PCNSE Practice Questions

Question 1

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Accepted Answer

Download, then Upload, then Install, then Reboot, then Verify. The correct sequence for upgrading PAN-OS on a standalone firewall is: Download the new image from the support portal, Upload it to the firewall, Install the image, Reboot the firewall to load the new version, and Verify the upgrade was successful. Common mistakes include swapping the order of upload and download, installing before upload, or reboot before install.

Answer

Download, then Install, then Upload, then Reboot, then Verify

Answer

Upload, then Download, then Install, then Reboot, then Verify

Answer

Download, then Upload, then Reboot, then Install, then Verify

Question 2

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. TLS 1.3 decryption support was introduced in PAN-OS 9.0, enabling the firewall to decrypt and inspect TLS 1.3 traffic. This allows organizations to maintain visibility into encrypted traffic using the latest TLS protocol without requiring additional hardware or software upgrades beyond the PAN-OS version.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 3

Which TWO of the following are mandatory requirements for forming an active/passive HA pair between two Palo Alto Networks firewalls? (Choose exactly two.)

Accepted Answer

Both firewalls must be the same hardware model.. For an active/passive HA pair, both firewalls must be the same hardware model to ensure identical hardware resources (e.g., CPU, memory, ASICs) and port layouts. This is a mandatory requirement because the HA synchronization process relies on matching hardware capabilities to avoid configuration mismatches and failover failures.

Answer

Both firewalls must have the same number of active VLANs.

Answer

Both firewalls must use the same management interface IP address.

Answer

Both firewalls must have identical license subscriptions.

Question 4

A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?

Accepted Answer

Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.. The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.

Answer

Configure a Zone Protection profile to block the IP.

Answer

Apply a QoS policy to limit the bandwidth from that IP to zero.

Answer

Add the IP to an External Dynamic List and reference it in a security rule.

Question 5

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 6

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 7

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Accepted Answer

The application 'ssl' is not allowed in any security rule.. The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Answer

The session ended with TCP FIN, causing the firewall to deny.

Answer

The destination IP is blacklisted.

Answer

The security rule 'default-deny' explicitly blocks this traffic.

Question 8

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Accepted Answer

Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.. App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.

Answer

Confirm that the source and destination users are correctly configured.

Answer

Ensure that a security profile is applied to the rule to allow the application.

Answer

Check if the rule is placed after a deny-all rule.

Question 9

Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?

Accepted Answer

Local storage on the firewall's management disk (MP) and export via the web interface.. The firewall's management plane (MP) includes a local log storage partition that can hold logs (e.g., traffic, threat, system) and allows export via the web interface (Monitor > Logs > Export). This provides a built-in method for log collection without requiring external infrastructure. Option E is correct because syslog (UDP/TCP, RFC 3164 or RFC 5424) is a standard protocol supported by Palo Alto firewalls to forward all log types to an external collector for centralized reporting and forensics.

Answer

Export to Microsoft Azure Sentinel directly without any intermediate.

Answer

SNMPv3 traps for all log types.

Answer

Email alerts for all threat logs.

Question 10

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 11

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

Accepted Answer

Check the security policy rulebase order and matching. The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Answer

Verify the user-ID agent is mapping the IP correctly

Answer

Check the service configuration for the destination port

Answer

Check the NAT configuration for the user's subnet

Question 12

An administrator configures the management interface with IP 192.168.1.1/24 and can ping it from a host on the same subnet, but cannot access the web interface. What is the likely cause?

Accepted Answer

HTTP/HTTPS is not enabled in the interface management profile.. The management interface on a Palo Alto Networks firewall requires an explicit management profile that enables HTTP/HTTPS access. Even if the interface has a valid IP and is reachable via ping (ICMP), the web server will not respond to HTTP/HTTPS requests unless the corresponding services are enabled in the interface management profile. By default, the management interface may have a profile that allows only ping, not web access.

Answer

The web server is not running.

Answer

The host is not in the allowed IP list.

Answer

The firewall is in FIPS mode.

Question 13

Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?

Accepted Answer

Active/Passive HA with floating IP. Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.

Answer

Active/Passive HA with virtual router synchronization

Answer

Use of multiple public IPs with NAT rules

Question 14

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Accepted Answer

Enable Automatic Tunnel. Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients. Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Answer

GlobalProtect client package assigned to macOS

Answer

Gateway IP Pool configured

Answer

PanGPS (Pan GlobalProtect Service) enabled

Question 15

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Palo Alto Networks Certified Network Security Engineer PCNSE practice test

Three ways to study

Study PCNSE by domain

Study PCNSE by topic

Manage, Monitor and Operate practice questions

Securing Traffic and App-ID practice questions

Securing Users and Applications with Authentication practice questions

Decryption and SSL Inspection practice questions

Managing Troubleshooting and High Availability practice questions

Deploy and Configure Firewalls practice questions

Core Concepts and Architecture practice questions

Secure Access and VPN practice questions

Troubleshoot practice questions

PCNSE fundamentals practice questions

PCNSE scenario practice questions

PCNSE troubleshooting practice questions

Top PCNSE questions

Palo Alto Networks Certified Network Security Engineer PCNSE practice questions

How to use these PCNSE questions

Quick answer