Knowledge + Practice

CCNA Core Concepts and Architecture Questions

54 questions · Core Concepts and Architecture · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A network security engineer is deploying a Palo Alto Networks firewall in a high-availability (HA) active/passive configuration. The engineer wants to ensure that the passive firewall takes over seamlessly if the active firewall fails. Which of the following is a requirement for HA active/passive configuration?

A.The active firewall must have a higher priority value than the passive firewall.

B.Both firewalls must be configured with the same management IP address.

C.Both firewalls must have identical hardware models and software versions.

D.The passive firewall must have a separate security policy that blocks all traffic.

AnswerC

For HA active/passive, both firewalls must be the same hardware model and run the same PAN-OS software version. This ensures that the passive firewall can take over without compatibility issues. If the models or software versions differ, the HA pair may not form, or failover may not work correctly. Identical hardware and software also ensure consistent performance and feature support. While some platforms allow mixed models in HA, it is not recommended and may not be supported. For seamless failover, identical configurations are essential.

Why this answer

For HA active/passive, both firewalls must be identical in hardware model and PAN-OS software version to ensure compatibility and seamless failover. The passive firewall synchronizes configuration from the active firewall, so security policies are the same. Each firewall needs a unique management IP for separate management.

Priority values are used for election but are not required to be higher on the active firewall. The passive firewall does not have a separate blocking policy.

Exam trap

The trap here is thinking that the active firewall must have a higher priority, but priority is only used for election and does not define the active/passive role.

Practice this question →

2

Multi-Selecthard

Which THREE of the following are key differences between the Palo Alto Networks Next-Generation Firewall and Cloud-Delivered Security Services (CDSS)?

Select 3 answers

A.CDSS performs full application-level packet inspection.

B.CDSS offers services like DNS Security and WildFire that require an internet connection to the cloud.

C.CDSS provides cloud-based threat analysis and signature updates, while the firewall is the enforcement point.

D.CDSS is a replacement for the firewall's local threat prevention functionality.

E.CDSS can automatically share threat intelligence across all subscribed firewalls.

AnswersB, C, E

CDSS services such as DNS Security and WildFire run in Palo Alto Networks' cloud, so the firewall needs outbound internet connectivity to query them. This satisfies the scenario's requirement for a key difference: these subscriptions are cloud-delivered rather than fully on-box.

Why this answer

Option B is correct because CDSS subscriptions such as DNS Security and WildFire are cloud-hosted services that the firewall must reach over the internet to submit files/URLs and retrieve verdicts, unlike purely on-box inspection. Option C is correct because the architectural split is that CDSS performs cloud-based threat analysis and delivers dynamic signature/content updates, while the NGFW remains the inline enforcement point that applies policy and blocks traffic. Option E is correct because CDSS aggregates telemetry from all subscribed firewalls and pushes newly derived threat intelligence back out globally, giving every firewall protection from threats seen anywhere.

Option A is not correct because full application-level packet inspection is done by the NGFW's App-ID engine on the firewall itself, not by CDSS. Option D is not correct because CDSS augments rather than replaces the firewall's local threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) capabilities.

Exam trap

The trap here is assuming CDSS replaces local firewall functions (like packet inspection or threat prevention) rather than understanding it as a complementary cloud service that enhances, not substitutes, the firewall's core enforcement capabilities.

Practice this question →

3

MCQeasy

A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?

A.Enable IKE on the management interface.

B.Enable User-ID on the management interface.

C.Configure a service route to redirect management traffic to a dataplane interface.

D.Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.

AnswerD

Adding the user's subnet to Permitted IP Addresses under Device > Setup > Management restricts HTTPS management access to explicitly listed sources, satisfying the dedicated MGMT network constraint. Without this entry, the firewall silently drops management-plane traffic from unlisted addresses, so the help desk user is denied despite correct routing and policy.

Why this answer

The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.

Exam trap

The trap here is that candidates often confuse management access control with service routes or dataplane features, assuming that being on the same MGMT network is sufficient, but the firewall explicitly blocks all management protocol access by default unless the source IP is permitted.

How to eliminate wrong answers

Option A is wrong because IKE (Internet Key Exchange) is used for IPsec VPN tunnel negotiation, not for controlling access to the web management interface; enabling IKE on the management interface does not grant HTTPS access. Option B is wrong because User-ID is a feature for mapping IP addresses to usernames for policy enforcement, typically on dataplane interfaces, and enabling it on the management interface does not affect HTTPS management access. Option C is wrong because service routes are used to redirect management traffic (e.g., syslog, SNMP, RADIUS) to a specific dataplane interface for outbound communication, but they do not control inbound HTTPS access to the management interface; the management interface itself must have the correct permitted IP list.

Practice this question →

4

Multi-Selecthard

A security engineer is designing a Palo Alto Networks firewall deployment for a multi-tenant environment. The engineer needs to ensure that each tenant's traffic is isolated and that security policies can be applied per tenant. The engineer plans to use Virtual Systems (vsys) to achieve this. Which two statements about Virtual Systems (vsys) are true? (Choose two.)

Select 2 answers

A.Virtual Systems can be assigned dedicated physical interfaces or share interfaces using VLANs.

B.Virtual Systems share the same management interface and IP address.

C.Virtual Systems require a separate license for each vsys instance.

D.Virtual Systems share the same global routing table and cannot have separate virtual routers.

E.Each vsys has its own set of security policies, zones, and interfaces.

AnswersA, E

In a vsys deployment, physical interfaces can be assigned to a specific vsys, or they can be shared across vsys using VLAN tags. This flexibility allows for efficient use of physical resources while maintaining isolation. Each vsys can have its own Layer 3 interfaces or VLAN interfaces, enabling separate routing and policy enforcement. This statement accurately describes how vsys can be deployed in a multi-tenant environment.

Why this answer

Virtual Systems (vsys) provide logical isolation on a single firewall, each with its own policies, zones, and interfaces. They can be assigned dedicated physical interfaces or share interfaces via VLANs. They can also have separate virtual routers for independent routing.

Licensing is based on the total number of vsys enabled, not per instance. These characteristics make vsys suitable for multi-tenant deployments.

Exam trap

The trap here is assuming that vsys share all resources or require individual licenses, when in fact they can be isolated with dedicated interfaces and routing, and licensing is based on total count.

Practice this question →

5

MCQhard

An organization uses User-ID with agent-based mapping on a Palo Alto Networks firewall. Users authenticate to a domain but some user-to-IP mappings are not showing up in the firewall's user cache. The firewall can reach the domain controllers. What is the most likely cause?

A.Panorama must be used to distribute User-ID configurations.

B.The firewall's DNS settings are incorrect, preventing user lookup.

C.The user-id mapping timeout is set too low.

D.The User-ID agent is not configured with the correct domain credentials or domain name.

AnswerD

Agent-based User-ID requires valid domain credentials and the correct domain name to query Active Directory and build user-to-IP mappings. Without them, the agent cannot resolve users even though network connectivity to the domain controllers exists.

Why this answer

The User-ID agent requires valid domain credentials and the correct domain name to query Active Directory for user-to-IP mappings. If these are misconfigured, the agent cannot authenticate to the domain controllers, and no mappings will be populated in the firewall's user cache, even though network connectivity exists.

Exam trap

The trap here is that candidates often assume connectivity issues (like DNS or reachability) are the cause, but the question explicitly states the firewall can reach the domain controllers, narrowing the focus to authentication and configuration of the User-ID agent itself.

How to eliminate wrong answers

Option A is wrong because Panorama is not required for User-ID configuration; User-ID can be configured directly on the firewall or via a separate User-ID agent. Option B is wrong because DNS settings affect hostname resolution, not the user-to-IP mapping process, which relies on the User-ID agent querying domain controllers via LDAP or NetAPI. Option C is wrong because a low timeout would cause mappings to expire prematurely, not prevent them from appearing initially.

Practice this question →

6

MCQhard

An organization is implementing SSL Forward Proxy decryption to inspect outbound HTTPS traffic. They want to exclude traffic to specific internal applications that cannot handle decryption due to certificate pinning. The firewall is configured with a decryption policy that decrypts all traffic from the internal network to the internet. To exclude the pinned applications, which approach is best practice?

A.Create a custom URL category for the applications and add it to a decryption policy rule with action 'no-decrypt'.

B.Configure an SSL/TLS Service Profile with an exception list for the destination IPs.

C.Use GlobalProtect client settings to bypass decryption for the pinned applications.

D.Reduce the SSL/TLS protocol version on the decryption policy to cause fail-closed for those applications.

AnswerA

A custom URL category listing the pinned applications, referenced by a no-decrypt rule placed above the decrypt-all rule, excludes them cleanly. This satisfies the certificate-pinning constraint without weakening decryption coverage for all other outbound HTTPS traffic.

Why this answer

Creating a custom URL category for the pinned applications and referencing it in a decryption policy rule with action 'no-decrypt' is the best practice for excluding specific traffic from SSL Forward Proxy decryption. This approach allows the firewall to selectively bypass decryption based on the destination URL, which is more granular and manageable than IP-based exceptions, and it aligns with the decryption policy's ability to match traffic by URL category.

Exam trap

The trap here is that candidates often confuse the SSL/TLS Service Profile's exception list (used for inbound decryption) with forward proxy decryption, leading them to select Option B, but the exception list does not apply to outbound SSL Forward Proxy policies.

