Palo Alto Networks Certified Network Security Engineer PCNSE PCNSE Questions 376–450 | Page 6/7

376

MCQeasy

By default, what is the action on traffic between two different zones without any security rule?

A.deny

B.allow

C.depends on the application

D.prompt

AnswerA

By default, traffic between different zones is denied unless a security rule allows it.

Why this answer

By default, Palo Alto Networks firewalls implement an implicit deny rule for inter-zone traffic. This means that if no security rule explicitly matches traffic between two different zones, the firewall drops the packet and logs it as a deny action. This default behavior ensures that all cross-zone traffic must be explicitly allowed by a security policy, enforcing a zero-trust model.

Exam trap

The trap here is that candidates often confuse the default inter-zone action with intra-zone traffic (which is allowed by default) or assume that the firewall will prompt or log a warning, when in fact it silently denies without any user notification.

How to eliminate wrong answers

Option B is wrong because allowing inter-zone traffic by default would violate the principle of least privilege and create a security hole; Palo Alto firewalls never allow traffic without an explicit allow rule. Option C is wrong because the action is not dependent on the application; the firewall applies a default deny regardless of the application ID, and application identification only occurs after a rule match. Option D is wrong because the firewall does not prompt or ask for user input for inter-zone traffic; it silently drops the packet based on the implicit deny rule.

Full explanation →

377

MCQhard

A security engineer is deploying a new PA-5220 firewall to replace an existing legacy firewall. The environment has complex routing with OSPF and BGP. The engineer configures the firewall with multiple virtual routers: one for the internal network, one for the DMZ, and one for the external connection to two ISPs. The firewall is placed in Layer 3 mode. After the cutover, users report that they can access the internet but internal traffic between two different subnets that are both in the internal virtual router fails to route properly. The engineer checks the routing table on the internal virtual router and sees correct OSPF learned routes. The security policies allow all traffic between those subnets. What is the most likely cause of the routing failure?

A.The firewall does not have a loopback interface for OSPF router-id

B.The security policy is not correctly identifying the traffic due to asymmetric routing

C.The internal interfaces are assigned to different virtual routers

D.The OSPF metric is too high, causing route preference issues

AnswerC

If the interfaces belong to different virtual routers, the firewall will not route between them by default without inter-VR route leaking or a shared VR.

Why this answer

The most likely cause is that the internal interfaces are assigned to different virtual routers. In a Palo Alto Networks firewall, Layer 3 interfaces belong to a specific virtual router, and routing between subnets in different virtual routers requires either a route leak or a shared virtual router. Since the engineer placed both subnets in the same internal virtual router but the interfaces are in different virtual routers, the firewall cannot route traffic between them even if the routing table and security policies are correct.

Exam trap

The trap here is that candidates often assume that security policies alone control traffic flow, forgetting that virtual routers create isolated routing domains, and that interfaces in different virtual routers cannot route to each other without explicit route leaking or redistribution.

How to eliminate wrong answers

Option A is wrong because a loopback interface for OSPF router-id is not required for OSPF to function; the firewall can use the highest IP address of any active interface or a manually configured router-id. Option B is wrong because asymmetric routing is not the issue here; the traffic is between two subnets within the same virtual router, and the security policy allows all traffic, so asymmetric routing would not cause a failure in this scenario. Option D is wrong because a high OSPF metric would affect route preference but would not prevent routing between directly connected subnets within the same virtual router; the firewall would still use connected routes or OSPF-learned routes with lower metrics.

Full explanation →

378

MCQeasy

Refer to the exhibit. What does the serial number '0123456789' indicate?

A.The MAC address of the management interface

B.The model number of the firewall

C.The firmware version installed

D.The unique hardware identifier for licensing and support

AnswerD

The serial number is used for licensing and technical support identification.

Why this answer

The serial number '0123456789' is a unique hardware identifier assigned to each Palo Alto Networks firewall during manufacturing. It is used for licensing, support entitlement, and device identification in the Palo Alto Networks support portal, not for network-level addressing or software versioning.

Exam trap

The trap here is that candidates often confuse the serial number with the model number or MAC address, especially when the exhibit shows a generic string like '0123456789' that lacks the typical format of a Palo Alto Networks serial number (e.g., starting with 'PA' or a specific prefix).

How to eliminate wrong answers

Option A is wrong because the MAC address of the management interface is a separate, network-layer identifier used for Layer 2 communication, not the serial number. Option B is wrong because the model number (e.g., PA-5250) is a different alphanumeric string that identifies the hardware platform, not the unique serial number. Option C is wrong because the firmware version (e.g., PAN-OS 10.2.3) is a software release identifier displayed in the dashboard or CLI, not the hardware serial number.

Full explanation →

379

Multi-Selecteasy

Which TWO components are part of the PAN-OS management plane?

Select 2 answers

A.SSL decryption engine

B.Packet buffer

C.Log collection and reporting

D.Management interface

E.App-ID engine

AnswersC, D

Log collection and reporting are handled by the management plane.

Why this answer

Log collection and reporting is a function of the management plane in PAN-OS. The management plane handles all non-traffic-forwarding tasks, including logging, configuration management, and reporting. This is distinct from the data plane, which processes actual network traffic.

Exam trap

The trap here is that candidates often confuse data plane functions (like SSL decryption, App-ID, and packet buffering) with management plane responsibilities, leading them to select options A, B, or E instead of recognizing that log collection and the management interface are purely management plane components.

Full explanation →

380

MCQeasy

A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?

A.Define a tunnel interface with an IP address that matches the certificate subject

B.Set the gateway's IP pool to require certificate authentication

C.Configure a certificate profile in the gateway's authentication settings

D.Configure client authentication in the portal with a certificate profile

AnswerC

The gateway uses a certificate profile to validate client certificates during tunnel establishment.

Why this answer

A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.

Exam trap

The trap here is that candidates often confuse portal authentication settings with gateway authentication settings, assuming that configuring a certificate profile on the portal will automatically enforce certificate-based access on the gateway, but the gateway requires its own separate authentication configuration.

How to eliminate wrong answers

Option A is wrong because a tunnel interface IP address does not need to match the certificate subject; the certificate subject is used for identity mapping, not for IP assignment. Option B is wrong because the IP pool is used for assigning client IP addresses from a defined range, not for requiring certificate authentication; certificate enforcement is handled separately in the authentication profile. Option D is wrong because client authentication in the portal controls web-based access to the portal interface, not the gateway tunnel; gateway authentication settings are independent and must be configured directly on the gateway.

Full explanation →

381

MCQhard

A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?

A.Set up a port mirror on the upstream switch

B.Create an application override policy

C.Configure a PCAP filter in the firewall's packet capture feature

D.Use tcpdump on the management interface

AnswerC

PCAP filter selectively captures traffic based on specified criteria.

Why this answer

The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.

Exam trap

The trap here is that candidates confuse a management-plane tool (tcpdump on the management interface) with a data-plane capture, or they assume port mirroring is the only way to capture traffic, overlooking the firewall's native, performance-friendly PCAP filter feature.

How to eliminate wrong answers

Option A is wrong because port mirroring on an upstream switch copies all traffic from the monitored port, not just the specific application, and it introduces additional load on the switch and firewall, potentially affecting performance. Option B is wrong because an application override policy changes how the firewall identifies and handles the application (e.g., by specifying a custom port), but it does not capture or log packet-level data for forensic analysis. Option D is wrong because tcpdump on the management interface only captures traffic destined to or originating from the management plane, not the data-plane traffic flowing through the firewall's forwarding path.

Full explanation →

382

MCQeasy

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

A.Disable URL filtering on the existing security rule

B.Check the user-ID mapping to ensure the user is authenticated

C.Create a new security rule allowing the user's IP to any

D.Add the URL to an allow list in the URL filtering profile

AnswerD

This allows the specific URL while keeping the profile active.

Why this answer

The traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Exam trap

The trap here is that candidates may assume disabling URL filtering entirely (Option A) is the quickest fix, but the PCNSE exam tests the understanding that URL filtering profiles should be modified granularly using allow/block lists rather than disabling the feature completely.

How to eliminate wrong answers

Option A is wrong because disabling URL filtering on the existing security rule would remove all URL-based controls for that rule, potentially exposing the network to malicious or inappropriate websites, which is an overreaction to a single blocked URL. Option B is wrong because the user-ID mapping is irrelevant to a URL filtering block; URL filtering decisions are based on the URL category or list, not user authentication status, and the traffic log already shows the session is denied due to URL filtering, not authentication. Option C is wrong because creating a new security rule allowing the user's IP to any would bypass all security policies, including URL filtering, but it is an insecure and overly permissive solution that ignores the specific URL filtering block and could allow unrestricted access to any destination.

Full explanation →

383

MCQhard

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

A.The SSL Forward Proxy profile is set to ignore the decryption policy.

B.The firewall is using a different decryption port than 443.

C.The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.

D.The URL category for banking is not correctly identified.

AnswerD

While possible, the more likely issue is rule ordering.

Why this answer

The decryption policy rules are evaluated top-down. The administrator placed the 'No Decrypt' rule first for banking URLs, which is the correct order. However, if the banking URLs do not match the URL category defined in the rule (e.g., the category is not correctly identified or updated), the 'No Decrypt' rule will not apply.

Traffic then falls through to the second 'Decrypt' rule, which decrypts all remaining traffic, including banking. Therefore, the most likely issue is that the URL category for banking is not correctly identified (Option D).

Full explanation →

384

Matchingmedium

Match each high availability (HA) term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

One firewall handles traffic; the other stands by

Both firewalls handle traffic simultaneously

Keepalive messages exchanged between HA peers

Original active firewall reclaims role after recovery

Firewall that initially processed a session

Why these pairings

The correct matches are: Active/Passive (A), Heartbeat (C), and Preemption (E). The distractors swap definitions: B confuses Active/Active with Failover, and D confuses Failover with Active/Active.

Full explanation →

385

MCQeasy

What is the recommended best practice for the HA2 keepalive timer in an active/passive HA configuration?

A.2000 ms

B.It should be left at the default value and not changed

C.500 ms

D.1000 ms

AnswerD

Default and recommended for stability.

Why this answer

In an active/passive HA configuration, the HA2 keepalive timer should be set to 1000 ms (1 second) as a best practice. This value provides a balance between fast failover detection and network stability, ensuring that the passive firewall can detect a failure of the active firewall within a reasonable timeframe without causing false positives due to transient network issues.

Exam trap

The trap here is that candidates may confuse the HA2 keepalive timer with the HA1 backup link timer or assume a lower value always improves performance, ignoring the risk of false failovers due to network jitter.

How to eliminate wrong answers

Option A (2000 ms) is wrong because a 2-second keepalive timer is too slow for active/passive HA, potentially delaying failover beyond acceptable limits for critical traffic. Option B (default value) is wrong because the default HA2 keepalive timer is typically 1000 ms, so leaving it unchanged actually matches the recommended best practice, but the option implies not changing it from a non-default value, which is misleading; the correct practice is to ensure it is set to 1000 ms, not to leave it at an unspecified default. Option C (500 ms) is wrong because a 500 ms timer is too aggressive, increasing the risk of false failovers due to minor network jitter or transient delays, which can destabilize the HA pair.

Full explanation →

386

MCQmedium

A company uses SSL Forward Proxy decryption for user traffic. Recently, some users cannot access a specific HTTPS website that uses a self-signed certificate. The firewall's decryption policy is set to 'decrypt' and the action is 'forward proxy'. The firewall does not have the self-signed CA certificate installed. What is the most likely cause of the issue?

A.The firewall cannot decrypt the session because it does not trust the self-signed certificate of the website.

