Courseiva
← Back to Palo Alto Networks Certified Network Security Engineer PCNSE questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
PCNSE
exam code
Palo Alto Networks
vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related PCNSE topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Manage, Monitor and Operate practice questions

Manage, Monitor and Operate practice questions for PCNSE.

Securing Traffic and App-ID practice questions

Securing Traffic and App-ID practice questions for PCNSE.

Securing Users and Applications with Authentication practice questions

Practise PCNSE questions linked to Securing Users and Applications with Authentication.

Decryption and SSL Inspection practice questions

Practise PCNSE questions linked to Decryption and SSL Inspection.

Managing Troubleshooting and High Availability practice questions

Targeted PCNSE practice covering Managing Troubleshooting and High Availability.

Deploy and Configure Firewalls practice questions

Sharpen your PCNSE knowledge of Deploy and Configure Firewalls.

Core Concepts and Architecture practice questions

Targeted PCNSE practice covering Core Concepts and Architecture.

Secure Access and VPN practice questions

Targeted PCNSE practice covering Secure Access and VPN.

Troubleshoot practice questions

Sharpen your PCNSE knowledge of Troubleshoot.

PCNSE fundamentals practice questions

PCNSE fundamentals practice questions for PCNSE.

PCNSE scenario practice questions

Targeted PCNSE practice covering PCNSE scenario.

PCNSE troubleshooting practice questions

Sharpen your PCNSE knowledge of PCNSE troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

A cloud-based application is accessed via URL filtering and uses SAML authentication. After a user changes their password in the identity provider (Okta), they are unable to authenticate to the application. The firewall is configured with an authentication policy that uses SAML. Other users who have not changed passwords can authenticate successfully. What is the most likely issue?

Question 2mediummultiple choice
Read the full MPLS explanation →

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Question 3hardmulti select
Full question →

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Question 4hardmultiple choice
Full question →

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Question 5mediummultiple choice
Full question →

A network administrator is troubleshooting an issue where HTTPS traffic to a particular website is being blocked. The security policy rule allows SSL traffic to that website. The firewall logs show the traffic is being blocked by the URL Filtering profile. The URL Filtering profile is set to allow the category 'Business-and-Economy'. The website belongs to the category 'Shopping'. What action should the administrator take?

Question 6mediummultiple choice
Full question →

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

Question 7mediummultiple choice
Full question →

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

Question 8easymultiple choice
Full question →

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Question 9mediummultiple choice
Full question →

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

Exhibit

Refer to the exhibit.

admin@PA-5000# show shared authentication-profile TestAuth
{
  "entry": {
    "@name": "TestAuth",
    "method": {
      "kerberos": {
        "server-profile": "KDC-Profile",
        "realm": "EXAMPLE.COM"
      },
      "allow-list": ["EXAMPLE\\user1", "EXAMPLE\\user2"]
    },
    "user-domain": "EXAMPLE",
    "expiration": 60
  }
}
Question 10mediummultiple choice
Review the full routing breakdown →

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

Question 11hardmultiple choice
Read the full VPN explanation →

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Exhibit

Refer to the exhibit.

show vpn gateway

Name: Corp-GW
Peer IP: 203.0.113.1
Local IP: 198.51.100.1
IKE version: IKEv2
Pre-shared key: ****
IKE crypto profile: default
DPD: enabled

show vpn tunnel

Name: Corp-Tun
Tunnel interface: tunnel.1
Type: IPSec
IKE gateway: Corp-GW
IPSec crypto profile: default
Proxy IDs: local 10.0.0.0/16, remote 172.16.0.0/16

show routing route

Destination: 172.16.0.0/16
Next hop: tunnel.1
Metric: 10

show interface tunnel.1

Interface: tunnel.1
Zone: VPN-Zone
Virtual router: default
Question 12mediummultiple choice
Full question →

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

Question 13hardmultiple choice
Read the full VPN explanation →

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Question 14hardmultiple choice
Review the full OSPF breakdown →

A security engineer is deploying a new PA-5220 firewall to replace an existing legacy firewall. The environment has complex routing with OSPF and BGP. The engineer configures the firewall with multiple virtual routers: one for the internal network, one for the DMZ, and one for the external connection to two ISPs. The firewall is placed in Layer 3 mode. After the cutover, users report that they can access the internet but internal traffic between two different subnets that are both in the internal virtual router fails to route properly. The engineer checks the routing table on the internal virtual router and sees correct OSPF learned routes. The security policies allow all traffic between those subnets. What is the most likely cause of the routing failure?

Question 15mediummultiple choice
Full question →

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Exhibit

Refer to the exhibit.

admin@PA-220> show system info | match appid
appid version: 8000-7120
appid last update: 2024/10/01 03:00:00
appid packet buffer: 1024 KB
appid max sessions: 500000

These PCNSE practice questions are part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style PCNSE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.