Courseiva

CCNA Troubleshoot Questions

57 questions · Troubleshoot topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

A firewall is experiencing high CPU utilization. The engineer suspects a denial-of-service attack. Which command should be used to identify the source of the attack?

A.show counter global | match drop
B.show session all | match <source IP>
C.request high-availability state
D.debug flow basic
AnswerB

This command lists all sessions and can be filtered to see if a single source has many sessions.

Why this answer

The 'show session all' command displays all active sessions on the firewall, and piping the output to 'match <source IP>' filters for sessions originating from a specific IP address. In a high CPU scenario suspected to be a DoS attack, this allows the engineer to quickly identify if a single source IP is generating an excessive number of sessions, which is a common indicator of a flood-based attack.

Exam trap

The trap here is that candidates often choose 'debug flow basic' (option D) because they think deep packet inspection is needed to find the attack source, but this command is too resource-intensive and does not directly identify the source IP; instead, the session table query is the correct first step.

How to eliminate wrong answers

Option A is wrong because 'show counter global | match drop' shows global packet drop counters (e.g., for policy denies, TCP errors), not the source IP of traffic causing high CPU; it can indicate drops but does not identify the attacker. Option C is wrong because 'request high-availability state' is used to manage HA failover or state synchronization, not to diagnose high CPU or identify attack sources. Option D is wrong because 'debug flow basic' enables verbose packet flow debugging, which can overwhelm the CPU further and is not a targeted command for identifying a DoS source; it is a troubleshooting tool for flow issues, not for source identification.

Practice this question →
2
MCQmedium

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

A.Check the traffic logs for any denial events
B.Check the IPSec tunnel status and IKE/IPSEC SA rekey timers
C.Reboot the firewall to clear any stale sessions
D.Verify the routing table on both firewalls
AnswerB

Intermittent connectivity every few minutes often indicates a mismatch in SA lifetime or rekey failure.

Why this answer

The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Exam trap

The trap here is that candidates often jump to routing or security rule checks, but the periodic nature of the outage is a classic symptom of IPsec SA rekey failure, not a routing or policy issue.

How to eliminate wrong answers

Option A is wrong because traffic logs showing denial events would indicate persistent blocking (e.g., by security rules), not the periodic connectivity pattern described; intermittent rekey failures do not generate consistent denial log entries. Option C is wrong because rebooting the firewall is a disruptive, non-diagnostic step that clears all sessions and logs, potentially destroying evidence of the rekey failure and delaying resolution. Option D is wrong because verifying the routing table checks for static or dynamic route stability, but routing is typically stable in a site-to-site VPN; the periodic nature of the issue points to a VPN rekey problem, not a routing change.

Practice this question →
3
MCQmedium

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

A.The SSL decryption policy is configured correctly
B.The security rule is still referencing the correct URL filtering profile
C.The URL filtering license is still valid
D.The URL filtering database is up-to-date
AnswerD

An upgrade may require a fresh download of the URL database to ensure proper categorization.

Why this answer

After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Exam trap

The trap here is that candidates assume a configuration or license issue is the root cause, but Palo Alto Networks exams specifically test the knowledge that after an upgrade, the URL filtering database must be re-downloaded to ensure accurate categorization, as the upgrade process can invalidate the local database.

How to eliminate wrong answers

Option A is wrong because SSL decryption policy affects the ability to inspect encrypted traffic for URL categorization, but it does not cause configured URL filtering categories to stop being blocked; if decryption is misconfigured, the firewall would simply not see the full URL, but the existing categories would still be blocked for non-encrypted or decrypted traffic. Option B is wrong because the security rule referencing the correct URL filtering profile is a basic configuration check, but after an upgrade, the profile reference typically remains intact; the issue is more likely a stale database rather than a lost profile association. Option C is wrong because the URL filtering license is a subscription that enables the feature, but it does not expire or become invalid during a software upgrade; the license status is checked at the time of use and would generate a clear license error if invalid, not a silent failure to block categories.

Practice this question →
4
MCQhard

A firewall has a security policy that includes a rule with a 'Schedule' object. During the scheduled time, traffic should be allowed, but it is being blocked. The schedule is configured correctly. What could be the issue?

A.The schedule object uses the wrong time zone
B.The schedule object is not referenced in the rule
C.The user's traffic is using a different application
D.The rule is placed incorrectly in the security policy
AnswerA

If the firewall's time zone is different from the schedule's intended time zone, the schedule may not activate as expected.

