How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 15 Refer to the Exhibit Practice Questions scenario questions for the PCNSE exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCNSE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Palo Alto Networks Certified Network Security Engineer PCNSE questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCNSE

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Exhibit

config shared
security-rulebase
 security-rules
  rule "Allow-SSL"
   from [ "Trust-L3" ]
   to [ "Untrust-L3" ]
   source [ "10.0.0.0/8" ]
   destination [ "any" ]
   application [ "ssl" ]
   service [ "application-default" ]
   action allow
   log-start no
   log-end yes
   log-setting "Profile1"
 end-rule
  rule "Block-HTTP"
   from [ "Trust-L3" ]
   to [ "Untrust-L3" ]
   source [ "10.0.0.0/8" ]
   destination [ "any" ]
   application [ "web-browsing" ]
   service [ "application-default" ]
   action deny
   log-start no
   log-end yes
 end-rule
end
config shared
 application-group "Web-Apps"
  members [ "ssl" "web-browsing" ]
 end-application-group
end

A
The service 'application-default' does not match port 443; a custom service must be used.
Why wrong: Application-default automatically uses the default port for the application, which for SSL is 443.
B
The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.
Although not shown here, if an application-group containing 'ssl' is in a deny rule higher in the order, it would deny the traffic.
C
The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.
Why wrong: Logging settings do not affect the action; the session would still be allowed.
D
SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.
Why wrong: SSL identification does not require decryption; the firewall can identify SSL by the handshake even without decryption.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions

Securing Traffic and App-ID practice questions

Securing Users and Applications with Authentication practice questions

Decryption and SSL Inspection practice questions

Managing Troubleshooting and High Availability practice questions

Deploy and Configure Firewalls practice questions

Core Concepts and Architecture practice questions

Secure Access and VPN practice questions

Troubleshoot practice questions

PCNSE fundamentals practice questions

PCNSE scenario practice questions

PCNSE troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

Exhibit

Based on the exhibit, which THREE conclusions can be drawn?

Exhibit

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Exhibit

Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?

Exhibit

Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?

Exhibit

Refer to the exhibit. What does the uptime indicate?

Exhibit

The security policy rule shown in the exhibit has log-start and log-end both set to 'no', but a log-forwarding profile is configured. Which statement best describes the logging behavior for sessions matching this rule?

Exhibit

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

Exhibit

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Exhibit

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

Exhibit

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

Exhibit

Exhibit

Refer to the exhibit. A user at IP 10.10.1.11 is unable to access internal resources that require authentication. The firewall logs show 'no user mapping' for traffic from this IP. Which step should the administrator take first?

Exhibit

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

Exhibit