent a SYN packet and is waiting for a response.

C.The traffic is being dropped due to asymmetric routing.

D.The application has been identified as incomplete.

AnswerB

SYN_SENT indicates the firewall is in the process of opening a connection.

Why this answer

The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Exam trap

The trap here is that candidates confuse SYN_SENT with a session teardown state or assume it indicates a problem like asymmetric routing, when in fact it is a normal transient state during TCP connection setup that only becomes problematic if it persists beyond the timeout.

How to eliminate wrong answers

Option A is wrong because a session torn down by the server would show states like FIN_WAIT, CLOSE_WAIT, or TIME_WAIT, not SYN_SENT, which is an initial handshake state. Option C is wrong because asymmetric routing typically causes sessions to be in a 'half-open' state or show as 'drop' due to security policy mismatch, not SYN_SENT; SYN_SENT is a normal transient state during connection establishment. Option D is wrong because application identification occurs after the TCP handshake completes and data is exchanged; SYN_SENT is too early in the flow for app-ID to be determined, and an 'incomplete' application would be flagged later, not at this stage.

Full explanation →

298

MCQmedium

A company has configured User-ID with Active Directory polling. Some users cannot access resources even though their security policy rules appear correct. The administrator verifies that the User-ID agent is connected and polling. What additional step should the administrator take?

A.Restart the User-ID agent service.

B.Check the firewall's management plane CPU usage.

C.Ensure the firewall has a license for User-ID.

D.Verify that the user group mapping is correct.

AnswerD

Group mapping is critical for security policies based on user groups.

Why this answer

Even if the User-ID agent is connected and polling, the firewall may not have the correct group-to-user mappings. Without accurate group mapping, security policies that reference user groups will fail to match, causing access issues for users who are members of those groups. The administrator should verify the group mapping configuration in the User-ID agent or on the firewall to ensure users are properly associated with their groups.

Exam trap

The trap here is that candidates assume a connected and polling User-ID agent guarantees correct policy enforcement, overlooking the critical step of verifying group mapping accuracy, which is a common misconfiguration in Active Directory environments.

How to eliminate wrong answers

Option A is wrong because restarting the User-ID agent service is a generic troubleshooting step that does not address the root cause of incorrect group mapping; the agent is already connected and polling, so a restart would not fix mapping errors. Option B is wrong because checking the firewall's management plane CPU usage is relevant for performance issues, not for user authentication or group mapping problems; high CPU would not prevent users from accessing resources if policies are correct. Option C is wrong because User-ID functionality does not require a separate license; it is included with the firewall's base subscription (e.g., Threat Prevention or URL Filtering), so a missing license is not the issue here.

Full explanation →

299

Multi-Selecthard

An engineer is troubleshooting an HA pair where session synchronization is not working. Which THREE steps should be taken to diagnose the issue? (Choose three.)

Select 3 answers

A.Verify that the HA2 link is operationally up

B.Check the session synchronization status using 'show running session-sync'

C.Check the HA1 link status using 'show high-availability state'

D.Review the system logs for session sync errors

E.Enable flow-based routing on both firewalls

AnswersA, B, D

HA2 is used for session synchronization.

Why this answer

The HA2 link is the dedicated link for session synchronization in a Palo Alto Networks HA pair. If the HA2 link is not operationally up, session state information cannot be exchanged between the firewalls, causing synchronization to fail. Verifying the HA2 link status is a fundamental first step in troubleshooting session sync issues.

Exam trap

The trap here is that candidates often confuse the HA1 and HA2 links, assuming that checking the HA1 link status (which handles heartbeats) will reveal session sync issues, when in fact only the HA2 link is responsible for session synchronization.

Full explanation →

300

MCQmedium

Refer to the exhibit. A user attempts to access a banking site (category: finance) over HTTPS. What will happen?

A.The traffic is decrypted because the first rule matches.

B.The traffic is dropped because no rule matches.

C.The traffic is decrypted only if the SSL certificate is installed.

D.The traffic is not decrypted because the second rule matches and overrides the first.

AnswerD

The no-decrypt rule for category finance matches, so decryption is bypassed.

Why this answer

The firewall processes security rules from top to bottom, and the second rule explicitly matches HTTPS traffic to the finance category with an action of 'No Decrypt'. Since the second rule matches before any decryption rule, it overrides the first rule's decrypt action, and the traffic is not decrypted.

Exam trap

The trap here is that candidates assume the first matching rule in a decryption policy is always applied, but Palo Alto Networks decryption policies allow a later 'No Decrypt' rule to override an earlier 'Decrypt' rule for the same traffic.

How to eliminate wrong answers

Option A is wrong because the first rule does match the traffic, but the second rule (No Decrypt) is evaluated after the first and overrides it due to rule order precedence; decryption does not occur. Option B is wrong because a rule does match (the second rule), so the traffic is not dropped; it is allowed without decryption. Option C is wrong because SSL certificate installation is irrelevant here; the No Decrypt rule explicitly prevents decryption regardless of certificate presence.

Full explanation →

Palo Alto Networks Certified Network Security Engineer PCNSE (PCNSE) — Questions 226–300