How to eliminate wrong answers

Option B is wrong because an SSL/TLS Service Profile's exception list is used to exclude specific destination IPs from SSL/TLS termination for inbound decryption (e.g., for SSL Inbound Inspection), not for outbound SSL Forward Proxy decryption; it does not apply to forward proxy scenarios. Option C is wrong because GlobalProtect client settings control VPN tunnel behavior and client-level security policies, but they cannot bypass firewall-level decryption policies; decryption is enforced at the firewall, not the client. Option D is wrong because reducing the SSL/TLS protocol version on the decryption policy would cause the firewall to fail to negotiate a secure connection with the server, potentially breaking all HTTPS traffic to those applications, not just excluding them; it does not provide a selective 'no-decrypt' mechanism.

Practice this question →

7

MCQmedium

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The firewall is deployed in a forward proxy mode. The engineer wants to ensure that the firewall can decrypt traffic without generating certificate errors on client browsers. Which configuration is required to achieve this?

A.Install the forward trust certificate on the firewall and distribute the forward untrust certificate to all client devices.

B.Install the forward untrust certificate on the firewall and distribute the forward trust certificate to all client devices.

C.Install the forward trust certificate on the firewall and distribute it to all client devices as a trusted root CA certificate.

D.Install the forward trust certificate on the firewall and configure the clients to use the firewall as a proxy server for all SSL connections.

AnswerC

For SSL forward proxy decryption, the firewall uses the forward trust certificate to generate a certificate for each server and sign it. For clients to trust this dynamically generated certificate, the forward trust certificate must be installed as a trusted root CA on the client devices. This prevents certificate errors and allows decryption to occur seamlessly.

Why this answer

In SSL forward proxy decryption, the firewall acts as a man-in-the-middle, decrypting traffic, inspecting it, and re-encrypting it. To prevent certificate warnings, the firewall uses a forward trust certificate to sign the certificates it presents to clients. For clients to trust these certificates, the forward trust certificate must be installed as a trusted root CA on each client device.

This is a fundamental requirement for transparent SSL decryption without user disruption.

Exam trap

The trap here is confusing the roles of the forward trust and forward untrust certificates; the forward trust certificate must be trusted by clients, while the forward untrust certificate is used when the server certificate is untrusted.

Practice this question →

8

MCQmedium

A network security engineer is deploying a PA-5220 firewall in a data center. The firewall must inspect traffic between two internal segments (trust and dmz) and also provide security for outbound internet access. The engineer wants to ensure that when a packet arrives, the firewall properly identifies the application and enforces security policies. Which component is responsible for identifying the application regardless of port, protocol, or encryption?

A.Content-ID

B.App-ID

C.SSL Decryption

D.User-ID

AnswerB

App-ID is the Palo Alto Networks traffic classification engine that identifies applications traversing the firewall by analyzing multiple attributes such as protocol, port, and behavior, even if the application uses non-standard ports or encryption. It enables policy enforcement based on the actual application, not just port. In this scenario, App-ID ensures accurate identification for both internal and internet-bound traffic.

Why this answer

App-ID is the core technology that identifies applications by analyzing traffic characteristics, not just ports. It is essential for enforcing application-based security policies. Content-ID, User-ID, and SSL Decryption are supporting technologies that operate after or alongside App-ID but do not perform application identification themselves.

Therefore, App-ID is the correct component for application identification.

Exam trap

The trap here is confusing App-ID with Content-ID or SSL Decryption, thinking that decryption or content inspection alone can identify applications.

Practice this question →

9

Multi-Selectmedium

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Select 2 answers

A.DoS Protection

B.User-ID

C.SSL Decryption

D.URL Filtering

E.Zone Protection Profile

AnswersA, E

DoS Protection can actively terminate sessions exceeding thresholds.

Why this answer

A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Exam trap

The trap here is that candidates often assume only security policy rules control traffic flow, forgetting that additional security features like DoS Protection and Zone Protection Profiles can override an allow action by terminating sessions based on rate limits or attack signatures.

Practice this question →

10

MCQmedium

A security engineer wants to identify applications in SSL/TLS encrypted traffic without decrypting the payload. Which method can be used?

A.Deploy a network tap to capture traffic

B.Use App-ID's encrypted traffic detection capabilities

C.Configure the firewall to trust all certificates

D.Implement SSL Forward Proxy decryption

AnswerB

App-ID inspects TLS handshake metadata — server name indication, certificate fields and JA3 fingerprints — plus packet patterns, identifying the application without decrypting payload. This satisfies the requirement to classify encrypted traffic while preserving privacy and avoiding decryption overhead.

Why this answer

App-ID's encrypted traffic detection capabilities allow the firewall to identify applications within SSL/TLS encrypted flows without decrypting the payload. It uses techniques such as server name indication (SNI) inspection, certificate field analysis, and JA3/JA3S fingerprinting to match traffic to known applications, even when the content is encrypted.

Exam trap

The trap here is that candidates often assume application identification in encrypted traffic always requires decryption, overlooking that metadata from the TLS handshake can be used for identification without breaking encryption.

How to eliminate wrong answers

Option A is wrong because deploying a network tap only captures raw packets; it does not provide application identification without additional decryption or deep packet inspection. Option C is wrong because configuring the firewall to trust all certificates would bypass certificate validation, creating a security vulnerability and still not enabling application identification without decryption. Option D is wrong because SSL Forward Proxy decryption explicitly decrypts the payload to inspect it, which the question states should be avoided.

Practice this question →

11

Multi-Selecthard

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Select 3 answers

A.Configure a virtual router and assign interfaces

B.Configure the HA1 link and HA1 backup link

C.Enable aggregate Ethernet on all interfaces

D.Set up a management profile for each interface

E.Configure a floating IP for the active firewall

AnswersA, B, E

Virtual router is required for Layer 3 routing.

Why this answer

In Layer 3 mode, a virtual router must be configured to enable the firewall to participate in IP routing. The virtual router handles route learning, static routes, and route redistribution, and each Layer 3 interface must be assigned to a virtual router to forward traffic. Without this, the firewall cannot route packets between zones.

Exam trap

The trap here is that candidates often think aggregate Ethernet or management profiles are mandatory for HA or Layer 3 operation, but they are optional features that do not affect basic routing or HA failover functionality.

Practice this question →

12

MCQeasy

A security administrator is configuring a new Palo Alto Networks firewall and needs to enable App-ID to identify applications traversing the network. The administrator wants to ensure that App-ID can correctly identify applications even when they use non-standard ports or encryption. Which feature must be enabled to allow App-ID to inspect encrypted traffic?

A.SSL decryption

B.User-ID

C.Content-ID

D.Application override

AnswerA

SSL decryption allows the firewall to decrypt SSL/TLS traffic, enabling App-ID to inspect encrypted applications. Without decryption, App-ID can only identify applications based on metadata such as certificate information or IP addresses, which is less accurate. Enabling SSL decryption ensures that App-ID can see inside encrypted sessions and apply appropriate security policies based on the actual application.

Why this answer

SSL decryption is required to inspect encrypted traffic, allowing App-ID to identify applications accurately. Without decryption, App-ID relies on heuristics and metadata, which may misidentify applications. User-ID, Content-ID, and application override serve different purposes and do not decrypt traffic.

Enabling SSL decryption ensures that App-ID can see inside encrypted sessions and enforce policies based on the true application.

Exam trap

The trap here is assuming that Content-ID or other security subscriptions can inspect encrypted traffic without SSL decryption enabled.

Practice this question →

13

MCQmedium

A network security engineer is designing a multi-vsys Palo Alto Networks firewall deployment to provide both advanced security and virtual routing separation for three different departments. Each department requires its own routing table and separate security policy enforcement. The engineer must decide which component is responsible for enforcing security policies and providing threat inspection across all virtual systems. Which component of the Palo Alto Networks Next-Generation Firewall performs this function?

A.The management plane

B.The control plane

C.The dataplane

D.The user-ID agent

AnswerC

The dataplane is responsible for all traffic processing, including security policy enforcement, application identification, and threat inspection. In a multi-vsys firewall, each vsys has its own dataplane resources, allowing separate security policies and routing. The dataplane ensures that traffic between departments is inspected and controlled according to the configured rules, providing the required security and separation.

Why this answer

The dataplane is the core processing engine that enforces security policies, performs application identification, and inspects traffic for threats. In a multi-vsys configuration, each virtual system has dedicated dataplane resources, ensuring that security policies are applied independently. The management plane, control plane, and User-ID agent support administration, routing, and user mapping but do not enforce security policies or inspect traffic.

Exam trap

The trap here is confusing the control plane with the dataplane, assuming that routing or management functions also enforce security policies.

Practice this question →

14

MCQmedium

An administrator is reviewing the firewall's session table and notices many sessions in a 'discard' state. What is the most likely cause of this session state?

A.The firewall is experiencing high CPU utilization.

B.The session was denied by a security policy or a threat was detected and the session was reset.

C.The session is waiting for application identification to complete.

D.The firewall is performing SSL decryption and the session is temporarily paused.

AnswerB

Sessions in 'discard' state are typically those that have been denied by a security policy or have been reset due to a threat detection. When a security policy denies traffic, the firewall creates a session entry with the action 'deny' and the state may show as 'discard' until the session times out. Similarly, if a threat is detected and the action is 'reset-both' or 'drop', the session is marked for discard.

Why this answer

Sessions in 'discard' state indicate that the firewall has decided to drop the session, usually due to a security policy deny action or a threat detection with a reset or drop action. This state persists until the session times out. Understanding session states helps administrators quickly identify policy violations or security events.

Exam trap

The trap here is assuming 'discard' means the session is waiting for inspection, but it actually means the session is being terminated.