B.The website is not included in the decryption policy's URL category.

C.The firewall's decryption certificate is not trusted by the client browsers.

D.The firewall's forward proxy decryption requires a server certificate that matches the original website.

AnswerA

The firewall must trust the server's certificate to re-sign for the client; without the self-signed CA, it cannot.

Why this answer

In SSL Forward Proxy decryption, the firewall must generate a new server certificate on-the-fly to present to the client. To do this, it needs to trust the original server's certificate so it can validate the server's identity and then re-sign the session. Since the website uses a self-signed certificate and the firewall does not have that CA certificate installed, the firewall cannot validate the server's certificate, causing the decryption to fail and the session to be blocked.

Exam trap

Palo Alto Networks often tests the distinction between the firewall's ability to validate the server certificate (which requires the server's CA to be trusted) versus the client's trust in the firewall's decryption certificate, leading candidates to confuse client-side trust issues with server-side validation failures.

How to eliminate wrong answers

Option B is wrong because the decryption policy's URL category determines which traffic is decrypted, not whether the firewall can validate the server's certificate; if the URL category were the issue, the traffic would simply not be decrypted, not fail with a certificate trust error. Option C is wrong because the client browsers trusting the firewall's decryption certificate is a separate issue that affects browser warnings, not the firewall's ability to decrypt the session; the firewall can still decrypt even if clients don't trust its certificate. Option D is wrong because forward proxy decryption does not require the firewall's certificate to match the original website; the firewall generates a new certificate with the same subject name as the original site, signed by its own CA, which is the standard behavior for forward proxy.

Full explanation →

387

Matchingmedium

Match each PAN-OS component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Handles configuration, logging, and reporting

Processes traffic and enforces security policies

Manages routing and session setup

Collects and stores logs for analysis

Centralized management for multiple firewalls

Why these pairings

PAN-OS architecture separates management, data, and control functions into distinct planes. The Management Plane handles configuration and logging; the Data Plane processes traffic; the Control Plane manages routing and sessions. Panorama is a centralized management tool, not a plane within a single firewall.

Full explanation →

388

MCQhard

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

A.The firewall must be rebooted for the custom App-ID to take effect.

B.An application override rule has not been configured to associate the traffic with the custom App-ID.

C.The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

D.The firewall cannot identify applications over UDP.

AnswerB

Application override is required to bypass signature-based identification and assign the custom App-ID.

Why this answer

The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Exam trap

The trap here is that candidates assume a correctly configured custom App-ID will automatically identify traffic, but they overlook the need for an Application Override rule to explicitly bind the traffic to that App-ID when the firewall cannot match it via signatures.

How to eliminate wrong answers

Option A is wrong because rebooting the firewall is unnecessary; custom App-IDs take effect immediately after commit, not requiring a reboot. Option C is wrong because custom App-IDs are not enabled in a separate 'Applications' section; they are created and applied via Security policy rules or Application Override rules. Option D is wrong because Palo Alto Networks firewalls can identify applications over UDP; App-ID supports both TCP and UDP protocols, and the issue is specifically about the lack of a signature for this proprietary protocol.

Full explanation →

389

Drag & Dropmedium

Arrange the steps to configure a new administrator account with role-based access.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

To configure a new administrator with role-based access on a Palo Alto firewall, you must first create the administrator account by navigating to Device > Administrators and clicking Add. Then enter the username and password. Next, assign a role (e.g., Superuser, Read‑Only, or a custom role) to define the access level.

Finally, commit the changes to apply the configuration. This sequence ensures the account is fully defined before committing.

Full explanation →

390

MCQhard

A firewall is configured with multiple virtual wire interfaces. Traffic passes through but the firewall cannot enforce security policies based on source/destination IP addresses. What is the reason?

A.The virtual wire is not configured with zones

B.The virtual wire requires a VLAN tag

C.The security policy is in layer 3 mode

D.Virtual wire mode does not support IP-based policies

AnswerD

In virtual wire mode, the firewall acts as a transparent bridge and cannot inspect IP addresses for policy matching.

Why this answer

In virtual wire mode, the firewall operates as a transparent Layer 2 bridge, forwarding frames based on MAC addresses without performing any IP routing or inspection of Layer 3 headers. Because the firewall does not see the source or destination IP addresses in the traffic, it cannot enforce security policies that rely on IP-based criteria. Option D correctly identifies that virtual wire mode inherently does not support IP-based policies.

Exam trap

The trap here is that candidates may assume virtual wire mode still allows IP-based policies because the firewall can see IP packets, but they forget that the firewall does not process Layer 3 headers in this mode, making IP-based policy enforcement impossible.

How to eliminate wrong answers

Option A is wrong because virtual wire interfaces are automatically assigned to a zone when the virtual wire is created, and zones are required for policy enforcement, but the issue here is not about zone assignment—it's about the lack of IP visibility. Option B is wrong because virtual wire mode does not require VLAN tags; it can pass untagged traffic, and VLAN tags are optional for segmenting traffic within a virtual wire. Option C is wrong because security policies in Layer 3 mode are used for routed interfaces, not virtual wire interfaces; virtual wire mode operates at Layer 2, and the policy enforcement is based on Layer 2 information, not Layer 3 IP addresses.

Full explanation →

391

MCQhard

A company wants to use GlobalProtect with pre-logon (user unknown). After configuration, users report that they can authenticate but cannot access the gateway during pre-logon. Which configuration item is most likely missing?

A.Pre-logon token not enabled on the portal

B.Gateway's certificate not imported or untrusted

C.Pre-logon token not enabled on the gateway

D.Portal's authentication profile does not allow pre-logon

AnswerB

If the gateway's certificate is not trusted, the client will reject the connection during pre-logon.

Why this answer

During pre-logon, the GlobalProtect gateway must present a trusted certificate to the client before any user authentication occurs, because the user is unknown and the client cannot rely on user credentials to validate the gateway. If the gateway's certificate is not imported or is untrusted, the client will reject the SSL/TLS handshake, preventing access even though portal authentication succeeds. This is the most common cause of pre-logon connectivity failure after portal authentication works.

Exam trap

The trap here is that candidates confuse the pre-logon token (a gateway setting for token-based pre-logon) with certificate trust issues, assuming the token must be enabled on the portal, when in fact the certificate trust failure is the root cause of the gateway access problem.

How to eliminate wrong answers

Option A is wrong because the pre-logon token is a gateway-level setting, not a portal setting; the portal controls authentication and configuration download, but the token for pre-logon is configured on the gateway. Option C is wrong because the pre-logon token being enabled on the gateway is necessary for the client to obtain a token, but the question states users can authenticate, implying the token exchange works; the issue is that the client cannot access the gateway, which points to a certificate trust problem. Option D is wrong because the portal's authentication profile does not control pre-logon behavior; pre-logon is configured on the gateway, and the portal's authentication profile only affects user authentication after the gateway connection is established.

Full explanation →

392

Multi-Selectmedium

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Select 2 answers

A.Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.

B.Using the 'Application Command Center' to automatically generate custom App-IDs.

C.Using the 'set application' command in the CLI.

D.Importing an App-ID definition file from a CSV.

E.Using the 'Objects' > 'Application Filters' menu in the web interface.

AnswersC, E

CLI allows configuration of custom applications.

Why this answer

The 'set application' CLI command allows you to define a custom App-ID by specifying characteristics such as protocol, port, and signature. This is a direct method to create a custom application object on a Palo Alto Networks firewall, as documented in the administrator's guide.

Exam trap

The trap here is that candidates may confuse 'Create Application Override' (which bypasses App-ID) with 'Create App-ID' (which defines a new application), leading them to select option A, or they may mistakenly think the ACC can generate App-IDs, which it cannot.

Full explanation →

393

MCQeasy

A network administrator wants to ensure that all traffic traversing the firewall is correctly identified by App-ID before any security policies are evaluated. Which step is essential?

A.Enable App-ID on the firewall interfaces.

B.Configure security zones properly.

C.Enable Threat Prevention profiles.

D.Ensure App-ID is enabled in the security policy rules.

AnswerD

App-ID is applied per rule; enabling it ensures identification occurs.

Why this answer

App-ID must be enabled within the security policy rule itself to ensure traffic is identified before policy evaluation. While enabling App-ID on interfaces (Option A) is a prerequisite, the essential step is to configure the security rule to use App-ID as a match criterion; otherwise, the firewall will not perform application identification for that rule. This guarantees that App-ID classification occurs prior to any allow/deny decisions.

Exam trap

The trap here is that candidates often confuse enabling App-ID on interfaces (a prerequisite) with the essential step of actually using App-ID in security rules, leading them to select Option A instead of D.

How to eliminate wrong answers

Option A is wrong because enabling App-ID on interfaces only activates the ability to decode applications at the interface level, but without referencing App-ID in a security rule, the firewall will not enforce application-based policy decisions. Option B is wrong because configuring security zones is a fundamental network segmentation step but does not directly control whether App-ID is applied to traffic; zones are used for policy enforcement, not for enabling App-ID identification. Option C is wrong because Threat Prevention profiles (e.g., IPS, antivirus) are applied after App-ID has already identified the application; they do not ensure that App-ID is used for traffic identification before policy evaluation.

Full explanation →

394

MCQhard

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

A.The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.

B.The firewall's decryption policy is set to 'no-decrypt' for the application.

C.The firewall's internet link experiences periodic packet loss.

D.The SaaS application's certificate is expired or revoked.

AnswerA

SSL/TLS version mismatch can cause intermittent failures; the firewall may attempt a higher version than the server supports.

Why this answer

In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.

Exam trap

The trap here is that candidates assume intermittent issues must be caused by network problems like packet loss (Option C) or policy misconfigurations (Option B), but the key clue is 'no drops or errors' on the firewall, pointing to a higher-layer TLS negotiation mismatch that does not generate firewall-level drops.

How to eliminate wrong answers

Option B is wrong because if the decryption policy were set to 'no-decrypt' for the application, the firewall would simply pass the traffic through without decryption, which would not cause intermittent connectivity issues—it would either work or not based on the application's certificate handling. Option C is wrong because periodic packet loss on the internet link would typically result in drops or errors visible in the firewall's logs or counters, and the question explicitly states the firewall shows no drops or errors. Option D is wrong because an expired or revoked certificate would cause a consistent failure (e.g., a certificate error or block) rather than intermittent connectivity, and the firewall would likely log a certificate validation error.

Full explanation →

395

MCQmedium

Dynamics Inc., a mid-sized company, uses Palo Alto Networks PA-5250 firewalls at their data center. They recently deployed a new web-based CRM application that uses HTTPS and WebSocket connections on TCP port 8443. The security team configured a custom application 'crm-app' with a signature that matches the 'Host' header in HTTP requests, and set the protocol decoder to 'tcp' and the port to 8443. The application is used in a security policy to allow traffic from internal users to the CRM server. However, after deployment, the traffic logs show the application is identified as 'ssl' instead of 'crm-app'. The firewall's App-ID and threat prevention subscriptions are active and up to date. The team has verified that the custom application signature is correctly configured, and the traffic clearly matches the defined host header. Which action should be taken to ensure the CRM traffic is correctly identified by App-ID?

A.Increase the 'timeout' value for the custom application signature from 0 to 60 seconds.

B.Modify the custom application signature to use the 'tcp' protocol decoder and set the port to 8443.

C.Disable SSL decryption for the CRM traffic to allow App-ID to inspect the unencrypted HTTP headers.

D.Create a new security rule with an application override that sets the application to 'crm-app' for the CRM traffic.