Why this answer

The schedule object is configured correctly, but if the firewall's time zone setting does not match the schedule's time zone, the rule may activate at the wrong local time. For example, if the schedule is set to UTC but the firewall is in EST, traffic during the intended window will be blocked because the firewall evaluates the schedule against its own system time. This is a common misconfiguration where the schedule object itself is correct, but the time zone context is mismatched.

Exam trap

The exam often tests the misconception that a correctly configured schedule object will always work as expected, without considering the time zone context, leading candidates to overlook the time zone mismatch and choose options like rule placement or application mismatch instead.

How to eliminate wrong answers

Option B is wrong because if the schedule object were not referenced in the rule, the rule would be active at all times (or the schedule would have no effect), not specifically blocking traffic during the scheduled time. Option C is wrong because the application field in a security rule is independent of the schedule; a different application would cause a match or no match based on App-ID, not cause a schedule-based block. Option D is wrong because rule placement affects which rule is matched first, but if the correct rule with the schedule is matched and the schedule is configured correctly, placement would not cause the traffic to be blocked during the scheduled window.

Practice this question →
5
MCQmedium

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

A.A security policy rule with a geolocation-based deny is blocking the traffic
B.Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth
C.The GlobalProtect gateway is not configured with the correct client settings
D.The DNS proxy setting is misconfigured
AnswerA

Geolocation-based rules can block traffic if the user's public IP is in a denied country.

Why this answer

Even though the GlobalProtect tunnel is established successfully, a security policy rule with a geolocation-based deny can block traffic from the user's source IP address. Since the user is connecting remotely, their IP address may fall into a denied geolocation region, preventing access to internal resources while the tunnel itself remains up. This matches the symptom of successful tunnel establishment but inability to access internal resources.

Exam trap

The trap here is that candidates often assume a successful tunnel establishment means all traffic is allowed, overlooking that security policy rules, especially geolocation-based ones, are evaluated after tunnel establishment and can still block traffic based on the source IP's geographic location.

How to eliminate wrong answers

Option B is wrong because if split tunneling is disabled, all traffic goes through the firewall, which could cause bandwidth saturation but would not prevent access to internal resources; in fact, it would force all traffic through the tunnel, potentially improving access to internal resources. Option C is wrong because incorrect client settings on the GlobalProtect gateway would typically prevent tunnel establishment or cause connection failures, not allow successful tunnel establishment while blocking internal resource access. Option D is wrong because a misconfigured DNS proxy setting would cause name resolution failures, not block traffic to internal resources after the tunnel is already established; the user would likely see DNS errors rather than being unable to access resources by IP address.

Practice this question →
6
Multi-Selectmedium

Which TWO CLI commands can be used to check whether a specific security policy rule is being matched by traffic? (Choose two.)

Select 2 answers
A.show session limit
B.show security-policy rule-usage
C.show session all filter rule <rulename>
D.show security-policy rule <rulename>
E.show running security-policy
AnswersB, C

This command displays the number of times each rule has been matched.

Why this answer

The 'show security-policy rule-usage' command displays the hit count for each security policy rule, allowing you to verify if a specific rule has been matched by traffic. Option C is correct because 'show session all filter rule <rulename>' filters active sessions by the rule name, showing only sessions that matched that specific security policy rule, which directly confirms rule usage.

Exam trap

The trap here is that candidates often confuse 'show security-policy rule <rulename>' (which only shows configuration) with a command that shows rule usage, leading them to select option D instead of the correct rule-usage or session-filter commands.

Practice this question →
7
Multi-Selecteasy

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Select 2 answers
A.Configure a NetFlow exporter on Panorama.
B.Use the Panorama API to retrieve logs.
C.Export logs as CSV directly from the Panorama web interface.
D.Configure a Log Forwarding profile to send logs to a syslog server.
E.Use SNMP traps to send log data.
AnswersB, D

The API can be used to programmatically export logs in various formats.

Why this answer

Panorama provides a RESTful API that allows external systems to programmatically retrieve logs via HTTPS requests. This is a supported method for exporting logs to external systems, enabling integration with SIEM tools or custom scripts for log analysis and monitoring.

Exam trap

The trap here is that candidates confuse manual CSV export from the web interface with a supported automated export method, or mistakenly think NetFlow or SNMP can handle full log export when they are designed for different purposes (flow data and alerts, respectively).

Practice this question →
8
MCQmedium

Refer to the exhibit. A user at 10.1.1.10 is trying to connect to a web server at 203.0.113.5 on port 443. The session shows 'State: DROP' with reason 'policy-deny'. However, the administrator has a security policy rule that allows SSL traffic from the source zone to the destination zone. What is the most likely cause of the drop?