Practice this question →

15

MCQhard

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

A.The route lookup for the destination requires a larger MTU.

B.The firewall is not performing TCP MSS clamping on the traffic.

C.The firewall is using jumbo frames on the internal interface.

D.The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.

AnswerD

IPsec encapsulation adds outer headers after the original packet is routed, pushing a 1500-byte frame past the interface MTU and triggering the drop. This matches the logged reason exactly, since the original packet size alone equals the MTU.

Why this answer

When a packet is encapsulated (e.g., by IPsec) after the routing decision, the original packet's size remains 1500 bytes, but the encapsulation adds overhead (e.g., IPsec ESP headers/trailers, typically 50–60 bytes). This causes the resulting frame to exceed the interface MTU of 1500, triggering a 'packet too long for interface MTU' drop. The firewall logs the drop at the physical interface after encapsulation, not before.

Exam trap

The trap here is that candidates assume the firewall drops the packet before encapsulation because the original packet matches the MTU, but the drop occurs after encapsulation adds overhead, making the final frame too large.

How to eliminate wrong answers

Option A is wrong because the route lookup determines the next hop and outgoing interface, but it does not change the packet size; a larger MTU on the route would not cause a drop of a 1500-byte packet on a 1500-MTU interface. Option B is wrong because TCP MSS clamping reduces the TCP segment size to avoid fragmentation, but the drop occurs after routing/encapsulation, and MSS clamping would not prevent the encapsulation overhead from exceeding the MTU. Option C is wrong because jumbo frames (typically >9000 bytes) on an internal interface would allow larger packets, not cause drops; the issue is on the egress interface where the MTU is 1500.

Practice this question →

16

MCQeasy

A company needs to deploy a firewall in transparent inline mode to filter traffic between two switches without requiring any IP address changes on existing devices. Which interface type should be configured?

A.Virtual Wire

B.Tap

C.Layer3

D.Layer2

AnswerA

Virtual Wire binds two interfaces into a transparent pair that forwards traffic without MAC or IP addressing, so existing switches and devices keep their addresses unchanged. It filters inline between the switches while remaining invisible at layer three.

Why this answer

Virtual Wire (VWire) is the correct interface type because it allows the firewall to operate in transparent inline mode without requiring any IP address changes on existing devices. In VWire mode, the firewall acts as a Layer 2 bump in the wire, forwarding traffic between two interfaces based on MAC addresses without participating in routing or requiring IP configuration on the firewall interfaces themselves.

Exam trap

The trap here is that candidates confuse Layer2 interfaces with Virtual Wire, assuming any transparent mode works the same, but Layer2 interfaces require bridge groups or VLAN configuration and do not provide the same zero-touch inline deployment as Virtual Wire.

How to eliminate wrong answers

Option B (Tap) is wrong because a Tap interface is used for passive monitoring only; it receives a copy of traffic but cannot actively filter or block traffic inline between switches. Option C (Layer3) is wrong because Layer3 interfaces require IP addresses and routing, which would necessitate IP address changes on existing devices and break the transparent requirement. Option D (Layer2) is wrong because while Layer2 interfaces can operate transparently, they require a VLAN tag or bridge configuration and do not inherently provide the same zero-configuration, bump-in-the-wire behavior as Virtual Wire, which is specifically designed for transparent inline deployment without any IP or VLAN changes.

Practice this question →

17

MCQeasy

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

A.Configure a Zone Protection profile to block the IP.

B.Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.

C.Apply a QoS policy to limit the bandwidth from that IP to zero.

D.Add the IP to an External Dynamic List and reference it in a security rule.

AnswerB

Security rules are evaluated top-down, so a deny rule matching source 192.168.1.100 placed above the broad allow rule blocks only that host while all other outbound traffic still matches the allow rule. This is more efficient than editing the existing allow rule.

Why this answer

The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Exam trap

The trap here is that candidates may think a Zone Protection profile or QoS policy can block a specific host, but these features are designed for different purposes (threat prevention and traffic shaping, respectively) and do not provide the precise, rule-based blocking that a security rule offers.

How to eliminate wrong answers

Option A is wrong because Zone Protection profiles are used to protect against flood attacks, reconnaissance, and other network-based threats at the zone level, not to block specific IP addresses from accessing the internet; they operate on traffic patterns, not individual host policies. Option C is wrong because a QoS policy limits bandwidth but does not block traffic; setting bandwidth to zero would still allow the traffic to be processed and potentially dropped due to congestion, but it is not a reliable or efficient method to block a specific host. Option D is wrong because using an External Dynamic List (EDL) is an indirect method that requires additional configuration and external management, making it less efficient than a direct security rule for blocking a single static IP address.

Practice this question →

18

MCQeasy

A network administrator is setting up a new Palo Alto Networks firewall. The administrator needs to configure the firewall so that it can resolve domain names for its own management traffic, such as for updates and logging. Which type of interface should be configured with a default gateway to allow the firewall to reach external services?

A.Management interface

B.Layer 2 dataplane interface

C.Layer 3 dataplane interface

D.Virtual wire interface

AnswerA

The management interface is used for out-of-band management and for the firewall to communicate with external services such as DNS, NTP, and Palo Alto Networks update servers. To allow the firewall to resolve domain names and reach the internet for updates, the management interface must be configured with a default gateway. This is separate from dataplane interfaces and is essential for management connectivity.

Why this answer

The management interface is dedicated for out-of-band management and for the firewall to communicate with external services like DNS, NTP, and update servers. To allow the firewall to resolve domain names for its own management traffic, the management interface must have a default gateway configured. Dataplane interfaces, whether Layer 3, Layer 2, or virtual wire, are for user traffic and do not handle management traffic by default.

Exam trap

The trap here is assuming that any interface with a default gateway can provide management connectivity, when only the management interface is used for the firewall's own services.

Practice this question →

19

Multi-Selecteasy

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Select 2 answers

A.Export to Microsoft Azure Sentinel directly without any intermediate.

B.Local storage on the firewall's management disk (MP) and export via the web interface.

C.SNMPv3 traps for all log types.

D.Email alerts for all threat logs.

E.Syslog to an external log collector.

AnswersB, E

The management plane disk stores logs locally, and the web interface exports them for reporting and forensics. This satisfies the log collection requirement without external infrastructure, though retention is bounded by the firewall's on-box storage capacity.

Why this answer

Option B is correct because the firewall's management plane (MP) can retain logs locally on its management disk, and administrators can retrieve them through the web interface (or CLI) for reporting and forensic review. Option E is correct because the firewall natively supports forwarding logs via syslog to external log collectors (e.g., a syslog server or Panorama in log-collector mode), which is a standard method for centralized reporting and forensics. Option A is not valid because Azure Sentinel does not ingest Palo Alto logs directly without an intermediate, such as a syslog forwarder, Log Analytics agent, or CEF connector.

Option C is incorrect because SNMPv3 traps are used for monitoring/alerting on MIB objects, not for transporting full log records of all log types. Option D is incorrect because email alerts are notification-only and do not provide a complete, structured log collection mechanism for reporting and forensics.

Exam trap

The trap here is that candidates confuse 'log collection' with 'alerting mechanisms' (SNMP traps and email alerts), assuming they can replace full log export, but Palo Alto firewalls require dedicated log forwarding methods (syslog, Panorama, or local export) for complete reporting and forensics.

Practice this question →

20

MCQmedium

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. Traffic fails over correctly, but after a failover, existing sessions from external users to internal servers are broken. The security team wants to prevent this disruption. Which feature must be enabled?

A.Link Monitoring

B.Virtual Router Redundancy

C.Session State Synchronization

D.Path Monitoring

AnswerC

Session State Synchronization replicates session tables between HA peers, so the passive firewall already holds established flows when failover occurs. This satisfies the scenario's requirement to prevent broken external-to-internal sessions, since traffic resumes without re-establishing TCP handshakes.

Why this answer

Session State Synchronization (option C) is required because it ensures that session table entries—including TCP state, sequence numbers, and application-layer metadata—are replicated from the active firewall to the passive firewall in real time. Without this, after a failover, the newly active firewall has no knowledge of existing sessions, causing it to drop packets and forcing clients to re-establish connections. This feature is specifically designed to maintain stateful session continuity during HA failovers.

Exam trap

The trap here is that candidates confuse high-availability failover mechanisms (like link monitoring or path monitoring) with stateful session replication, assuming that any HA feature will preserve sessions, but only Session State Synchronization specifically copies the session table to the standby device.

How to eliminate wrong answers

Option A is wrong because Link Monitoring only checks the physical link status of interfaces and triggers a failover if a link goes down; it does not replicate session state. Option B is wrong because Virtual Router Redundancy (e.g., VRRP) provides gateway redundancy at Layer 3 but does not synchronize firewall session state; it is unrelated to stateful session preservation. Option D is wrong because Path Monitoring monitors the reachability of specific destination IP addresses (e.g., next-hop gateways) to trigger failover, but it does not synchronize session tables between HA peers.

Practice this question →

21

MCQhard

A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?

A.Packet filtering rules

B.Session limit rules

C.QoS profiles

D.Resource profiles

AnswerD

Resource profiles assign each virtual system guaranteed minimum CPU and session capacity, preventing one vsys from monopolising dataplane resources. This directly satisfies the requirement to guarantee every vsys its minimum share when a single vsys consumes excessive resources.

Why this answer

Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.

Exam trap

The trap here is confusing session limits (which cap usage) with resource profiles (which guarantee minimums), leading candidates to choose session limit rules as a way to protect other vsys, when in fact they only prevent a single vsys from exceeding a threshold, not ensuring fair share under contention.