AnswerD

An application override forces the firewall to identify the traffic as the specified application, bypassing App-ID's detection. This is a valid approach when App-ID fails to correctly classify traffic despite a properly configured custom signature.

Why this answer

When a custom application signature fails to identify traffic due to the firewall's inability to inspect encrypted payloads (like HTTPS/WebSocket), an application override in a security rule forces App-ID to classify the traffic as the specified application regardless of the signature match. Since the CRM traffic uses HTTPS on port 8443, the firewall sees encrypted SSL/TLS handshakes and defaults to 'ssl' App-ID because it cannot inspect the encrypted HTTP headers. An application override bypasses the App-ID identification process and directly assigns the desired application, ensuring correct logging and policy enforcement.

Exam trap

The trap here is that candidates assume a correctly configured custom application signature will always identify traffic, but they overlook that encrypted payloads (HTTPS/WebSocket) prevent the firewall from inspecting HTTP headers, making the signature ineffective without SSL decryption or an application override.

How to eliminate wrong answers

Option A is wrong because increasing the timeout value for a custom application signature affects how long the firewall waits for additional packets to complete identification, but it does not solve the core issue that the encrypted payload prevents the signature from matching the Host header. Option B is wrong because the custom application signature is already configured with the 'tcp' protocol decoder and port 8443 as stated in the scenario; this option suggests a redundant change that does not address the encryption problem. Option C is wrong because disabling SSL decryption would leave the traffic encrypted, preventing App-ID from inspecting the HTTP headers; SSL decryption must be enabled (with a decryption policy) to decrypt the traffic so that the custom signature can match the Host header in the clear.

Full explanation →

396

Drag & Dropmedium

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Configuring a security policy on Palo Alto Networks firewalls involves defining the traffic flow by specifying source and destination zones, then selecting the application and service, setting the action (allow or deny), and finally committing the changes. The correct order ensures logical consistency and proper policy enforcement. Common mistakes include swapping zones, setting action before application, or placing destination after application.

Full explanation →

397

MCQeasy

A security administrator notices that HTTP traffic is correctly identified as web-browsing but HTTPS traffic is showing as ssl. The company uses a custom HTTPS-based application that needs to be identified by its own App-ID. What should the administrator do?

A.Enable SSL decryption on the firewall.

B.Configure a custom URL category for the application.

C.Create an App-ID override (custom application) for the custom application.

D.Disable App-ID for the traffic.

AnswerA

Correct. Enabling SSL decryption allows the firewall to decrypt HTTPS traffic, enabling App-ID to inspect the payload and identify applications. With decryption, the administrator can later create a custom App-ID signature for the custom application.

Why this answer

Enabling SSL decryption (Option A) is the correct first step to identify a custom HTTPS-based application. App-ID cannot inspect encrypted payloads, so SSL decryption allows the firewall to decrypt traffic for inspection. Once decrypted, the administrator can create a custom App-ID signature based on the application's specific characteristics.

Option C is incorrect because an App-ID override is used to bypass App-ID for traffic that should not be inspected, not to define a new application. The question asks for the method to identify the custom application by its own App-ID, and SSL decryption is necessary to enable that identification.

Exam trap

The trap is that candidates often think creating an App-ID override (custom application) is the solution, but an override bypasses App-ID, not creates a signature. The correct approach is to enable SSL decryption to allow App-ID to inspect the decrypted traffic and then define a custom application signature.

How to eliminate wrong answers

Option A is wrong because enabling SSL decryption would decrypt the traffic, allowing App-ID to inspect the payload, but it does not create a custom App-ID for the application; it only enables visibility into encrypted traffic, and the question requires the application to be identified by its own App-ID, not just decrypted. Option B is wrong because configuring a custom URL category categorizes URLs for URL filtering, not for identifying applications via App-ID; App-ID and URL categories are separate functions, and URL categories do not create application signatures. Option D is wrong because disabling App-ID for the traffic would prevent any application identification, including the custom application, which is the opposite of the goal; it would also break security policy enforcement based on application.

Full explanation →

398

Multi-Selectmedium

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Select 2 answers

A.Client certificate

B.Security zone for the tunnel interface

C.Tunnel interface

D.GlobalProtect portal configuration

E.IKE gateway configuration

AnswersC, E

The tunnel interface is the endpoint for the VPN traffic.

Why this answer

A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Exam trap

The trap here is that candidates often confuse the GlobalProtect portal configuration as a prerequisite for the IPSec tunnel, but the portal is only needed for client configuration and certificate provisioning, not for the actual tunnel establishment between the gateway and the remote client.

Full explanation →

399

MCQmedium

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

A.Create separate virtual systems (VSYS) for each tenant on the same firewall.

B.Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

C.Use active/active HA mode to assign each tenant to a different firewall.

D.Configure multiple virtual routers (VRFs) within the same virtual system.

AnswerA

VSYS provides complete logical separation of configuration, routing, and policies per tenant.

Why this answer

Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Exam trap

The trap here is that candidates often confuse virtual routers (VRFs) with full tenant isolation, not realizing that VRFs only separate routing tables, while VSYS provides complete separation of policies, objects, and administration required for multi-tenant environments.

How to eliminate wrong answers

Option B is wrong because deploying multiple VM-Series firewalls as separate instances on the same hypervisor would require separate management and licensing for each instance, defeating the purpose of using a single HA pair and increasing complexity. Option C is wrong because active/active HA mode does not assign tenants to different firewalls; both firewalls in an active/active pair share the same configuration and forward traffic together, so tenant isolation would still require VSYS or other segmentation. Option D is wrong because multiple virtual routers (VRFs) within the same virtual system can separate routing tables but do not isolate security policies, administrative access, or other tenant-specific configurations; VSYS is required for full tenant isolation.

Full explanation →

400

MCQeasy

A firewall administrator needs to troubleshoot a connectivity issue where users in the 10.0.1.0/24 subnet cannot reach the internet. The administrator suspects a missing policy. Which tool within the firewall's web interface can be used to test which security policy will be matched for a given traffic flow?

A.Network > Virtual Routers

B.Policy Optimizer > Test Policy Match

C.Monitor > Logs > Traffic

D.Device > Setup > Management

AnswerB

Test Policy Match simulates traffic and returns matching policy.

Why this answer

The 'Test Policy Match' tool under Policy Optimizer allows an administrator to simulate a specific traffic flow (source/destination IP, port, protocol) and see which security policy rule it matches. This directly addresses the need to verify whether a missing or misconfigured policy is blocking internet access for the 10.0.1.0/24 subnet.

Exam trap

The trap here is that candidates often confuse the 'Test Policy Match' tool with traffic logs (Option C), thinking logs can predict future policy matches, but logs only show past events and cannot simulate a flow that hasn't occurred yet.

How to eliminate wrong answers

Option A is wrong because Virtual Routers manage routing tables and next-hop decisions, not security policy matching; it cannot test which security rule applies to a traffic flow. Option C is wrong because Monitor > Logs > Traffic shows historical logs of already-processed traffic, not a proactive test of policy matching for a hypothetical flow. Option D is wrong because Device > Setup > Management configures administrative settings (e.g., management interfaces, authentication) and has no capability to simulate or test security policy matching.

Full explanation →

401

Multi-Selectmedium

Which two are valid methods for collecting User-ID information on a Palo Alto Networks firewall? (Choose two.)

Select 2 answers

A.Syslog parsing

B.Email gateway

C.Active Directory agent

D.SNMP trap

E.Captive portal

AnswersC, E

The AD agent polls domain controllers for user logon events.

Why this answer

The Active Directory agent is a dedicated software component that integrates with Microsoft Active Directory to map user logon events to IP addresses, providing real-time User-ID information to the firewall. Option E is correct because Captive Portal actively authenticates users via browser-based or agent-based authentication, associating their IP address with a username upon successful login, which is a direct method for collecting User-ID data.

Exam trap

The trap here is that candidates often confuse Syslog parsing or SNMP traps as valid User-ID sources because they are common in other security contexts, but Palo Alto Networks specifically requires authentication-based methods like AD agent, Captive Portal, or XFF headers for User-ID collection.

Full explanation →

402

Multi-Selecteasy

Which TWO of the following are supported authentication methods for IPSec VPN tunnel setup between two Palo Alto Networks firewalls?

Select 2 answers

A.Certificate

B.RADIUS

C.SAML

D.LDAP

E.Pre-shared key

AnswersA, E

Certificate authentication is supported for IPSec tunnels.

Why this answer

Palo Alto Networks firewalls support certificate-based authentication for IKEv1 and IKEv2 IPsec VPN tunnels, where each peer presents an X.509 certificate signed by a trusted CA. This method provides strong mutual authentication and is commonly used in large-scale or high-security deployments.

Exam trap

The trap here is that candidates confuse user authentication methods (RADIUS, SAML, LDAP) with device-to-device IPsec tunnel authentication, which only supports pre-shared keys and certificates on Palo Alto firewalls.

Full explanation →

403

Multi-Selecteasy

An organization wants to enforce multi-factor authentication (MFA) for administrative access to the Palo Alto Networks firewall. Which TWO authentication methods are supported for local administrator accounts?

Select 2 answers

A.LDAP authentication

B.SAML IdP authentication

C.One-time password (OTP) via RADIUS

D.Time-based one-time password (TOTP)

E.Client certificate authentication

AnswersC, D

Correct: OTP via RADIUS is a supported MFA method for local admin accounts.

Why this answer

Palo Alto Networks firewalls support one-time password (OTP) authentication for local administrator accounts via RADIUS, where the RADIUS server generates and validates the OTP. Option D is correct because time-based one-time password (TOTP) is natively supported for local administrator MFA, using RFC 6238 to generate time-synchronized codes that the firewall validates directly without an external server.

Exam trap

The trap here is that candidates often confuse authentication methods that support MFA for local administrator accounts with those used for external user authentication (e.g., SAML or LDAP), mistakenly thinking any external IdP can be applied to local accounts, when in fact only TOTP and RADIUS-based OTP are supported for local admin MFA.

Full explanation →

404

Multi-Selecteasy

Which TWO conditions can cause an HA pair to show a state of 'suspended'?

Select 2 answers

A.Software version mismatch between peers

B.HA2 link failure

C.License mismatch between peers

D.Configuration synchronization failure

E.HA1 link failure

AnswersD, E

If config sync fails, firewall may suspend to avoid inconsistency.

Why this answer

A configuration synchronization failure causes the HA pair to enter a 'suspended' state. When configuration sync fails, the passive peer cannot apply the active peer's configuration, breaking the synchronization requirement for HA operation. The suspended state prevents the passive peer from taking over until the configuration mismatch is resolved.

Exam trap

The trap here is that candidates often assume that link failures only cause 'non-functional' states, but in the PCNSE exam, an HA1 link failure specifically triggers the 'suspended' state because the control link is down. Configuration synchronization failure is the other cause. Candidates may incorrectly think that HA2 link failure or license/version mismatches cause suspended state, but they do not.

Full explanation →

405

MCQhard

You are a network security engineer at a multinational corporation. The company has a main data center and three branch offices connected via MPLS. The firewall at the data center is a PA-5250 running PAN-OS 10.2. The firewall is configured for SSL Forward Proxy decryption of all outbound HTTPS traffic from internal users to the internet. Recently, users in Branch Office A report that they cannot access several external HTTPS websites, while users at other branches and the data center have no issues. The decryption policy for Branch Office A is identical to the others. You check the decryption statistics and see that for Branch Office A, the number of 'SSL handshake failures' is high. You also notice that the firewall's system log shows errors like 'peer certificate chain validation failure' for sessions from Branch Office A. The firewall has a forward trust certificate issued by an internal CA, and the internal CA certificate is installed on all clients. What is the most likely cause of this issue?

