319 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This exam was retired by the vendor on July 31, 2025.
PCNSE can no longer be scheduled. The practice material below remains available for reference and for learners studying the underlying skills. See Palo Alto Networks' current certification portfolio (NGFW Engineer, Network Security Professional)
This is exactly what you see during practice — question, options, and a full explanation after you answer.
A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?
To enforce MFA for administrative access on a Palo Alto Networks firewall, you must create an authentication profile that uses RADIUS (or another MFA-capable server) and then assign that profile to the admin accounts. The authentication profile defines how the firewall authentica…Read full explanation
In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?
The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disruptin…Read full explanation
Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?
The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security e…Read full explanation
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.