How to eliminate wrong answers

Option A is wrong because packet filtering rules control which traffic is allowed or denied based on headers and state, not CPU or session resource allocation. Option B is wrong because session limit rules cap the maximum number of concurrent sessions for a vsys but do not guarantee a minimum share of CPU or session capacity. Option C is wrong because QoS profiles manage bandwidth and priority for network traffic, not dataplane CPU cycles or session table resources.

Practice this question →

22

MCQhard

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

A.Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.

B.The HA configuration is set to active/active mode instead of active/passive.

C.The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.

D.The heartbeat interfaces are not configured on each firewall.

AnswerC

A missing heartbeat link prevents each firewall from receiving HA hello messages, so both transition to active after reboot. Restoring the heartbeat connection re-establishes state synchronisation and election, after which the secondary can be forced passive to clear the split-brain condition.

Why this answer

In an active/passive HA pair, each firewall monitors the peer's health via the heartbeat link. If the heartbeat link fails, each firewall assumes the peer is down and transitions to active state to ensure traffic continuity. Simultaneous reboot does not cause both to become active unless the heartbeat link is absent or broken; restoring the heartbeat link and forcing one firewall to passive resolves the split-brain scenario.

Exam trap

The trap here is that candidates assume simultaneous reboot causes a priority tie, but the real issue is the missing heartbeat link, which prevents the firewalls from detecting each other's state after reboot.

How to eliminate wrong answers

Option A is wrong because priority and serial number tie-breaking only apply when both firewalls attempt to become active at the same time with a functional heartbeat; simultaneous reboot does not override the need for heartbeat communication. Option B is wrong because active/active mode would require explicit configuration and would not cause both to appear active after reboot if the heartbeat link were functional; the symptom described matches a heartbeat failure, not a mode misconfiguration. Option D is wrong because the heartbeat interfaces must be configured for HA to function; if they were not configured, the firewalls would not form an HA pair at all, but the question states they are in an HA pair, implying heartbeat interfaces are configured.

Practice this question →

23

MCQeasy

A network security administrator is deploying a new PA-3220 firewall in a data center. The security team requires that all traffic traversing the firewall be inspected for threats, but they want to minimize latency for trusted internal traffic that is already known to be benign. The administrator decides to create a security policy rule that allows traffic from the 'Trust' zone to the 'DMZ' zone without any security profiles attached. Which statement accurately describes the behavior of this rule?

A.The traffic will be allowed, but the firewall will still perform application identification and threat inspection if a profile is later added to the rule.

B.The traffic will be allowed, and because no security profiles are attached, the firewall will not perform any threat inspection on this traffic.

C.The traffic will be blocked by default because security profiles are mandatory for all allow rules.

D.The traffic will be allowed, but the firewall will automatically apply the default security profiles from the 'default' security profile group.

AnswerB

Security profiles are the mechanism that enables threat inspection. When a security policy rule allows traffic and no security profiles are attached, the firewall does not apply antivirus, anti-spyware, vulnerability protection, or other threat scanning for that session. This matches the administrator's intent to minimize latency for trusted internal traffic.

Why this answer

Security profiles are the components that enable threat inspection on allowed traffic. When a security policy rule permits traffic but has no security profiles attached, the firewall performs application identification and other basic functions but does not scan for threats such as viruses, spyware, or vulnerabilities. This behavior allows administrators to tailor inspection based on trust levels and performance requirements.

In this scenario, the administrator intentionally omits profiles to reduce latency for trusted internal traffic, and the firewall will honor that configuration.

Exam trap

The trap here is assuming that the firewall always performs threat inspection on allowed traffic, but threat inspection requires explicit attachment of security profiles to the security policy rule.

Practice this question →

24

MCQmedium

A company implements SSL Forward Proxy decryption. Users complain that accessing certain websites, such as video streaming and software updates, is slow. Which action should the administrator take to improve performance?

A.Increase the SSL session cache to 1024.

B.Upgrade the firewall to a higher model.

C.Exclude known high-traffic sites from decryption.

D.Enable SSL session re-use.

AnswerC

SSL Forward Proxy decryption adds significant CPU load, and streaming or update traffic consumes disproportionate bandwidth for little inspection value. Excluding those destinations from decryption bypasses the proxy processing entirely, restoring throughput and reducing firewall resource consumption.

Why this answer

Excluding known high-traffic sites (e.g., video streaming and software update servers) from SSL Forward Proxy decryption reduces the processing overhead on the firewall. Decrypting and re-encrypting high-volume traffic consumes significant CPU and memory resources, causing latency. By bypassing decryption for these sites, the firewall can forward traffic directly, improving performance without sacrificing security for other traffic.

Exam trap

The trap here is that candidates often focus on optimizing TLS handshake performance (session cache or reuse) rather than recognizing that the primary bottleneck is the decryption of large data payloads, which is unaffected by handshake optimizations.

How to eliminate wrong answers

Option A is wrong because increasing the SSL session cache to 1024 (the maximum supported value) only helps with session reuse for previously decrypted connections, but it does not address the fundamental bottleneck of decrypting high-traffic streams; the cache reduces handshake overhead, not bulk data processing. Option B is wrong because upgrading to a higher model firewall is a costly, long-term solution that does not solve the immediate performance issue; the problem is likely due to decryption of high-volume traffic, not insufficient hardware capacity for normal operations. Option D is wrong because enabling SSL session reuse (via session IDs or session tickets) reduces the number of full TLS handshakes but does not reduce the decryption workload for the actual data transfer; the slowdown is from decrypting large payloads, not from repeated handshakes.

Practice this question →

25

MCQeasy

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

A.The web server is not running.

B.The host is not in the allowed IP list.

C.The firewall is in FIPS mode.

D.HTTP/HTTPS is not enabled in the interface management profile.

AnswerD

Ping succeeds because ICMP is permitted by default on the management interface, but the web interface requires HTTP or HTTPS explicitly enabled within the interface management profile; without that service permitted, management access is refused.

Why this answer

The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Exam trap

The trap here is that candidates assume a reachable IP (via ping) implies all management services are accessible, but Palo Alto separates ICMP from HTTP/HTTPS in the management profile, so ping success does not guarantee web access.

How to eliminate wrong answers

Option A is wrong because the web server (management web interface) is a built-in service that is always running on the firewall; the issue is not that the server is down, but that access is blocked by the management profile. Option B is wrong because the allowed IP list is a separate access control mechanism that restricts which source IPs can reach the management interface, but the question states the host can ping the interface, so the host is reachable; the problem is that HTTP/HTTPS services are not permitted in the profile, not that the host is excluded from an allow list. Option C is wrong because FIPS mode affects cryptographic algorithms and disables weaker protocols, but it does not prevent HTTP/HTTPS access entirely; if FIPS mode were enabled, HTTPS would still work with FIPS-compliant ciphers, so this would not cause a complete inability to access the web interface.

Practice this question →

26

Multi-Selectmedium

A security administrator is designing a zero trust architecture using Palo Alto Networks Next-Generation Firewalls. They need to ensure that all traffic between the internal network and the internet is inspected, and that users are identified regardless of location. Which two components are required to achieve user identification for both on-premises and remote users? (Choose two.)

Select 2 answers

A.Captive Portal to authenticate users who are not covered by other User-ID methods.

B.User-ID Agent to monitor directory servers and map IP addresses to usernames for on-premises users.

C.Syslog forwarding to send user mapping logs to an external server.

D.XML API to query the firewall for user mapping information.

E.GlobalProtect to authenticate remote users and map their IP addresses to usernames.

AnswersB, E

The User-ID Agent connects to directory servers such as Active Directory to retrieve user-to-IP mappings for on-premises users. This is essential for identifying users on the internal network, as it provides the mapping that the firewall uses in security policies to enforce user-based rules.

Why this answer

To identify users both on-premises and remotely, the administrator needs GlobalProtect for remote users and a User-ID Agent for on-premises users. GlobalProtect authenticates remote users and provides IP-to-username mapping, while the User-ID Agent monitors directory servers to map IP addresses to usernames for internal users. Together, they enable consistent user-based policy enforcement across locations.

Exam trap

The trap here is thinking that a single component can handle all user identification, when in fact different methods are needed for on-premises and remote users.

Practice this question →

27

MCQeasy

A network security administrator is configuring a new Palo Alto Networks firewall and wants to ensure that traffic between two internal subnets is inspected by the firewall. The subnets are on different interfaces. What must be configured to allow the firewall to inspect this traffic?

A.A Policy-Based Forwarding (PBF) rule to redirect the traffic to the firewall.

B.A NAT policy rule translating the source IP addresses.

C.A Security policy rule allowing traffic from the source zone to the destination zone.

D.A decryption policy rule to decrypt the traffic.

AnswerC

For the firewall to inspect and allow traffic between two interfaces, a Security policy rule must permit the traffic from the source zone to the destination zone. Without such a rule, the default interzone deny rule will block the traffic. The rule should also specify the correct applications and services to match the traffic, ensuring that the firewall performs the necessary inspection.

Why this answer

To allow and inspect traffic between two internal subnets on different interfaces, the administrator must create a Security policy rule that permits traffic from the source zone to the destination zone. This rule enables the firewall to perform security inspections such as application identification, threat prevention, and content filtering. Other policies like NAT, PBF, or decryption are not required for basic traffic flow and do not replace the need for a Security policy rule.

Exam trap

The trap here is confusing NAT or PBF with security policy; NAT translates addresses and PBF changes forwarding, but neither permits traffic.