A.The forward trust certificate has expired or is not trusted by the clients in Branch Office A.

B.The decryption profile for Branch Office A is configured with an incorrect cipher suite that is not supported by the external websites.

C.Traffic from Branch Office A is asymmetrically routed, causing the TLS handshake to be incomplete.

D.The decryption policy rule for Branch Office A is missing the 'ssl-decrypt' action.

AnswerC

Asymmetric routing can cause the firewall to see only one side of the TCP handshake, leading to SSL handshake failures.

Why this answer

C is correct because asymmetric routing causes the firewall to see only one side of the TCP handshake, preventing it from completing the TLS handshake. When traffic from Branch Office A takes a different return path (e.g., via another MPLS link or direct internet breakout), the firewall cannot associate the server's SYN-ACK with the original client SYN, leading to SSL handshake failures and 'peer certificate chain validation failure' errors in the logs. The decryption policy and certificates are identical across branches, so the issue is specific to the network path.

Exam trap

The trap here is that candidates often blame certificate trust or decryption profile misconfigurations first, overlooking that asymmetric routing is a common network-layer cause of SSL decryption failures even when all security policies and certificates are correctly configured.

How to eliminate wrong answers

Option A is wrong because the forward trust certificate is issued by an internal CA that is installed on all clients, and the decryption policy is identical across branches; if the certificate were expired or untrusted, all branches would be affected, not just Branch Office A. Option B is wrong because the decryption profile's cipher suite configuration is identical across branches, and cipher mismatch would typically cause 'no shared cipher' errors, not 'peer certificate chain validation failure' or high SSL handshake failures. Option D is wrong because if the decryption policy rule were missing the 'ssl-decrypt' action, the firewall would not attempt decryption at all, and the decryption statistics would show no decrypted sessions or SSL handshake failures for that branch.

Full explanation →

406

MCQhard

A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?

A.The HA2 link is down but HA1 is up

B.The session sync is disabled

C.The passive firewall has link monitoring enabled

D.The passive firewall is running a different PAN-OS version

AnswerD

Version mismatch causes non-functional state.

Why this answer

The passive firewall showing a 'non-functional' state in an Active/Passive HA pair most likely indicates a version mismatch. PAN-OS requires both firewalls in an HA pair to run the exact same software version for configuration synchronization to work. If the passive firewall is running a different PAN-OS version, it cannot properly interpret or apply the configuration from the active firewall, causing it to enter a non-functional state.

Exam trap

The trap here is that candidates often confuse 'non-functional' with connectivity issues (like a down HA link) or session sync settings, but the key is that configuration sync requires identical PAN-OS versions, and a mismatch manifests as a 'non-functional' state on the passive firewall.

How to eliminate wrong answers

Option A is wrong because if the HA2 link (used for session and configuration synchronization) is down but HA1 (heartbeat link) is up, the passive firewall would typically show a 'suspended' or 'passive' state, not 'non-functional', as HA1 can still detect the peer. Option B is wrong because disabling session sync only affects the synchronization of session tables, not configuration changes; configuration sync is controlled separately and would not cause a 'non-functional' state. Option C is wrong because link monitoring on the passive firewall affects failover decisions (e.g., causing a passive-to-active transition if monitored links fail), but it does not prevent configuration synchronization or cause a 'non-functional' state.

Full explanation →

407

MCQmedium

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

A.Redistribution of routes between the virtual routers

B.Enabling packet forwarding on the virtual router interfaces

C.A security policy allowing traffic between the zones associated with the virtual routers

D.A static route on both virtual routers pointing to each other's subnets

AnswerC

Traffic between VRs may involve different zones; without an allow policy, packets are dropped.

Why this answer

In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Exam trap

The trap here is that candidates confuse routing (Layer 3) with security policy (Layer 4-7), assuming that if routes exist, traffic will flow, but Palo Alto firewalls enforce zone-based policies independently of routing.

How to eliminate wrong answers

Option A is wrong because route redistribution is not required when static or direct routes already exist between the virtual routers; redistribution is used to share routes dynamically between routing protocols, not to enable packet forwarding. Option B is wrong because packet forwarding is enabled by default on virtual router interfaces in Palo Alto firewalls; there is no separate 'enable forwarding' toggle. Option D is wrong because the question states both virtual routers already have routes to each other's subnets via a shared inter-connect, so adding more static routes would be redundant and not address the packet drop.

Full explanation →

408

Multi-Selectmedium

An engineer is configuring App-ID for a network that uses both standard and custom applications. Which of the following are best practices for using App-ID effectively? (Choose three.)

Select 3 answers

A.Rely solely on default application signatures for all traffic identification.

B.Use application filters to create dynamic application groups based on characteristics.

C.Use application groups to simplify policy management for related applications.

D.Disable App-ID for traffic on well-known ports to reduce processing overhead.

E.Regularly update Application and Threats content to keep signatures current.

AnswersB, C, E

Correct: Filters allow grouping by attributes without manual updates.

Why this answer

Application filters allow you to dynamically group applications based on shared characteristics (e.g., risk, category, technology), which simplifies policy management as new applications matching those criteria are automatically included without manual updates. This is a best practice for scaling App-ID in environments with both standard and custom applications.

Exam trap

The trap here is that candidates may think disabling App-ID on well-known ports reduces overhead (Option D), but App-ID is designed to identify applications irrespective of port, and disabling it creates a security gap that attackers can exploit via port hopping.

Full explanation →

409

MCQeasy

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

A.Reboot both firewalls simultaneously to reset the HA state.

B.Disable link speed and duplex settings on the HA interfaces to force a failover.

C.Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.

D.Set the HA mode to 'active/active' to allow both firewalls to process traffic.

AnswerC

Preemptive ensures the higher-priority device becomes active after recovery, preventing both firewalls from staying active.

Why this answer

Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Exam trap

The trap here is that candidates often assume rebooting or resetting the HA state (Option A) is sufficient, but they overlook the need for preemption to automatically resolve the split-brain condition after a power failure, which is a common cause of HA instability in production environments.

How to eliminate wrong answers

Option A is wrong because rebooting both firewalls simultaneously does not resolve the underlying split-brain condition; it only temporarily resets the HA state and the problem will recur if the root cause (lack of preemption) is not addressed. Option B is wrong because disabling link speed and duplex settings on HA interfaces would disrupt the HA heartbeat link, potentially causing both firewalls to assume active state due to loss of communication, which worsens the issue rather than fixing it. Option D is wrong because setting the HA mode to 'active/active' would allow both firewalls to process traffic simultaneously, which is not the intended design for this active/passive deployment and would cause asymmetric routing and network instability, not resolve the split-brain problem.

Full explanation →

410

MCQmedium

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

A.The security policy rule does not have logging enabled at session end.

B.SSL decryption is enabled but the website certificate is untrusted.

C.A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

D.A URL Filtering profile is applied to the rule and is blocking the website's URL category.

AnswerD

URL Filtering profiles can override application-level allowances by blocking specific URL categories, causing the session to be dropped.

Why this answer

A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.

Exam trap

The trap here is that candidates assume 'web-browsing' allowed means all web traffic is permitted, overlooking that URL Filtering profiles can block specific URLs or categories even when the application is allowed.

How to eliminate wrong answers

Option A is wrong because logging at session end does not affect traffic forwarding; it only controls whether session logs are generated. Option B is wrong because if SSL decryption is enabled and the certificate is untrusted, the firewall typically presents a block page or generates a warning, but the session is not silently dropped; the user would see a certificate error, not a drop. Option C is wrong because a DoS protection profile rate-limits traffic based on thresholds (e.g., max sessions per source IP), but the user reports a single website issue, not general connectivity problems, and rate-limiting would cause intermittent drops or delays, not a consistent block for one specific site.

Full explanation →

411

MCQmedium

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

A.The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.

B.The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

C.The traffic is using a non-standard port, so the standard rule does not match.

D.There is a decryption policy causing the application to be misidentified.

AnswerA

Inconsistent identification can occur if the application signature does not match all variations of the traffic.

Why this answer

App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.

Exam trap

The trap here is that candidates assume App-ID is instant and always correct on the first packet, but PCNSE tests the understanding that App-ID may require multiple packets to fully identify an application, leading to a temporary 'unknown-tcp' classification that can match a deny rule before the correct application is recognized.

How to eliminate wrong answers

Option B is wrong because App-ID does not assign multiple application labels to the same session; it either identifies the application or falls back to 'unknown-tcp' (or 'incomplete') — a software bug causing dual identification is not a documented behavior. Option C is wrong because the question states the traffic uses default port 5000, and the security policy allows 'trading-app' over that port, so a non-standard port is not the issue. Option D is wrong because decryption policies affect SSL/TLS traffic, but the question does not mention encrypted traffic, and decryption misidentification would not cause fallback to 'unknown-tcp' — it would affect the decrypted application classification, not the initial unknown-tcp fallback.

Full explanation →

412

MCQhard

A security administrator notices that users are able to bypass authentication by accessing resources using IP addresses instead of FQDNs, even though authentication policies are configured. How can this be prevented?

A.Create a decryption policy to decrypt all traffic.

B.Use identity-based routing to enforce authentication.

C.Enable user-ID on the ingress interface and configure authentication policy for IP addresses.

D.Configure an authentication policy with source user 'unknown' to enforce authentication for all unmapped IP addresses.

AnswerD

By default, authentication policies match on source user 'any', so if a user mapping exists, the policy applies. Setting source user to 'unknown' ensures that traffic from IPs without a user mapping triggers authentication.

Why this answer

When users access resources by IP address rather than FQDN, the firewall cannot associate the traffic with a specific user via normal authentication policies (which rely on domain-based rules). By configuring an authentication policy with source user 'unknown', the firewall forces authentication for all unmapped IP addresses, ensuring that even IP-based access triggers user identification and policy enforcement.

Exam trap

The trap here is that candidates often assume enabling User-ID on the interface or using decryption will solve the bypass, but they miss the critical detail that authentication policies must explicitly target unmapped IPs via the 'unknown' source user to enforce authentication for IP-based access.

How to eliminate wrong answers

Option A is wrong because decryption policies are used to inspect encrypted traffic, not to enforce authentication for IP-based access. Option B is wrong because identity-based routing controls traffic forwarding based on user identity but does not enforce authentication for unmapped IP addresses. Option C is wrong because enabling User-ID on the ingress interface and configuring authentication policy for IP addresses does not address the core issue; the firewall still requires a user mapping, and IP addresses alone bypass the authentication policy unless the source user is set to 'unknown'.

Full explanation →

413

Multi-Selecthard

Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?

Select 3 answers

A.SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

B.Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.

C.The firewall must generate a certificate on-the-fly signed by a trusted CA for each decrypted session.

D.An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

E.The firewall can inspect the Server Name Indication (SNI) field in the ClientHello to determine the destination hostname.

AnswersB, C, E

These are common match criteria for decryption policy rules.

Why this answer

Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.

Exam trap

The trap here is that candidates assume SSL Forward Proxy decryption is limited to port 443, but Palo Alto firewalls can decrypt SSL/TLS on any TCP port by inspecting the handshake, and they also mistakenly think the decryption profile must contain a certificate for the firewall, when in fact the CA certificate is configured separately and the firewall generates session-specific certificates automatically.

Full explanation →

414

MCQmedium

A security engineer notices that traffic from a trusted internal application is being blocked by the firewall. The application communicates using a proprietary protocol over TCP port 8443. The engineer has already created a custom App-ID for this application but the traffic is still being blocked. What is the most likely reason?

A.The custom App-ID must be added to a security profile group.