Practice this question →

28

MCQeasy

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

A.Panorama with Dedicated Log Collectors

B.Panorama with Log Collectors

C.Panorama without Log Collectors

D.Panorama in High Availability mode

AnswerC

Panorama deployed without Log Collectors manages policies and device configuration centrally while each managed firewall retains its own logs in local storage. This satisfies the stem's requirement that logs stay on the firewall rather than being forwarded to Panorama.

Why this answer

Panorama without Log Collectors is the correct deployment mode because it allows centralized management of firewalls while keeping logs stored locally on each firewall. In this mode, Panorama handles only configuration and policy management, and log collection is disabled, so no logs are forwarded to Panorama. This is ideal for environments where log retention must remain on the firewall due to compliance or bandwidth constraints.

Exam trap

The trap here is that candidates often assume Panorama always requires log forwarding for centralized management, confusing the management plane (configuration/policy) with the data plane (logging), and thus overlook the 'without Log Collectors' mode as a valid deployment option.

How to eliminate wrong answers

Option A is wrong because Panorama with Dedicated Log Collectors requires logs to be sent from firewalls to dedicated collector hardware, not stored locally. Option B is wrong because Panorama with Log Collectors (using the built-in collector on the Panorama appliance) also forwards logs from firewalls to Panorama, not local storage. Option D is wrong because Panorama in High Availability mode is a redundancy configuration that can be used with or without log collectors, and does not inherently change where logs are stored; logs are still sent to Panorama if collectors are configured.

Practice this question →

29

MCQmedium

A security administrator configures a new network template in Panorama and assigns it to a template stack. The template stack is associated with a device group containing several firewalls. After committing the Panorama configuration and pushing to devices, some firewalls in the device group do not have the new template settings. What is the most likely cause?

A.The firewalls that are not receiving the template are not included in the same template stack.

B.The device group has not been committed.

C.The firewalls are not licensed for Panorama management.

D.The template is in 'preview' mode.

AnswerA

Template settings only reach firewalls that are members of the template stack. Firewalls in the device group but absent from that stack receive no template configuration, explaining why only some devices show the new settings.

Why this answer

In Panorama, templates are assigned to template stacks, and template stacks are then assigned to specific firewalls. If a firewall does not belong to the template stack that contains the new template, it will not receive those settings, regardless of its membership in the device group. Device groups manage policy objects and rules, not network configuration templates.

Exam trap

The trap here is that candidates often confuse device groups (which manage policy) with template stacks (which manage network configuration), assuming that membership in a device group automatically applies all associated templates.

How to eliminate wrong answers

Option B is wrong because the device group commit is separate from template commit; templates are committed as part of the Panorama configuration push, and a missing device group commit would affect policy, not template settings. Option C is wrong because Panorama management does not require a separate license for firewalls; it is a built-in capability of the firewall platform. Option D is wrong because Panorama does not have a 'preview' mode for templates; templates are either committed or not, and preview is a concept for policy rules, not network templates.

Practice this question →

30

MCQhard

A network security engineer is troubleshooting why a Palo Alto Networks firewall is not enforcing a security policy that should block traffic from the untrust zone to the trust zone. The policy is configured correctly, and the firewall is receiving traffic. The engineer suspects that the traffic is being allowed by a different policy due to policy evaluation order. Which factor determines the order in which security policies are evaluated?

A.The rule with the most specific match is evaluated first, regardless of position.

B.Rules are evaluated based on the zone pair, with intra-zone rules first.

C.The order of rules in the security policy rulebase, from top to bottom.

D.Rules with a deny action are always evaluated before allow rules.

AnswerC

Security policies are evaluated from top to bottom in the rulebase. The first rule that matches the traffic is applied. If a rule above the intended block rule allows the traffic, the block rule will not be evaluated. Therefore, the engineer must ensure that more specific rules are placed above general allow rules to enforce the desired blocking.

Why this answer

Security policies are evaluated sequentially from the top of the rulebase to the bottom. The first matching rule is enforced, so rule order is critical. Placing a block rule below an allow rule that matches the same traffic will result in the traffic being allowed.

Therefore, the engineer must reorder rules to ensure the block rule is evaluated first.

Exam trap

The trap here is assuming that PAN-OS prioritizes rules by specificity or action, when it strictly follows rule order.

Practice this question →

31

MCQmedium

An administrator is troubleshooting why a Security policy rule that allows traffic from the 'trust' zone to the 'untrust' zone is not matching for certain sessions. The administrator notices that the sessions are being denied by an interzone rule. What is the most likely cause?

A.The allow rule is configured with the application 'any' instead of a specific application.

B.The allow rule is configured with a source user instead of a source IP address.

C.The allow rule is configured with a destination zone of 'untrust' but the traffic is destined to the firewall itself.

D.The interzone rule is placed above the allow rule in the rulebase.

AnswerD

Security policy rules are evaluated top-down, and the first rule that matches the traffic is applied. If an interzone deny rule is positioned above the allow rule, it will match and block the traffic before the allow rule is evaluated. This is a common cause of unexpected denials when rule order is not carefully managed, especially when interzone rules are added for default protection.

Why this answer

The most likely cause is that the interzone deny rule is positioned above the allow rule in the Security policy rulebase. Because PAN-OS evaluates rules from top to bottom and stops at the first match, a deny rule higher in the list will take precedence over a later allow rule. To resolve the issue, the administrator should move the allow rule above the interzone deny rule or adjust the interzone rule to be more specific so it does not match the intended traffic.

Exam trap

The trap here is focusing on application or user settings when the symptom clearly indicates a rule order problem, as interzone rules are often placed at the top for default protection.

Practice this question →

32

MCQeasy

Which component of the PAN-OS architecture is responsible for processing security policies and performing packet inspection?

A.Panorama plane

B.Management plane

C.Data plane

D.Control plane

AnswerC

The data plane handles all packet-level processing, including security policy enforcement, application identification, and threat inspection, after the management plane pushes committed configuration and the control plane builds routing and session tables. This satisfies the stem's requirement for the component performing packet inspection and policy enforcement.

Why this answer

The data plane is the correct answer because it is the hardware-accelerated component in PAN-OS that handles all packet forwarding, security policy enforcement, and deep packet inspection (including App-ID, Content-ID, and SSL decryption). It operates on a separate processor from the management and control planes to ensure that security processing does not impact management access or routing stability.

Exam trap

The trap here is that candidates confuse the control plane's role in session setup with packet inspection, but the control plane only handles control traffic (e.g., ARP, routing updates) and session table management, not the actual security policy enforcement or deep packet inspection that occurs in the data plane.

How to eliminate wrong answers

Option A is wrong because Panorama is a centralized management platform for multiple firewalls, not a plane within a single PAN-OS firewall; it does not perform packet inspection or enforce security policies directly. Option B is wrong because the management plane handles administrative tasks (CLI, GUI, logging, configuration commits) and does not process live traffic or perform packet inspection. Option D is wrong because the control plane manages routing protocols (e.g., OSPF, BGP), session setup, and high-availability state synchronization, but it does not inspect packet payloads or enforce security rules.

Practice this question →

33

Multi-Selecteasy

Which THREE of the following are core components of the GlobalProtect solution? (Choose exactly three.)

Select 3 answers

A.GlobalProtect License Server

B.GlobalProtect Gateway

C.GlobalProtect Client

D.GlobalProtect Mobile App

E.GlobalProtect Portal

AnswersB, C, E

The GlobalProtect Gateway is a core component, terminating client tunnels and enforcing security policy for remote users. It works alongside the portal and the agent to deliver the solution, making it one of the three required components.

Why this answer

The three core components of the GlobalProtect solution are the GlobalProtect Portal (E), the GlobalProtect Gateway (B), and the GlobalProtect Client (C). The GlobalProtect Portal (E) is the web-based interface that authenticates end users, distributes the GlobalProtect agent/app and its configuration, and provides the list of available gateways. The GlobalProtect Gateway (B) is the security appliance (firewall or Prisma Access) that terminates the tunnels and enforces security policy, providing access to internal resources.

The GlobalProtect Client (C) is the agent software installed on endpoints (Windows, macOS, Linux, iOS, Android) that connects to the portal and gateway to establish the VPN connection. The GlobalProtect License Server (A) is not a core component; licensing is managed through the firewall or Panorama, not a separate license server. The GlobalProtect Mobile App (D) is not a distinct core component — mobile support is delivered via the GlobalProtect Client (the app is simply the client for mobile platforms), so it is not counted separately.

Exam trap

The trap here is that candidates often mistake the GlobalProtect Mobile App as a core component, but it is simply a variant of the GlobalProtect Client and not one of the three fundamental architectural elements.

Practice this question →

34

MCQeasy

A security administrator is configuring a Palo Alto Networks firewall and needs to ensure that traffic from the trust zone to the untrust zone is inspected for threats. The administrator wants to enable threat prevention profiles on the security policy. Which Palo Alto Networks feature is responsible for detecting and preventing threats such as viruses, spyware, and command-and-control traffic?

A.SSL Decryption

B.App-ID

C.User-ID

D.Content-ID

AnswerD

Content-ID is the Palo Alto Networks integrated threat prevention engine that includes antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking. It inspects allowed traffic for threats and can block or alert based on security profiles. In this scenario, enabling threat prevention profiles on the security policy activates Content-ID to detect and prevent viruses, spyware, and command-and-control traffic. Content-ID works in conjunction with App-ID to provide comprehensive security.

Why this answer

Content-ID is the Palo Alto Networks integrated threat prevention engine that provides antivirus, anti-spyware, vulnerability protection, and other threat detection capabilities. It inspects allowed traffic based on security profiles attached to security policies. In this scenario, enabling threat prevention profiles activates Content-ID to detect and prevent threats such as viruses, spyware, and command-and-control traffic.

App-ID identifies applications, User-ID maps users, and SSL Decryption enables inspection of encrypted traffic, but none of these detect threats directly.

Exam trap

The trap here is assuming that App-ID or SSL Decryption provides threat detection, but only Content-ID does.

Practice this question →

35

MCQeasy

An administrator needs to allow FTP traffic from the internal network to an external server. The firewall is configured with a security policy that has the application 'ftp' and service 'service-http'. What is the most likely cause of the traffic being denied?

A.The source address is wrong.

B.The application is incorrectly set to ftp.

C.The rule is not enabled.

D.The service object in the rule is set to service-http, which does not match FTP traffic.

AnswerD

FTP uses TCP ports 20 and 21, whereas service-http matches TCP 80. Because the security policy's service object is service-http, the firewall drops the FTP session on port 21 before the ftp application can be identified, so the traffic is denied.

Why this answer

The security policy's service object is set to 'service-http' (TCP port 80), but FTP traffic uses TCP port 21 for control and TCP port 20 for data. In Palo Alto Networks firewalls, the service object defines the destination port for the traffic; if it does not match the actual port used by the application, the firewall will deny the session even if the application is correctly identified. The mismatch between the service and the application's expected port causes the traffic to be blocked.

Exam trap

The trap here is that candidates may think the application field alone is sufficient to allow traffic, but the service object must also match the destination port; Palo Alto Networks often tests this by pairing a correct application with an incorrect service to see if you understand the dual-layer check.

How to eliminate wrong answers

Option A is wrong because the source address being incorrect would cause traffic to not match the policy at all, but the question states the policy is configured with the application 'ftp' and service 'service-http', implying the source address is not the primary issue. Option B is wrong because the application 'ftp' is correctly set to allow FTP traffic; the problem is not the application but the service mismatch. Option C is wrong because the rule not being enabled would prevent any traffic matching, but the question asks for the most likely cause given the specific configuration details; the service mismatch is a more precise and common issue than a disabled rule.

Practice this question →

36

MCQeasy

A network administrator is configuring a new Palo Alto Networks firewall and needs to ensure that management traffic is separated from data traffic. Which interface type should be used for out-of-band management?

A.A dedicated management interface (MGT) with its own IP address and default gateway.

B.A VLAN interface on a data port configured with a management profile.

C.A tunnel interface configured for management access.

D.A loopback interface configured in the management zone.

AnswerA

The dedicated management interface (MGT) is designed for out-of-band management. It has its own IP address, default gateway, and separate routing table, ensuring that management traffic is isolated from data plane traffic. This separation enhances security and prevents data traffic from interfering with management access, which is critical for firewall administration.

Why this answer

The dedicated management interface (MGT) is specifically designed for out-of-band management, providing a separate routing table and isolation from data traffic. This ensures that management access is not affected by data plane issues and enhances security by keeping management traffic separate. Other interface types are part of the data plane and do not offer the same level of separation.

Exam trap

The trap here is assuming any interface with a management profile provides out-of-band management, but only the dedicated MGT interface ensures true separation.

Practice this question →

37

MCQmedium

A company has a Palo Alto Networks firewall with two virtual systems (vsys) configured. The administrator wants to ensure that traffic between vsys1 and vsys2 is inspected by the firewall. What must be configured to allow this inter-vsys traffic?

A.A NAT policy rule translating the source IP addresses between vsys.

B.A Security policy rule in each vsys allowing traffic to the other vsys.

C.A shared Security policy rule in the shared policy or a rule in each vsys, plus routing between the vsys.

D.A Policy-Based Forwarding (PBF) rule to redirect traffic between vsys.

AnswerC

Inter-vsys traffic requires that each vsys have a Security policy rule permitting the traffic, and that routing is configured to send traffic from one vsys to the other. This can be achieved with a shared policy rule that applies to both vsys or with individual rules in each vsys. Additionally, the virtual routers in each vsys must have routes to the other vsys, often via a shared interface or inter-vsys link.

Why this answer

To allow inter-vsys traffic, the administrator must configure Security policy rules that permit the traffic, either as a shared rule or individual rules in each vsys, and ensure that routing is in place to direct traffic between the vsys. Each vsys has its own virtual router, so routes must exist to forward traffic from one vsys to the other, often through a shared interface or an inter-vsys link. Without both policy and routing, the traffic will be blocked or dropped.

Exam trap

The trap here is assuming that a Security policy rule alone is enough for inter-vsys traffic, but routing between the isolated vsys instances is also required.

Practice this question →

38

Multi-Selectmedium

Which TWO of the following are true regarding Panorama's templates and device groups?

Select 2 answers

A.Device groups can only contain firewalls of the same model.

B.Templates are used to push network configurations such as interfaces, virtual routers, and zones.

C.Templates override device group settings when both are applied.

D.Panorama cannot manage firewalls in different geographic locations.

E.Shared policies are defined in the 'Shared' device group and are inherited by all other device groups.

AnswersB, E

Templates push network-level configuration — interfaces, virtual routers, zones — to managed firewalls, satisfying the stem's requirement for network settings rather than policy. Device groups handle policy objects and rules instead, so this option correctly identifies the configuration layer templates manage within Panorama's hierarchy.

Why this answer

Option B is correct because Panorama templates are specifically designed to push network-level configuration to managed firewalls, including interfaces, virtual routers, zones, and other network settings, which is their primary purpose. Option E is correct because Panorama includes a predefined 'Shared' device group at the top of the device group hierarchy, and policies defined there are inherited by all other device groups below it. Option A is incorrect because device groups can contain firewalls of different models, as long as they run compatible PAN-OS versions; model homogeneity is not required.

Option C is incorrect because templates and device groups operate on different configuration scopes (network vs. policy/objects) and do not override each other in that manner. Option D is incorrect because Panorama can manage firewalls across different geographic locations, which is one of its key centralized-management benefits.

Exam trap

The trap here is confusing the roles of templates and device groups, leading candidates to think templates override device group settings or that device groups are model-specific, when in fact they are independent configuration layers with different purposes.

Practice this question →

39

MCQeasy

A firewall administrator is configuring a new security zone for a DMZ. The requirement is that the DMZ zone should not be able to initiate connections to the internal trusted zone, but the trusted zone should be able to initiate connections to the DMZ. Which configuration achieves this with the least administrative effort?

A.Assign the DMZ interface to the same zone as the trust interface, and use security policies to control traffic between them.

B.Create a security policy from trust to DMZ allowing the required applications, and rely on the implicit deny for DMZ to trust.

C.Create two security policies: one from trust to DMZ allowing all applications, and one from DMZ to trust denying all applications.

D.Configure the DMZ zone with a zone protection profile that blocks all traffic from the DMZ to the trust zone.

AnswerB

The firewall's default behavior is to deny interzone traffic unless explicitly allowed. By creating only the trust-to-DMZ allow policy, the administrator leverages the implicit deny rule to block DMZ-to-trust traffic. This is the simplest and most efficient configuration, requiring only one policy.

Why this answer

The default security posture of a Palo Alto Networks firewall is to deny all interzone traffic except intrazone traffic. By creating only the necessary allow rule from trust to DMZ, the administrator ensures that the trusted zone can initiate connections to the DMZ, while the DMZ cannot initiate connections to the trust zone because of the implicit deny. This minimizes configuration and reduces the risk of misconfiguration.

Exam trap

The trap here is believing that an explicit deny rule is required to block traffic between zones, when the implicit deny already handles it.

Practice this question →

40

MCQeasy

Refer to the exhibit. What does the serial number '0123456789' indicate?

A.The MAC address of the management interface

B.The model number of the firewall

C.The firmware version installed

D.The unique hardware identifier for licensing and support

AnswerD

The serial number uniquely identifies the physical chassis, tying it to its licences, support entitlement and warranty record. It is not an IP address, HA group identifier or software version, so it satisfies the licensing and support-tracking requirement in the exhibit.

Why this answer

The serial number '0123456789' is a unique hardware identifier assigned to each Palo Alto Networks firewall during manufacturing. It is used for licensing, support entitlement, and device identification in the Palo Alto Networks support portal, not for network-level addressing or software versioning.

Exam trap

The trap here is that candidates often confuse the serial number with the model number or MAC address, especially when the exhibit shows a generic string like '0123456789' that lacks the typical format of a Palo Alto Networks serial number (e.g., starting with 'PA' or a specific prefix).

How to eliminate wrong answers

Option A is wrong because the MAC address of the management interface is a separate, network-layer identifier used for Layer 2 communication, not the serial number. Option B is wrong because the model number (e.g., PA-5250) is a different alphanumeric string that identifies the hardware platform, not the unique serial number. Option C is wrong because the firmware version (e.g., PAN-OS 10.2.3) is a software release identifier displayed in the dashboard or CLI, not the hardware serial number.

Practice this question →

41

Multi-Selecteasy

Which TWO components are part of the PAN-OS management plane?

Select 2 answers

A.SSL decryption engine

B.Packet buffer

C.Log collection and reporting

D.Management interface

E.App-ID engine

AnswersC, D

Log collection and reporting is a management plane function in PAN-OS, handling log ingestion, storage, and report generation. It is distinct from the data plane, which processes traffic, and the control plane, which handles routing and protocol operations.