B.The custom App-ID needs a vulnerability profile to be activated.

C.The security policy rule uses the destination port instead of App-ID.

D.An application override rule must be configured to associate the custom App-ID with the traffic.

AnswerD

Application override is necessary to bypass signature-based identification and assign the custom App-ID.

Why this answer

When a custom App-ID is created for a proprietary protocol, the firewall cannot automatically identify the application by inspecting the traffic. An application override rule is required to explicitly map the traffic (based on IP, port, or other criteria) to the custom App-ID, bypassing the firewall's default App-ID identification process. Without this override, the firewall continues to apply its default classification, which may block the traffic if it doesn't match any known application.

Exam trap

The trap here is that candidates assume creating a custom App-ID is sufficient for the firewall to automatically identify the traffic, but they overlook the mandatory step of configuring an application override rule to bind the custom App-ID to the specific traffic flows.

How to eliminate wrong answers

Option A is wrong because a security profile group (which includes vulnerability, anti-virus, and other profiles) is not required for App-ID to function; it is an optional grouping for policy enforcement. Option B is wrong because a vulnerability profile is unrelated to App-ID identification; it is used for threat prevention after traffic is allowed. Option C is wrong because the security policy rule can use App-ID as a match criterion regardless of the destination port; the issue is that the custom App-ID is not being applied to the traffic, not that the rule is misconfigured to use port instead.

Full explanation →

415

MCQhard

Two firewalls in an active/passive HA pair are not synchronizing. The administrator checks 'show high-availability state' and sees 'active' on both firewalls. What is the most likely cause?

A.The HA3 control link is misconfigured or down.

B.Session owner is set to 'primary' on both firewalls.

C.Preemptive mode is enabled on both firewalls.

D.Both firewalls have different PAN-OS versions.

AnswerA

Without heartbeat, each firewall assumes the other is down and becomes active.

Why this answer

When both firewalls show 'active' in the HA state, it indicates a split-brain scenario where each firewall believes it is the active unit. The HA3 control link is responsible for heartbeat and state synchronization; if it is misconfigured or down, the firewalls cannot detect each other's presence, causing both to assume active status. This is the most common cause of dual-active HA failures.

Exam trap

The trap here is that candidates often assume both firewalls showing 'active' is caused by a configuration mismatch like PAN-OS versions or preemptive settings, but the core issue is the loss of the HA3 control link, which prevents heartbeat detection and triggers a split-brain condition.

How to eliminate wrong answers

Option B is wrong because 'session owner' is a session distribution setting for active/active HA, not active/passive, and setting it to 'primary' on both does not cause both to show active; it affects session ownership, not HA state. Option C is wrong because preemptive mode controls whether a previously active firewall reclaims active status after a failure recovery; it does not cause both to become active simultaneously. Option D is wrong because different PAN-OS versions prevent HA formation entirely (the pair will not synchronize or form a HA group), but the state would show 'non-functional' or 'not synchronized', not 'active' on both.

Full explanation →

416

MCQhard

A company has a Palo Alto Networks firewall in a high-availability active/passive setup. After a failover event, the new active firewall is not correctly identifying some custom applications. The custom application objects and signatures are synchronized via Panorama. What is the most likely cause?

A.The application override rules are not synchronized.

B.The security policy rules referencing the custom applications are not present.

C.The custom application objects were created locally on the previous active firewall and not pushed from Panorama.

D.The custom application signatures are not committed on the new active firewall.

AnswerC

Correct: Local objects are not shared via Panorama, so they would be missing on the new active firewall.

Why this answer

Custom application objects created locally on the previous active firewall are not automatically synchronized to the peer in an active/passive HA pair. Even though Panorama is used for centralized management, local objects are not pushed from Panorama unless they were originally created and pushed via Panorama. After a failover, the new active firewall lacks these locally defined objects, causing it to fail to identify the custom applications.

Exam trap

The trap here is that candidates assume Panorama synchronization covers all configuration elements, but locally created objects (not pushed from Panorama) are not synced to the HA peer, leading to identification failures after failover.

How to eliminate wrong answers

Option A is wrong because application override rules are part of the security policy configuration and are synchronized via Panorama or HA config sync; they do not affect the identification of custom applications. Option B is wrong because the security policy rules referencing custom applications are present (they are synchronized via Panorama), but the issue is that the custom application objects themselves are missing. Option D is wrong because the custom application signatures are committed on the new active firewall (they were pushed from Panorama), but the locally created objects were never part of the Panorama push.

Full explanation →

417

MCQhard

A large organization has a PA-5250 firewall pair in active/passive HA mode. The firewalls are managed by Panorama. The security team recently created a new security policy rule to block a specific application (app-block-rule) and pushed the configuration from Panorama. After the push, the active firewall shows the new rule in the security policy list, but traffic matching the rule is not being blocked. The administrator checks the traffic logs and sees that the traffic is being allowed by a different rule with a higher priority. The administrator also notices that the 'app-block-rule' has an 'any' source and destination zone, but the allowed rule has specific zones. The administrator runs 'show session info' and sees that the sessions are being created before the policy push. The administrator wants to ensure that existing sessions are subject to the new policy. Which action should the administrator take?

A.Disable session re-aging on the firewall

B.Commit the configuration on the active firewall

C.Move the new rule to the top of the security policy

D.Enable session re-aging and set a short timeout for the application

AnswerD

Session re-aging forces new policy check on existing sessions.

Why this answer

Session re-aging forces the firewall to re-evaluate existing sessions against the current security policy. When a new policy is pushed, sessions established before the push continue to match the old policy until they expire. By enabling session re-aging and setting a short timeout, the firewall will age out those sessions sooner, causing them to be re-matched against the new 'app-block-rule' and thus be blocked.

Exam trap

The trap here is that candidates think moving the rule to the top of the policy (Option C) will fix the issue, but they overlook that existing sessions are not re-evaluated after a policy change unless session re-aging is enabled.

How to eliminate wrong answers

Option A is wrong because disabling session re-aging would prevent existing sessions from being re-evaluated, making the problem worse. Option B is wrong because the configuration was already pushed from Panorama and committed; the active firewall shows the rule, so a local commit is unnecessary and does not affect existing sessions. Option C is wrong because moving the rule to the top of the policy does not impact sessions that were created before the push; those sessions continue to use the old policy match until they expire or are aged out.

Full explanation →

418

Drag & Dropmedium

Order the steps to configure a static route on a Palo Alto Networks firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Full explanation →

419

MCQhard

A managed security service provider (MSSP) manages firewalls for multiple customers. One customer reports that their ERP application traffic is being dropped intermittently. The firewall logs show that the traffic is sometimes identified as 'erp-app' and allowed, and other times identified as 'unknown-tcp' and denied. The ERP application uses a proprietary protocol over TCP port 5555. The firewall has a custom application definition for 'erp-app' that uses a data pattern. The administrator verifies that the data pattern is correct. What should the administrator do to ensure consistent identification?

A.Increase the session timeout for the application.

B.Create a vulnerability protection profile to inspect the traffic.

C.Enable SSL decryption on the firewall.

D.Modify the custom application to include a port condition (default port 5555).

AnswerD

This provides a reliable port-based fallback when the data pattern is not seen.

Why this answer

The issue is that the custom application 'erp-app' relies solely on a data pattern for identification, but if the first packet of a session does not contain the pattern (e.g., due to TCP segmentation or the pattern appearing later in the flow), App-ID may classify the traffic as 'unknown-tcp' and deny it. By adding a port condition (default port 5555) to the custom application, the firewall will first match the traffic based on the TCP port, then inspect subsequent packets for the data pattern, ensuring consistent identification even if the pattern is not in the initial packet.

Exam trap

The trap here is that candidates may think the data pattern alone is sufficient for identification, overlooking that App-ID may need a port condition to anchor the classification when the pattern is not in the initial packet, leading them to choose irrelevant options like session timeout or SSL decryption.

How to eliminate wrong answers

Option A is wrong because increasing the session timeout would not affect how the traffic is initially identified; it only controls how long an idle session remains open, not the App-ID classification. Option B is wrong because vulnerability protection profiles are used to block exploits and malware, not to influence application identification; they operate after App-ID has already classified the traffic. Option C is wrong because SSL decryption is only relevant if the traffic is encrypted (e.g., HTTPS), but the ERP application uses a proprietary protocol over TCP port 5555, which is not encrypted with SSL/TLS; enabling SSL decryption would not help identify the application.

Full explanation →

420

MCQhard

An organization has a firewall in HA active-passive mode. After a failover, the new active firewall does not have the latest session table. What should be configured to ensure session synchronization?

A.Packet capture on active

B.Session setup on both peers

C.HA session sync

D.Commit force sync

AnswerC

This feature synchronizes active sessions to the passive firewall.

Why this answer

HA session synchronization (session sync) is the feature that replicates active session state from the active firewall to the passive firewall in an active-passive HA pair. Without this configuration, after a failover the new active firewall has no knowledge of existing sessions, causing all active connections to be dropped and requiring clients to re-establish them. Enabling session sync ensures the passive firewall maintains a synchronized session table, allowing seamless traffic continuation after failover.

Exam trap

The trap here is that candidates often confuse configuration synchronization (commit force sync) with runtime state synchronization (session sync), leading them to select Option D, but commit force sync only pushes configuration changes, not dynamic session data.

How to eliminate wrong answers

Option A is wrong because packet capture is a troubleshooting tool used to inspect traffic, not a mechanism to replicate session state between HA peers. Option B is wrong because session setup on both peers is not a configurable feature; session creation occurs naturally on the active firewall, and without session sync the passive peer does not receive those sessions. Option D is wrong because commit force sync is used to force a configuration synchronization from the active to the passive firewall, but it does not synchronize dynamic runtime data like session tables.

Full explanation →

421

MCQmedium

After upgrading a PA-5250, the firewall is not passing traffic. The administrator checks the dataplane CPU utilization and sees it is at 100%. Which command should be run to identify the cause?

A.show session all

B.show system resources dataplane

C.show counter global

D.show running resource-monitor

AnswerB

This command displays dataplane CPU and memory, helping identify the bottleneck.

Why this answer

The 'show system resources dataplane' command displays detailed CPU utilization per dataplane core, which is critical for identifying whether a single core is maxed out (e.g., due to a traffic storm or a specific session) or if the load is evenly distributed. In a PA-5250, the dataplane handles packet forwarding; 100% CPU indicates the dataplane is overwhelmed, and this command pinpoints the exact core(s) under stress, guiding further investigation into the root cause.

Exam trap

The trap here is that candidates often confuse 'show system resources dataplane' with 'show running resource-monitor' (which is for management-plane resource thresholds) or assume 'show session all' will reveal CPU overload, but session counts alone do not indicate CPU saturation.

How to eliminate wrong answers

Option A is wrong because 'show session all' lists all active sessions but does not provide CPU utilization data; it would not help identify why the dataplane CPU is at 100%. Option C is wrong because 'show counter global' displays global packet and byte counters for troubleshooting drops or errors, not CPU usage per core. Option D is wrong because 'show running resource-monitor' shows resource protection thresholds and current usage for management-plane resources, not dataplane CPU core utilization.

Full explanation →

422

MCQeasy

A company has a firewall with multiple virtual routers. They need to ensure that traffic from a specific subnet (10.1.1.0/24) can reach the internet but not other internal subnets. What is the best way to achieve this?

A.Use NAT policies

B.Configure static routes in the virtual router

C.Implement security policies with source zone and destination zone

D.Configure path monitoring

AnswerC

Security policies allow or deny traffic based on zones. By placing the subnet in a separate zone and creating policies, you can control access.