Why this answer

The PAN-OS management plane handles administrative and control functions rather than the actual data forwarding path. Option C, log collection and reporting, is correct because the management plane is responsible for gathering logs from the dataplane and generating reports, which administrators access via the management interface or external log collectors. Option D, the management interface, is correct because it is the dedicated out-of-band interface (typically MGT) used for administrative access such as SSH, HTTPS/WebUI, and API, and it belongs to the management plane.

The other options do not belong: the SSL decryption engine (A) and App-ID engine (E) are dataplane security processing functions that inspect and classify traffic, and the packet buffer (B) is a dataplane memory resource used for queuing and forwarding packets, not a management-plane component.

Exam trap

The trap here is that candidates often confuse data plane functions (like SSL decryption, App-ID, and packet buffering) with management plane responsibilities, leading them to select options A, B, or E instead of recognizing that log collection and the management interface are purely management plane components.

Practice this question →

42

Multi-Selecthard

A security administrator is designing a zero-trust architecture using Palo Alto Networks firewalls. They want to ensure that traffic between two internal zones is inspected and that access is granted based on user identity and device posture rather than IP address alone. Which two PAN-OS features must be implemented to meet these requirements? (Choose two.)

Select 2 answers

A.Enable App-ID to identify applications regardless of port or protocol.

B.Configure User-ID to map users to IP addresses via GlobalProtect or AD agent.

C.Deploy GlobalProtect with HIP profiles to assess device posture.

D.Configure a DNS sinkhole to block malicious domains.

E.Enable SSL decryption to inspect encrypted traffic.

AnswersB, C

User-ID is essential for enforcing policy based on user identity rather than IP. By integrating with Active Directory or GlobalProtect, the firewall learns which user is associated with each IP address. Security policies can then reference users or groups directly. This is a core requirement for zero-trust because it ensures that access decisions are tied to authenticated identity, not just network location, and it enables dynamic policy that follows the user.

Why this answer

Zero-trust access based on user identity and device posture requires User-ID to map users to IP addresses and GlobalProtect with HIP profiles to assess endpoint compliance. User-ID provides the identity context, while HIP provides posture context. Together, they allow security policies to grant or deny access based on both who the user is and the security state of their device, which is the essence of zero-trust.

Exam trap

The trap here is confusing inspection features like App-ID or SSL decryption with identity and posture features, when only User-ID and HIP provide the required context for zero-trust access decisions.

Practice this question →

43

MCQmedium

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

A.Create separate virtual systems (VSYS) for each tenant on the same firewall.

B.Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.

C.Use active/active HA mode to assign each tenant to a different firewall.

D.Configure multiple virtual routers (VRFs) within the same virtual system.

AnswerA

Separate VSYS instances partition a single firewall into independent logical firewalls, each with its own routing table, zones, policies and administrator roles. This satisfies the multi-tenant isolation requirement while retaining one active/passive HA pair, since VSYS share the underlying hardware and failover state.

Why this answer

Virtual systems (VSYS) allow a single Palo Alto Networks firewall to be partitioned into multiple independent logical firewalls, each with its own routing table, security policies, and administrative domains. This enables tenant isolation on a single HA pair without requiring separate hardware or instances, making option A correct for the described requirement.

Exam trap

The trap here is that candidates often confuse virtual routers (VRFs) with full tenant isolation, not realizing that VRFs only separate routing tables, while VSYS provides complete separation of policies, objects, and administration required for multi-tenant environments.

How to eliminate wrong answers

Option B is wrong because deploying multiple VM-Series firewalls as separate instances on the same hypervisor would require separate management and licensing for each instance, defeating the purpose of using a single HA pair and increasing complexity. Option C is wrong because active/active HA mode does not assign tenants to different firewalls; both firewalls in an active/active pair share the same configuration and forward traffic together, so tenant isolation would still require VSYS or other segmentation. Option D is wrong because multiple virtual routers (VRFs) within the same virtual system can separate routing tables but do not isolate security policies, administrative access, or other tenant-specific configurations; VSYS is required for full tenant isolation.

Practice this question →

44

MCQmedium

A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?

A.Redistribution of routes between the virtual routers

B.Enabling packet forwarding on the virtual router interfaces

C.A security policy allowing traffic between the zones associated with the virtual routers

D.A static route on both virtual routers pointing to each other's subnets

AnswerC

Inter-VR routing alone does not permit transit; the firewall still evaluates zone-to-zone traffic against security policy. Because VR1 and VR2 interfaces sit in separate zones, the missing rule is a security policy permitting the internal zone to the DMZ zone, satisfying the stem's requirement that packets traverse virtual routers.

Why this answer

In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.

Exam trap

The trap here is that candidates confuse routing (Layer 3) with security policy (Layer 4-7), assuming that if routes exist, traffic will flow, but Palo Alto firewalls enforce zone-based policies independently of routing.

How to eliminate wrong answers

Option A is wrong because route redistribution is not required when static or direct routes already exist between the virtual routers; redistribution is used to share routes dynamically between routing protocols, not to enable packet forwarding. Option B is wrong because packet forwarding is enabled by default on virtual router interfaces in Palo Alto firewalls; there is no separate 'enable forwarding' toggle. Option D is wrong because the question states both virtual routers already have routes to each other's subnets via a shared inter-connect, so adding more static routes would be redundant and not address the packet drop.

Practice this question →

45

MCQhard

An administrator is configuring a Palo Alto Networks firewall to perform SSL decryption for outbound traffic. The administrator wants to ensure that traffic to certain categories, such as financial services, is not decrypted due to privacy concerns. What should the administrator configure?

A.A decryption policy rule with the action 'no-decrypt' for the financial services category.

B.A decryption profile with the 'no-decrypt' setting for the financial services category.

C.A decryption policy rule with the action 'decrypt' for all traffic except financial services.

D.A Security policy rule with the action 'deny' for the financial services category.

AnswerA

A decryption policy rule with the action 'no-decrypt' allows the administrator to exclude specific traffic from SSL decryption based on criteria such as URL category. By placing this rule above the decryption rule, traffic to financial services will be exempt from decryption, addressing privacy concerns. This is the correct way to selectively bypass decryption for certain categories.

Why this answer

To exclude specific traffic from SSL decryption, the administrator should create a decryption policy rule with the action 'no-decrypt' for the desired category or traffic. This rule must be placed above the decryption rule that would otherwise decrypt the traffic. This ensures that traffic to financial services is not decrypted while other traffic can still be decrypted as needed.

The no-decrypt action is specifically designed for this purpose, allowing selective bypass of decryption.

Exam trap

The trap here is confusing decryption policy with Security policy; a Security policy deny would block traffic, not just bypass decryption, and decryption profiles do not control which traffic is decrypted.

Practice this question →

46

MCQmedium

A network security engineer is troubleshooting why a newly installed Palo Alto Networks firewall is not inspecting traffic between two internal subnets. The engineer confirms that the traffic is routed through the firewall, security policies are configured to allow and inspect the traffic, and no drop counters are incrementing. However, the firewall's session table shows sessions in an 'ACTIVE' state but with no application identified. Which component of the Palo Alto Networks Next-Generation Firewall is responsible for identifying the application in this scenario?

A.User-ID

B.App-ID

C.Content-ID

D.SSL Decryption

AnswerB

App-ID is the Palo Alto Networks traffic classification technology that identifies the application regardless of port, protocol, or evasion technique. In this scenario, sessions are active but no application is identified, meaning App-ID has not yet completed its classification. App-ID uses multiple identification mechanisms including application signatures, protocol decoding, and heuristics. Once App-ID identifies the application, it can enforce security policies based on the application. The lack of application identification could be due to incomplete session setup, asymmetric traffic, or insufficient packets for identification.

Why this answer

App-ID is the Palo Alto Networks technology that identifies applications traversing the firewall. It uses signatures, protocol decoding, and behavioral heuristics to classify traffic accurately. In the scenario, sessions are active but no application is identified, indicating that App-ID has not yet completed its analysis.

This could happen if the session is incomplete, if traffic is asymmetric, or if the application is unknown. Once App-ID identifies the application, the firewall can apply the appropriate security policy. The other options are related technologies but do not perform application identification.

Exam trap

The trap here is confusing App-ID with Content-ID, as both are 'ID' technologies, but only App-ID identifies the application.

Practice this question →

47

Multi-Selectmedium

Which TWO statements correctly describe the role of the data plane in PAN-OS architecture?

Select 2 answers

A.It performs content inspection.

B.It runs routing protocols like OSPF.

C.It handles all packet forwarding and security processing.

D.It stores log files.

E.It manages the web interface and CLI.

AnswersA, C

Content inspection occurs in the data plane, where the packet-processing hardware and software apply App-ID, Content-ID and security profiles to live traffic. This satisfies the stem's requirement for a data plane function, since the management plane handles configuration and logging rather than inspecting sessions.

Why this answer

Option A is correct because the data plane in PAN-OS is responsible for performing content inspection, including App-ID, Content-ID, and threat prevention, on traffic that has been allowed by policy. Option C is correct because the data plane handles all packet forwarding and security processing, executing the security policy decisions made by the control plane on a per-packet basis. Options B, D, and E are incorrect because routing protocols like OSPF run in the control plane, log files are stored on the management plane's logging subsystem, and the web interface and CLI are managed by the management plane.

Exam trap

The trap here is confusing the data plane with the control plane or management plane, as candidates often assume that routing protocols or logging are part of packet forwarding, when in PAN-OS they are strictly separated.