Why this answer

Security policies in Palo Alto Networks firewalls control traffic based on source and destination zones, enabling you to restrict traffic from the 10.1.1.0/24 subnet (assigned to a specific zone) to only the internet zone while blocking access to other internal subnets. This is achieved by creating a security policy that allows traffic from the source zone (e.g., 'Internal') to the destination zone (e.g., 'Internet') and explicitly denying traffic to other internal zones, without relying on routing or NAT.

Exam trap

The trap here is that candidates often confuse routing (static routes) with security policies, assuming that controlling the path via routes can restrict access, but in Palo Alto firewalls, access control is enforced by security policies, not routing tables.

How to eliminate wrong answers

Option A is wrong because NAT policies only translate IP addresses and do not control access between subnets; they cannot prevent traffic from reaching internal subnets. Option B is wrong because static routes determine the path for traffic but do not enforce access control; they would allow traffic to any reachable destination, including internal subnets. Option D is wrong because path monitoring is used for link failure detection and failover, not for restricting traffic between subnets.

Full explanation →

423

MCQhard

Refer to the exhibit. A user at IP 10.10.1.11 is unable to access internal resources that require authentication. The firewall logs show 'no user mapping' for traffic from this IP. Which step should the administrator take first?

A.Configure an authentication policy to trigger captive portal for that IP.

B.Verify that the User-ID agent has network access to the client at 10.10.1.11.

C.Check the Kerberos keytab file.

D.Manually create a static mapping for IP 10.10.1.11.

AnswerB

If the User-ID agent cannot communicate with the client or domain controller, no mapping is created.

Why this answer

The 'no user mapping' error indicates that the firewall cannot correlate the IP address (10.10.1.11) with a username. The first step is to verify that the User-ID agent can reach the client, because without network connectivity, the agent cannot collect user mappings via probing (e.g., WMI, NetBIOS, or terminal services). Option B directly addresses this root cause.

Exam trap

The trap here is that candidates often jump to configuring authentication policies or static mappings without first verifying the basic connectivity between the User-ID agent and the client, which is the most common root cause of missing user mappings.

How to eliminate wrong answers

Option A is wrong because configuring an authentication policy to trigger captive portal would require the user to actively authenticate, but the issue is that the firewall already lacks a user mapping for the IP; captive portal is a separate mechanism and not the first troubleshooting step. Option C is wrong because checking the Kerberos keytab file is relevant only if the firewall is configured for Kerberos-based authentication (e.g., for GlobalProtect or captive portal), but the core problem is missing user mapping, not a keytab misconfiguration. Option D is wrong because manually creating a static mapping is a workaround, not a diagnostic step; the administrator should first determine why the User-ID agent is not mapping the IP dynamically.

Full explanation →

424

MCQhard

A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?

A.Create a security policy rule allowing the traffic between the zones.

B.Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.

C.Configure route redistribution between VR-A and VR-B using a routing protocol.

D.Place all interfaces in the same virtual router.

AnswerB

This gives VR-B the necessary routing information to reach the subnet via VR-A.

Why this answer

Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet.

This is the standard method for inter-virtual-router routing without dynamic redistribution.

Exam trap

The trap here is that candidates often assume security policies are the only barrier between virtual routers, forgetting that virtual routers are isolated routing domains and a route must exist in the source virtual router's table before any policy can be applied.

How to eliminate wrong answers

Option A is wrong because security policy rules control traffic flow between zones but do not affect routing; without a route in VR-B, traffic will be dropped by the firewall's routing lookup before any security policy is evaluated. Option C is wrong because route redistribution requires a routing protocol (e.g., OSPF, BGP) to be configured on both virtual routers, which is unnecessary overhead when a simple static route achieves the same result without protocol convergence delays. Option D is wrong because placing all interfaces in the same virtual router defeats the purpose of segmentation and would merge the routing tables, potentially causing routing conflicts and breaking the isolation that virtual routers provide.

Full explanation →

425

MCQeasy

A small business uses a single PA-220 firewall with PAN-OS 10.2. The administrator notices that the firewall is no longer receiving automatic threat updates. The License page shows the Threat Prevention license is active with 200 days remaining. The administrator can manually download updates from the Palo Alto Networks update server. What is the most likely cause?

A.The firewall is behind a proxy that blocks the update service.

B.The update schedule is disabled.

C.The firewall's system clock is incorrect.

D.The DNS settings are misconfigured.

AnswerB

If the schedule is disabled, automatic updates will not occur, but manual downloads are still possible.

Why this answer

The most likely cause is that the update schedule is disabled. Even though the Threat Prevention license is active and manual downloads work, the firewall will not automatically check for or download updates if the scheduled update feature is turned off. In PAN-OS 10.2, the administrator must configure a recurring schedule under Device > Dynamic Updates for automatic updates to occur; otherwise, only manual downloads are possible.

Exam trap

The trap here is that candidates assume a valid license guarantees automatic updates, overlooking that the update schedule is a separate configuration setting that must be explicitly enabled.

How to eliminate wrong answers

Option A is wrong because if a proxy were blocking the update service, manual downloads would also fail, as they use the same outbound HTTPS connection to the Palo Alto Networks update server. Option C is wrong because an incorrect system clock would cause SSL certificate validation failures and prevent both automatic and manual updates, but the administrator can manually download updates successfully. Option D is wrong because misconfigured DNS would prevent resolution of the update server's FQDN, breaking both automatic and manual updates, yet manual downloads work.

Full explanation →

426

MCQhard

An organization is deploying a pair of PA-5250 firewalls in active/passive high availability. The network team notices that the passive firewall is not receiving synchronization updates. Both devices have the same software version and licenses. The HA1 control link is connected and shows 'up' in 'show high-availability state'. What is the most likely reason for the synchronization failure?

A.The HA2 link is not configured or is down.

B.The HA1 link is using a crossover cable instead of a straight-through cable.

C.The link speeds on the active and passive firewalls do not match.

D.The passive firewall is not in a 'passive' state.

AnswerA

Session synchronization requires HA2 link to be configured and operational.

Why this answer

The HA2 link is used for session synchronization in active/passive HA configurations. Even if the HA1 control link is up and passing heartbeats, without a functioning HA2 link, the passive firewall will not receive session state updates. The 'show high-availability state' command only confirms HA1 status, not HA2.

Exam trap

The trap here is that candidates assume a working HA1 control link implies full HA functionality, but the HA2 link is a separate requirement for session synchronization in active/passive mode.

How to eliminate wrong answers

Option B is wrong because the HA1 link uses a crossover cable for direct connections between firewalls (no switch), and a straight-through cable would be incorrect; this would cause the link to fail, but the question states the HA1 link is 'up'. Option C is wrong because mismatched link speeds on HA interfaces can cause errors or flapping, but the HA1 link is already up, and speed mismatch does not prevent synchronization specifically—it would affect the link state. Option D is wrong because if the passive firewall were not in a 'passive' state, the HA pair would not form, and the active firewall would not attempt to send synchronization updates; the question implies the pair is formed since HA1 is up.

Full explanation →

427

Multi-Selectmedium

Which TWO statements correctly describe the role of the data plane in PAN-OS architecture?

Select 2 answers

A.It performs content inspection.

B.It runs routing protocols like OSPF.

C.It handles all packet forwarding and security processing.

D.It stores log files.

E.It manages the web interface and CLI.

AnswersA, C

Content inspection (e.g., threat prevention) is performed by the data plane.

Why this answer

The data plane performs content inspection, including threat prevention, URL filtering, and application identification, using the single-pass software architecture to scan traffic in real time. This is a core function of the data plane, separate from the control and management planes.

Exam trap

The trap here is confusing the data plane with the control plane or management plane, as candidates often assume that routing protocols or logging are part of packet forwarding, when in PAN-OS they are strictly separated.

Full explanation →

428

MCQeasy

A company uses Policy-Based Forwarding (PBF) to route specific traffic from internal users to a partner network through an MPLS connection. The PBF rule is configured to match source addresses 10.1.1.0/24 and forward to a next-hop of 10.2.1.1. The administrator verifies that the MPLS router is reachable from the firewall. Traffic from the 10.1.1.0/24 network does not go through the MPLS link; instead, it takes the default route out the internet connection. Logs show that the traffic hits the PBF rule. What is the most likely issue?

A.The PBF rule is missing the egress interface configuration; it only specifies the next-hop IP.

B.The PBF rule's source zone is misconfigured.

C.The firewall's routing table does not have a route to the partner network via the MPLS router.

D.The PBF rule does not include a security policy to allow the traffic.

AnswerA

PBF requires the next-hop and interface; if only IP is set, the firewall may not know which interface to use, defaulting to routing table.

Why this answer

A PBF rule in PAN-OS requires both a next-hop IP and an egress interface to be explicitly configured. Without the egress interface, the firewall cannot determine which physical or logical interface to use for forwarding the matched traffic, so it falls back to the default route. Even though the traffic hits the PBF rule, the missing interface configuration prevents the policy-based forwarding from taking effect.

Exam trap

The trap here is that candidates assume specifying only the next-hop IP is sufficient for PBF, similar to a static route, but PAN-OS requires both the next-hop and the egress interface for policy-based forwarding to function correctly.

How to eliminate wrong answers

Option B is wrong because the logs confirm that the traffic hits the PBF rule, which means the source zone matching is already working correctly; a misconfigured source zone would prevent the rule from being matched at all. Option C is wrong because PBF overrides the routing table for matched traffic; the firewall does not need a separate route to the partner network via the MPLS router—the PBF rule itself provides the forwarding decision. Option D is wrong because security policies are evaluated after PBF; if the traffic hits the PBF rule, it has already passed the security policy check, so a missing security policy would block the traffic entirely, not cause it to take the default route.

Full explanation →

429

MCQmedium

An organization wants to map user identity from Active Directory for traffic coming from internal LAN users without installing any agent on domain controllers. Which User-ID mapping method should be used?

A.Active Directory polling

B.XML API

C.Terminal Services Agent

D.Captive Portal

AnswerA

Active Directory polling retrieves user-IP mappings from domain controller logs.

Why this answer

Active Directory polling is the correct method because it allows the Palo Alto Networks firewall to retrieve user-to-IP mappings directly from Active Directory domain controllers using LDAP queries, without requiring any agent installation. This method polls the security event logs on domain controllers to map authenticated users to their IP addresses, making it ideal for environments where agentless user identification is desired for internal LAN traffic.

Exam trap

The trap here is that candidates often confuse Terminal Services Agent with a general agentless solution, but it is actually a specialized agent for multi-user environments, not a method for mapping standard LAN users without installing software.

How to eliminate wrong answers

Option B (XML API) is wrong because the XML API is used for programmatic configuration and data retrieval from the firewall, not for real-time user mapping from Active Directory. Option C (Terminal Services Agent) is wrong because it is specifically designed to map users in Terminal Services or Citrix environments where multiple users share a single IP address, not for general LAN user mapping without an agent. Option D (Captive Portal) is wrong because it requires end-user interaction via a web browser to authenticate, which is not suitable for transparently mapping existing Active Directory users without installing an agent.

Full explanation →

430

MCQeasy

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

A.show session info

B.show running np-ips

C.show device-info

D.show high-availability state

AnswerD

Displays HA status including link states.

Why this answer

The 'show high-availability state' command is the correct CLI command to verify the health of HA1, HA2, and HA3 links because it displays the current status, link state, and any failures for each HA link in a Palo Alto Networks firewall. This command provides a comprehensive view of the HA control link (HA1), data link (HA2), and backup link (HA3), including their operational status and packet statistics, which is essential for troubleshooting high-availability configurations.

Exam trap

The trap here is that candidates often confuse 'show high-availability state' with 'show device-info' or 'show session info', assuming general system or session data includes HA link details, but only the dedicated HA command provides the granular link status required for this verification.

How to eliminate wrong answers

Option A is wrong because 'show session info' displays information about active sessions, such as source/destination IPs and ports, not the status of HA links. Option B is wrong because 'show running np-ips' shows the running configuration of network processor IP addresses, which is unrelated to HA link health verification. Option C is wrong because 'show device-info' provides general system information like model, serial number, and uptime, but does not include the specific status of HA1, HA2, or HA3 links.

Full explanation →

431

Multi-Selecthard

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Select 3 answers

A.Policy-based VPN using a tunnel monitor

B.GlobalProtect Gateway configuration

C.Route-based VPN using a virtual router and static route

D.SSL VPN using GlobalProtect portal

E.Tunnel interface with IPSec tunnel configuration

AnswersA, C, E

Policy-based VPN uses security policies to define interesting traffic.

Why this answer

A policy-based VPN on Palo Alto Networks uses a tunnel monitor to verify the health of the IPSec tunnel by sending ICMP probes to the peer's tunnel IP address. This allows the firewall to detect tunnel failures and trigger failover or route changes, which is a standard method for site-to-site VPN configuration.

Exam trap

The trap here is that candidates confuse remote access VPN methods (GlobalProtect Gateway and Portal) with site-to-site VPN methods, leading them to select options B or D, which are exclusively for client-to-site connectivity.

Full explanation →

432

MCQmedium

An administrator reviews a traffic log entry: 'Source: 10.0.0.10, Destination: 8.8.8.8, Application: web-browsing, Action: allow, Bytes Sent: 500, Bytes Received: 1200'. What does this log entry indicate about the traffic?

A.The traffic was blocked by a security policy.

B.The traffic was only one-way; only received bytes were logged.

C.The traffic was allowed and identified as web-browsing.

D.The application was incorrectly identified.

AnswerC

The log confirms both the action and the application.

Why this answer

The log entry shows 'Action: allow', which explicitly indicates the firewall permitted the traffic. The 'Application: web-browsing' field confirms that the Palo Alto Networks firewall correctly identified the traffic as HTTP/HTTPS (web-browsing) using App-ID, not just by port. The presence of both 'Bytes Sent' and 'Bytes Received' with non-zero values confirms bidirectional communication, so the traffic was allowed and properly classified.

Exam trap

The trap here is that candidates may assume traffic to 8.8.8.8 is always DNS and thus think the application was misidentified, but the log explicitly shows 'web-browsing' which is valid for HTTP/HTTPS traffic to any IP, and the 'allow' action confirms the firewall permitted it.

How to eliminate wrong answers

Option A is wrong because the 'Action: allow' field directly contradicts blocking; a blocked session would show 'Action: deny' or 'drop'. Option B is wrong because both 'Bytes Sent: 500' and 'Bytes Received: 1200' are non-zero, proving bidirectional traffic, not one-way. Option D is wrong because the application 'web-browsing' is a standard App-ID for HTTP/HTTPS traffic to a public DNS server (8.8.8.8), and there is no evidence of misidentification; App-ID uses deep packet inspection to verify the application regardless of port.

Full explanation →

433

Multi-Selectmedium

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Select 2 answers

A.SSL decryption is not enabled for the session.

B.The firewall CPU is too slow to process packets.

C.The content-ID engine has not been licensed.

D.Asymmetric routing where the firewall sees only one direction of traffic.

E.A deny rule that blocks the traffic.

AnswersA, D

Encrypted payload cannot be inspected for application identification.

Why this answer

App-ID classifies a session as 'incomplete' when it cannot identify the application because it sees only partial traffic. SSL decryption not being enabled prevents the firewall from inspecting encrypted payloads, so App-ID cannot complete its signature-based or heuristic analysis, leaving the session marked as incomplete.

Exam trap

The trap here is that candidates often confuse 'incomplete' with 'blocked' or 'error' states, assuming a slow CPU or licensing issue would cause incomplete classification, when in fact incomplete specifically means the firewall lacks sufficient traffic data to identify the application.

Full explanation →

434

Multi-Selecteasy

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Select 2 answers

A.Reboot the firewall

B.Change the interface IP address

C.Verify the security policy order

D.Check the session table for the traffic

E.Update the threat prevention signature

AnswersC, D

Misplaced rules can cause traffic to be denied or not matched.

Why this answer

Security policy order determines which rule matches traffic first; if a policy is misordered or a deny rule precedes an allow rule, traffic will be blocked. Verifying policy order ensures that the intended allow rule is evaluated before any conflicting deny rules, which is a fundamental step in troubleshooting traffic flow on a Palo Alto Networks firewall.

Exam trap

The trap here is that candidates often assume rebooting or updating signatures will fix traffic issues, but these actions do not address the most common causes like policy misordering or session state problems, which are directly verifiable through the session table and policy order review.

Full explanation →

435

Multi-Selecteasy

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Select 2 answers

A.Disable App-ID for traffic that does not match any known application to improve performance.

B.Configure all security policies based on port only for consistency.

C.Use applications instead of ports in security policies.

D.Enable security profiles (e.g., vulnerability protection) along with App-ID.

E.Limit application usage to only well-known applications to reduce attack surface.

AnswersC, D

App-ID provides application-level control.

Why this answer

App-ID is designed to identify traffic based on application signatures, not ports, enabling more granular and accurate security policy enforcement. Using applications instead of ports allows the firewall to control modern applications that may use non-standard ports or hop between ports, which is a core best practice for Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often think disabling App-ID for unknown traffic improves performance (Option A), but this actually creates a security gap; the correct approach is to use 'default' rules with security profiles to handle unknown traffic safely.

Full explanation →

436

MCQhard

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

A.Disable SSL inspection on the security policy for this traffic.

B.Create an application override policy for this traffic to mark it as the custom application.

C.Enable SSL decryption on the traffic to inspect the payload.

D.Define a custom application object with the correct protocol signature and protocol type.

AnswerD

A custom application object allows the firewall to accurately identify the traffic based on its actual protocol characteristics.

Why this answer

The firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Exam trap

The trap here is that candidates often confuse application override (which forces classification) with custom application definition (which teaches the firewall to correctly identify the traffic), leading them to choose Option B instead of D.

How to eliminate wrong answers

Option A is wrong because disabling SSL inspection does not change how the firewall identifies the application; it only prevents decryption, leaving the misclassification intact. Option B is wrong because an application override policy forces the firewall to treat the traffic as the custom application regardless of the actual payload, which bypasses proper identification and can lead to security policy misapplication; it does not teach the firewall to correctly identify the application. Option C is wrong because enabling SSL decryption would attempt to decrypt traffic that is not actually SSL (since it is a custom application over TCP 44321), causing decryption failures and potential session drops, and it does not correct the underlying application identification.

Full explanation →

437

MCQhard

A firewall's dataplane CPU is consistently at 95% utilization even though session count is normal. Analysis shows that a large number of small packets are being processed. Which feature could be causing excessive dataplane processing?

A.Log forwarding to Panorama

B.User-ID agent polling

C.Fragmented packet reassembly

D.SSL Decryption with Forward Proxy

AnswerC

Reassembling many small fragmented packets consumes significant dataplane CPU.

Why this answer

Fragmented packet reassembly forces the dataplane to buffer and reassemble IP fragments before performing security policy checks. This process is CPU-intensive, especially when handling a high volume of small fragments, and can drive dataplane utilization to 95% even when the session count is normal. The firewall must allocate resources to track and reassemble each fragmented datagram, which explains the excessive processing.

Exam trap

The trap here is that candidates often associate high dataplane CPU with SSL decryption or logging, but the key clue is 'large number of small packets' — a classic indicator of fragmentation-related processing overhead, not encryption or management tasks.

How to eliminate wrong answers

Option A is wrong because log forwarding to Panorama is a management-plane task that does not consume dataplane CPU cycles; it uses the management plane or a dedicated logging interface. Option B is wrong because User-ID agent polling is a control-plane function that collects user mappings from domain controllers and does not directly affect dataplane packet processing. Option D is wrong because SSL Decryption with Forward Proxy, while CPU-intensive, typically manifests as high utilization during TLS handshake and decryption of large payloads, not from processing a large number of small packets; the symptom of small packets points to fragmentation, not SSL.

Full explanation →

438

Matchingmedium

Match each log type to its content.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Records session start, end, and bytes transferred

Logs blocked malware, exploits, or spyware

Logs web requests and category matches

Tracks files sent for cloud analysis

Records administrative actions and system events

Why these pairings

The correct matches are: Traffic log tracks session details; Threat log records security threats; URL Filtering log logs web browsing activity; WildFire Submissions log documents file samples sent for analysis. Common confusions include swapping Traffic with URL Filtering definitions or Threat with WildFire Submissions.

Full explanation →

439

Multi-Selecteasy

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Select 2 answers

A.show system info

B.show vpn ike-sa

C.show routing route

D.show vpn ipsec-sa

E.show interface all

AnswersB, D

This shows the IKE security associations.

Why this answer

'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often confuse general network commands (like routing or interface status) with VPN-specific commands, assuming that a working route or interface implies a functional IPSec tunnel, when in fact the tunnel may be down due to IKE or IPSec SA failures.

Full explanation →

440

MCQeasy

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

A.The App-ID signature database is outdated.

B.The security policy does not have an allow rule for web-browsing.

C.The firewall is experiencing asymmetric routing.

D.SSL decryption is not enabled for the traffic.

AnswerD

Without SSL decryption, encrypted traffic cannot be fully inspected, leading to 'incomplete' App-ID.

Why this answer

When SSL decryption is not enabled, the firewall cannot inspect encrypted HTTPS traffic payloads. As a result, App-ID may classify the traffic as 'incomplete' because it cannot match the encrypted payload to the web-browsing application signature. Enabling SSL decryption allows the firewall to decrypt the traffic, inspect the payload, and correctly identify the application.

Exam trap

The trap here is that candidates often assume 'incomplete' means a policy or signature issue, when in fact it specifically indicates that App-ID could not gather enough data from the encrypted session to complete identification, pointing directly to SSL decryption as the root cause.

How to eliminate wrong answers

Option A is wrong because an outdated App-ID signature database would cause unknown or misclassified applications, not specifically an 'incomplete' classification; the 'incomplete' status is a result of insufficient data for identification, not missing signatures. Option B is wrong because the security policy's allow rule determines whether traffic is permitted or blocked, not how it is classified in the App-ID table; 'incomplete' is a classification status, not a policy action. Option C is wrong because asymmetric routing can cause session setup issues or traffic to be dropped, but it does not directly cause App-ID to classify traffic as 'incomplete'; App-ID relies on the first few packets of a session, and asymmetric routing would more likely result in session timeouts or non-symmetric flow errors.

Full explanation →

441

MCQhard

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

A.The session was terminated by a firewall policy.

B.The session was idle for longer than the timeout threshold.

C.The session was forcibly closed by an administrator.

D.The session ended due to a TCP FIN/RST from the client.

AnswerB

Aged-out indicates the session was idle and reached the timeout.

Why this answer

The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Exam trap

Palo Alto Networks often tests the misconception that 'aged-out' means the session was terminated by a security policy or explicit reset, but the trap here is that 'aged-out' specifically refers to an idle timeout, not a policy action or TCP handshake termination.