Practice this question →

48

MCQhard

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

A.The session was terminated by a firewall policy.

B.The session was idle for longer than the timeout threshold.

C.The session was forcibly closed by an administrator.

D.The session ended due to a TCP FIN/RST from the client.

AnswerB

Aged-out means the session sat idle until its configured timeout expired, so PAN-OS removed it from the session table. This satisfies the exhibit's requirement: the session ended because no packets refreshed it within the timeout threshold, not due to a reset or policy denial.

Why this answer

The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Exam trap

Palo Alto Networks often tests the misconception that 'aged-out' means the session was terminated by a security policy or explicit reset, but the trap here is that 'aged-out' specifically refers to an idle timeout, not a policy action or TCP handshake termination.

How to eliminate wrong answers

Option A is wrong because a firewall policy termination would show 'Session End Reason: policy-deny' or similar, not 'aged-out'. Option C is wrong because an administrator forcibly closing a session would generate a 'Session End Reason: admin-reset' or 'session-manager clear session' event. Option D is wrong because a TCP FIN/RST from the client would result in 'Session End Reason: tcp-fin' or 'tcp-rst', not 'aged-out', which specifically indicates idle timeout.

Practice this question →

49

Drag & Dropmedium

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct factory reset sequence for a Palo Alto Networks firewall is: first locate the physical reset button, then press and hold it with a paperclip, wait for the alarm LED to turn off and back on (indicating the reset is complete), and finally release the button. This ensures all configurations are cleared and the device reboots to factory defaults. Common mistakes include performing steps in the wrong order, such as releasing too early or waiting before pressing.

Practice this question →

50

MCQhard

An enterprise requires separate administrative domains within a single firewall chassis for different business units. Each domain must have its own virtual router, security policies, and interface configuration. What is the appropriate PAN-OS feature?

A.Administrative roles with RBAC

B.Multiple contexts

C.Multiple virtual routers

D.Multiple virtual systems (vsys)

AnswerD

Multiple virtual systems partition one chassis into isolated logical firewalls, each with its own virtual router, security policies and interfaces. This delivers the separate administrative domains the business units require, which a single vsys or interface-level zoning cannot provide.

Why this answer

Virtual Systems (vsys) are the PAN-OS feature that enables partitioning a single physical firewall into multiple independent virtual firewalls. Each vsys operates with its own virtual router, security policies, and interface configuration, meeting the requirement for separate administrative domains for different business units within one chassis.

Exam trap

The trap here is confusing the Cisco term 'multiple contexts' with PAN-OS Virtual Systems, as candidates familiar with Cisco firewalls may incorrectly select Option B, not realizing that PAN-OS uses a different terminology and architecture for multi-tenancy.

How to eliminate wrong answers

Option A is wrong because Administrative roles with RBAC control user permissions and access to the firewall's management functions, but they do not create separate network domains with independent virtual routers, policies, or interfaces. Option B is wrong because 'Multiple contexts' is a Cisco ASA/Firepower term for virtual firewalls, not a PAN-OS feature; PAN-OS uses Virtual Systems (vsys) for this purpose. Option C is wrong because Multiple virtual routers allow separate routing tables within a single firewall instance, but they do not provide isolated security policies, interfaces, or administrative domains—all virtual routers share the same vsys context unless combined with vsys.

Practice this question →

51

MCQmedium

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

A.Reduced new session setup rate.

B.Reduced committed information rate (CIR) on QoS policies.

C.Increased latency for management access.

D.Increased packet drops due to buffer exhaustion.

AnswerD

Sustained dataplane buffer usage above 90% means the firewall cannot queue bursts fast enough, so new packets are discarded before processing. CPU headroom is irrelevant here: buffer exhaustion, not processing capacity, is the binding constraint, producing packet drops and retransmissions during the spike.

Why this answer

When dataplane packet buffer usage exceeds 90% during a traffic spike, the firewall's packet buffers are nearly exhausted, leading to a condition where incoming packets cannot be stored temporarily for processing. This directly causes packet drops because the dataplane has no available buffers to enqueue new packets, even though CPU utilization remains low. Option D correctly identifies this as the primary impact, as buffer exhaustion results in tail-drop behavior for new packets.

Exam trap

The trap here is that candidates often assume high packet buffer usage automatically implies high CPU utilization, but the PCNSE exam tests the understanding that dataplane buffer exhaustion and CPU utilization are independent metrics, and buffer drops can occur even when CPU is idle.

How to eliminate wrong answers

Option A is wrong because reduced new session setup rate is typically caused by high CPU utilization or session table exhaustion, not by high packet buffer usage; the CPU is below 30%, so session setup should not be impaired. Option B is wrong because the committed information rate (CIR) on QoS policies is a traffic-shaping parameter that is not directly affected by packet buffer usage; QoS policies enforce bandwidth limits regardless of buffer occupancy. Option C is wrong because increased latency for management access is associated with high control-plane CPU or management-plane congestion, not with dataplane buffer exhaustion; management traffic uses separate queues and resources.

Practice this question →

52

MCQhard

A security administrator is configuring a firewall to inspect traffic between two internal zones. The administrator wants to ensure that the firewall performs application identification and content inspection on all allowed traffic. Which configuration is required to achieve this?

A.Configure a Decryption policy to forward traffic to a content inspection engine.

B.Create a security policy with the action 'allow' and enable 'Log at Session End'.

C.Enable SSL decryption on the firewall for all traffic between the zones.

D.Create a security policy that allows the traffic and attach a Security Profile Group to the policy.

AnswerD

To perform application identification and content inspection, a security policy must be created that allows the traffic and has a Security Profile Group attached. The Security Profile Group includes profiles for antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking. Without attaching these profiles, the firewall only performs App-ID but not content inspection.

Why this answer

To perform application identification and content inspection on allowed traffic, a security policy must allow the traffic and have a Security Profile Group attached. The Security Profile Group contains the necessary profiles for antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking. Without these profiles, the firewall only identifies the application but does not inspect the content for threats.

Exam trap

The trap here is confusing SSL decryption with content inspection; decryption is only needed for encrypted traffic, while content inspection requires Security Profiles.

Practice this question →

53

MCQmedium

A firewall is configured with a destination NAT rule to translate public IP 203.0.113.10 to internal server 10.0.0.5 on port 443. Internal users from 10.0.0.0/24 can access the server using its private IP, but cannot access using the public IP. What should be configured to allow internal users to reach the server using the public IP?

A.Configure a source NAT rule that translates the internal source IP to the firewall's interface IP when the destination is the public IP.

B.Create a policy-based forwarding (PBF) rule to send the traffic to the server.

C.Add a security policy allowing traffic from internal zone to the public IP.

D.Add a static route on the firewall for the public IP pointing to the internal server.

AnswerA

Internal clients hitting the public IP create a flow where the server replies directly to the private source, bypassing the firewall and breaking the session. Source NAT rewrites the source to the firewall interface IP, forcing return traffic back through the firewall for correct translation.

Why this answer

When internal users send traffic to the public IP (203.0.113.10), the firewall performs destination NAT, translating the destination to 10.0.0.5. However, the return traffic from the server is sent directly to the internal user's IP (since they are on the same subnet), bypassing the firewall and causing asymmetric routing. A source NAT rule (often called NAT hairpin or NAT reflection) translates the internal source IP to the firewall's interface IP, forcing return traffic to go through the firewall and maintain session state.

Exam trap

The trap here is that candidates often think a security policy or route is sufficient, but they miss the fundamental requirement for symmetric routing in stateful firewalls, where the return traffic must traverse the same firewall that performed the NAT.

How to eliminate wrong answers

Option B is wrong because policy-based forwarding (PBF) is used to route traffic based on criteria like source/destination IP or application, not to solve NAT hairpin issues; it would not fix the asymmetric routing problem. Option C is wrong because a security policy alone does not address the NAT or routing issue; the traffic is already allowed if the server is reachable via private IP, and the problem is that the return traffic bypasses the firewall. Option D is wrong because adding a static route for the public IP pointing to the internal server would cause the firewall to route traffic directly to the server without performing NAT, breaking the translation and potentially causing routing loops or incorrect forwarding.

Practice this question →

54

MCQmedium

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

A.Create a security policy rule with an application override to match the port.

B.Define a custom application with the appropriate protocol, port, and optionally a signature.

C.Enable SSL decryption on the traffic to inspect encrypted payloads.

D.Add the port to the default application's 'port' field in the application object.

AnswerB

App-ID identifies applications by signature and protocol behaviour, not port alone. Since the proprietary protocol runs on a non-standard TCP port, a custom application object must be defined with the correct protocol, port and, where possible, a signature so the firewall can match and classify the traffic correctly.

Why this answer

When a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.

Exam trap

The trap here is that candidates often confuse 'application override' (which disables App-ID) with 'custom application' (which enhances App-ID), leading them to choose option A when they should instead define a new application object with the correct port and signature.

How to eliminate wrong answers

Option A is wrong because an application override bypasses App-ID entirely, forcing the firewall to treat all traffic on that port as the specified application, which defeats the purpose of dynamic identification and can lead to misclassification or security gaps. Option C is wrong because SSL decryption is irrelevant for a proprietary protocol that does not use TLS/SSL; decrypting encrypted payloads would not help if the traffic is not encrypted or if the protocol is not HTTP-based. Option D is wrong because modifying the default application's 'port' field would incorrectly associate a custom protocol with a built-in application, potentially causing false positives and breaking App-ID's ability to distinguish between applications.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Core Concepts and Architecture questions.

Start 20-question session