How to eliminate wrong answers

Option A is wrong because a firewall policy termination would show 'Session End Reason: policy-deny' or similar, not 'aged-out'. Option C is wrong because an administrator forcibly closing a session would generate a 'Session End Reason: admin-reset' or 'session-manager clear session' event. Option D is wrong because a TCP FIN/RST from the client would result in 'Session End Reason: tcp-fin' or 'tcp-rst', not 'aged-out', which specifically indicates idle timeout.

Full explanation →

442

MCQeasy

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

A.The rule must also specify the source zone.

B.The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.

C.The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.

D.The URL filtering license is not installed or expired.

AnswerC

Without decryption, the firewall cannot see the URL, so the URL category condition never matches.

Why this answer

When traffic is encrypted (HTTPS), the firewall cannot inspect the URL path or query parameters unless SSL decryption is enabled. Without decryption, URL filtering relies on the Server Name Indication (SNI) or IP address, which may not distinguish between 'youtube' and 'youtube.com/education' traffic. Since the rule requires both the application 'youtube' and the URL category 'educational-videos', the firewall cannot match the URL category for encrypted YouTube traffic, causing all YouTube traffic to be blocked by the implicit deny rule.

Exam trap

The trap here is that candidates assume App-ID and URL filtering are independent and always work together, but they overlook that URL filtering on encrypted traffic requires SSL decryption to inspect the URL path, a nuance frequently tested in PCNSE questions about decryption policies.

How to eliminate wrong answers

Option A is wrong because the source zone is not required for URL filtering to work; a rule without a source zone will match all zones, and the issue is not about zone matching but about the inability to evaluate the URL category on encrypted traffic. Option B is wrong because when both App-ID and URL filtering are used in a rule, the firewall evaluates both conditions; App-ID identifies the application (e.g., 'youtube'), and URL filtering further refines based on the URL category, so the application match does not prevent URL category evaluation. Option D is wrong because if the URL filtering license were missing or expired, the firewall would not apply any URL category match, but the question states that the URL category 'educational-videos' is recognized, and the issue is specifically that encrypted traffic prevents URL category lookup.

Full explanation →

443

MCQmedium

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

A.The certificate used for the Captive Portal page

B.The session timeout for authenticated users

C.The authentication sequence settings in the Captive Portal configuration

D.The User-ID agent mapping

AnswerC

If the sequence does not include reachable servers or has incorrect priorities, authentication requests may time out.

Why this answer

When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail.

Checking this first isolates the issue efficiently before investigating other components.

Exam trap

The trap here is that candidates often jump to checking the certificate (Option A) because Captive Portal uses HTTPS, but the timeout symptom specifically indicates a backend authentication server issue, not a certificate problem.

How to eliminate wrong answers

Option A is wrong because a certificate issue would typically cause SSL/TLS errors or browser warnings, not authentication request timeouts; the firewall would still process the request but the page might not load securely. Option B is wrong because session timeout controls how long an authenticated user remains active, not the initial authentication process; changing it would not affect the timeout of authentication requests. Option D is wrong because the User-ID agent mapping is used to map IP addresses to usernames after authentication, not to process the initial Captive Portal authentication requests; a timeout during authentication points to the authentication server or sequence, not the mapping agent.

Full explanation →

444

MCQhard

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

A.The IKE gateway is not configured with the correct peer IP.

B.No security policy allows traffic from the VPN zone.

C.The proxy IDs do not match the remote peer.

D.The tunnel interface is not assigned to a zone.

AnswerB

Even though the tunnel is up, traffic can be blocked by security policy if no rule permits it.

Why this answer

When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Exam trap

Palo Alto Networks often tests the misconception that a tunnel being up automatically means traffic will pass, but Palo Alto Networks requires an explicit security policy to permit decrypted traffic from the VPN zone.

How to eliminate wrong answers

Option A is wrong because if the IKE gateway had an incorrect peer IP, the tunnel would not come up at all (IKE phase 1 would fail). Option C is wrong because mismatched proxy IDs would cause IPsec SA negotiation to fail, preventing the tunnel from reaching an up state. Option D is wrong because a tunnel interface not assigned to a zone would cause the interface itself to be inactive, and the tunnel would not show as up; the question states the tunnel is up, so the interface must be zoned.

Full explanation →

445

Matchingmedium

Match each decryption type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Decrypts outbound traffic to inspect it

Decrypts inbound traffic to servers

Decrypts SSH traffic for policy enforcement

Traffic bypasses decryption

Sends decrypted traffic to a monitoring tool

Why these pairings

Correct matches: SSL Forward Proxy decrypts outbound traffic; SSL Inbound Inspection decrypts inbound traffic; SSH Proxy inspects SSH; Decryption Mirror duplicates decrypted traffic. Common confusion is swapping the direction of SSL decryption types.

Full explanation →

446

MCQeasy

After upgrading the software on an HA pair, the two firewalls report different HA states. Which command should be used to quickly verify the HA configuration synchronization status?

A.show high-availability pending-changes

B.show high-availability state

C.show high-availability sync-status

D.show high-availability link-monitoring

AnswerC

Displays config sync status between peers.

Why this answer

The 'show high-availability sync-status' command specifically displays the synchronization status of the configuration between HA peers, including whether the active and passive firewalls are in sync, the last sync time, and any pending changes. After a software upgrade, configuration mismatches can occur due to version differences or failed syncs, and this command directly verifies if the configurations are synchronized.

Exam trap

PCNSE candidates often confuse the HA state (active/passive) with configuration synchronization status. The 'show high-availability state' command shows the operational state, not the sync status. After a software upgrade, verifying configuration sync is critical, making 'show high-availability sync-status' the correct command.

How to eliminate wrong answers

Option A is wrong because 'show high-availability pending-changes' shows configuration changes that have been made on the local firewall but not yet committed, not the synchronization status between HA peers. Option B is wrong because 'show high-availability state' displays the current HA operational state (e.g., active, passive, non-functional) and peer information, but does not show whether the configurations are synchronized. Option D is wrong because 'show high-availability link-monitoring' shows the status of monitored HA links and interfaces, not the configuration synchronization status.

Full explanation →

447

MCQmedium

A company has deployed SSL Inbound Inspection to inspect HTTPS traffic to their internal web server hosting a custom application that requires mutual TLS authentication. The firewall is configured with a decryption policy that includes the server's certificate and the action 'decrypt'. The web server is configured to request client certificates. After implementation, users report that the application fails to authenticate them. The firewall logs show that SSL handshake with the client completes successfully, but the server never receives the client certificate during the handshake. The administrator has verified that the decryption policy is active and the server certificate is correctly imported. What is the most likely cause of this issue?

A.The decryption policy is set to 'no-decrypt' for the application's traffic.

B.The client certificates are not trusted by the firewall.

C.The firewall's SSL Inbound Inspection profile is set to 'passive' mode.

D.The firewall is not configured to forward client certificates to the server.

AnswerD

In SSL Inbound Inspection, the firewall must be configured to forward client certificates in the decryption profile; otherwise, it does not pass them.

Why this answer

In SSL Inbound Inspection, the firewall acts as a man-in-the-middle, terminating the client's SSL connection and then initiating a new SSL connection to the server. By default, the firewall does not forward the client certificate from the original client handshake to the server. To enable mutual TLS authentication, the administrator must explicitly configure the firewall to forward client certificates, typically via a Decryption Profile setting.

Since the logs show a successful handshake with the client but the server never receives the client certificate, the missing forwarding configuration is the most likely cause.

Exam trap

Palo Alto Networks often tests the distinction between SSL Forward Proxy and SSL Inbound Inspection, and candidates mistakenly assume that client certificates are automatically forwarded in inbound scenarios, when in fact they require explicit configuration in the decryption profile.

How to eliminate wrong answers

Option A is wrong because the decryption policy is verified as active and set to 'decrypt', not 'no-decrypt', and the logs show the SSL handshake completes successfully, which would not happen if decryption were disabled. Option B is wrong because the firewall does not validate client certificates during SSL Inbound Inspection unless specifically configured to do so; the issue is that the client certificate is not being forwarded, not that it is untrusted. Option C is wrong because 'passive' mode is not a valid setting in SSL Inbound Inspection profiles; the firewall uses 'decrypt' action for inbound inspection, and passive mode applies to SSL Forward Proxy decryption, not inbound scenarios.

Full explanation →

448

MCQeasy

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

A.Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.

B.Create a security rule with destination port 80 and 443 and action set to 'allow'.

C.Create a security profile that blocks all applications not in the allow list.

D.Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.

AnswerA

This rule allows only the specified applications.

Why this answer

App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Exam trap

The trap here is that candidates often confuse port-based rules (Option B) with application-based rules, assuming that allowing ports 80/443 is sufficient to control application access, but App-ID is required to distinguish between applications using the same port.

How to eliminate wrong answers

Option B is wrong because allowing destination ports 80 and 443 would permit all HTTP/HTTPS traffic, including applications like 'facebook-base' and 'youtube', but it would also allow many other web-based applications (e.g., 'twitter', 'dropbox'), failing to block them. Option C is wrong because security profiles (e.g., Antivirus, Vulnerability Protection) do not control which applications are allowed or blocked; they inspect traffic that is already permitted by the security rule's action. Option D is wrong because URL filtering rules control access based on URL categories, not application identities; 'social-networking' and 'multimedia' categories would include many applications beyond just 'facebook-base' and 'youtube', and URL filtering cannot enforce application-level granularity like App-ID can.

Full explanation →

449

MCQhard

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

A.The user's GlobalProtect client software is outdated

B.The gateway's 'Allow Access' list does not include the user

C.The gateway's interface is not in the same zone as the portal

D.The portal's 'Access' list does not include the user

AnswerB

The gateway can restrict access based on user or group; if the user is not allowed, the connection is dropped.

Why this answer

After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Exam trap

The trap here is confusing the portal's 'Access' list (which controls initial client configuration download) with the gateway's 'Allow Access' list (which controls post-authentication resource access), leading candidates to incorrectly select option D.

How to eliminate wrong answers

Option A is wrong because an outdated GlobalProtect client typically causes connection failures or feature incompatibilities, but the user authenticated successfully, indicating the client version is compatible with the gateway. Option C is wrong because the portal and gateway interfaces do not need to be in the same zone; they are separate components that can reside in different zones, and this would not cause post-authentication resource access failure. Option D is wrong because the portal's 'Access' list controls who can download the client configuration and connect to the portal, not access to resources through the gateway; the user already authenticated to the portal successfully.

Full explanation →

450

MCQhard

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

A.Heartbeat interface down

B.Firmware version mismatch (one firewall is on 10.1.4)

C.Management IP mismatch

D.License mismatch

AnswerB

HA requires exact PAN-OS version match. Even a minor patch difference can cause synchronization failure.

Why this answer

In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Exam trap

The trap here is that candidates often assume a heartbeat failure or license issue causes the 'non-functioning' state, but the specific PAN-OS version mismatch is the only condition that directly triggers this exact HA state in an active/passive pair.

How to eliminate wrong answers

Option A is wrong because a heartbeat interface down would typically cause the passive firewall to show a 'suspended' or 'down' state, not 'non-functioning', and the HA pair would attempt to use alternate paths or fail to form, but the specific 'non-functioning' state is not directly tied to a heartbeat failure. Option C is wrong because a management IP mismatch does not affect HA state; HA uses dedicated HA interfaces and IPs for control and data synchronization, not the management IP, so the passive firewall would still show a healthy state if other conditions are met. Option D is wrong because license mismatches do not cause a 'non-functioning' HA state; they may generate warnings or prevent certain features from working, but the HA pair itself will form and show active/passive states correctly as long as the PAN-OS versions match and HA configuration is valid.

Full explanation →

Palo Alto Networks Certified Network Security Engineer PCNSE (PCNSE) — Questions 376–450