A.The source NAT rule is missing, so the private IP cannot reach the internet.
B.The security policy rule that allows SSL is in a different rulebase or zone than the traffic.
C.The SSL application is not correctly identified because the traffic is encrypted.
D.The firewall is configured to block SSL sessions that use weak ciphers.
AnswerB

The traffic may be matched by an earlier deny rule or the zone context might be wrong.

Why this answer

The session shows 'policy-deny' with a DROP state, which indicates that the traffic matched a deny rule or did not match any allow rule in the security policy. Even though the administrator believes an SSL allow rule exists, the most common cause is that the rule is in a different rulebase (e.g., pre-rulebase or post-rulebase) or the traffic is traversing a different zone pair than the one the rule applies to. The firewall evaluates rules in a specific order (pre-rulebase, then rulebase, then post-rulebase), and if the rule is not in the correct location for the traffic's ingress and egress zones, it will not be matched, resulting in a policy-deny drop.

Exam trap

The trap here is that candidates assume a security policy rule exists globally, but the PCNSE exam tests the understanding that rules are zone-specific and rulebase-specific, so a rule in the wrong zone pair or rulebase will not be matched, leading to a policy-deny drop.

How to eliminate wrong answers

Option A is wrong because a missing source NAT rule would cause a different symptom: the session would show a 'nat-ip-alloc' failure or a 'no-route' drop, not a 'policy-deny' drop. Option C is wrong because the firewall can still match a security policy rule based on the destination port (443) and IP addresses even if the application is encrypted; SSL decryption is not required for policy matching. Option D is wrong because blocking weak ciphers is a function of SSL decryption profiles or SSL Forward Proxy settings, not a direct cause of a 'policy-deny' drop; such a block would result in a 'decrypt' or 'ssl' related drop reason, not 'policy-deny'.

Practice this question →
9
MCQmedium

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

A.The traffic is being blocked because the 'From Zone' is trust
B.The session is being denied by a different rule
C.The firewall might be incorrectly identifying the application as web-browsing when it is something else
D.The session is not being logged correctly
AnswerC

Application misidentification can cause partial loading if the firewall blocks embedded objects.

Why this answer

When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Exam trap

Palo Alto Networks often tests the nuance that a session being 'established' does not guarantee full application functionality; candidates mistakenly assume that if the session is up, all traffic is passing, but App-ID misclassification can cause partial content delivery.

How to eliminate wrong answers

Option A is wrong because the 'From Zone' being trust does not inherently block traffic; zone-based policies are evaluated based on the rulebase, and a session being established indicates that a rule allowed the initial handshake. Option B is wrong because if the session is established, it has already matched a rule that permits the session; a different rule denying the session would prevent establishment entirely, not cause partial loading. Option D is wrong because logging is a reporting function and does not affect whether traffic is allowed or blocked; incorrect logging would not cause incomplete page loading.

Practice this question →
10
MCQmedium

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

A.The source and destination zones are misconfigured
B.The rule is disabled
C.The user's IP is in a block list
D.The firewall is in transparent mode
AnswerA

If the rule's source or destination zone does not match the traffic zones, it won't match.

Why this answer

When a firewall logs 'No rule matched' despite a security policy rule existing, the most common cause is a zone mismatch. In Palo Alto Networks firewalls, security rules are evaluated based on source and destination zones; if the rule specifies different zones than the traffic's ingress and egress zones, the rule will not apply, resulting in a deny. Misconfigured zones prevent the rule from being considered, even if all other attributes (IP, port, application) match.

Exam trap

The trap here is that candidates often focus on rule order or IP addresses, overlooking that zone misconfiguration is the primary reason a rule is skipped entirely, as Palo Alto Networks firewalls enforce zone-based policy matching before any other rule attributes are checked.

How to eliminate wrong answers

Option B is wrong because if the rule were disabled, the firewall would still log 'No rule matched' only if no other rule matched, but the question states the rule should match; disabling a rule removes it from evaluation entirely, but the symptom is the same as a zone mismatch, making it less likely given the rule is intended to match. Option C is wrong because a block list (e.g., External Dynamic List or custom block IP) would cause a deny with a different log reason, such as 'Denied by block list' or 'Denied by URL filtering', not 'No rule matched'. Option D is wrong because transparent mode (Layer 2) does not affect security rule matching; the firewall still evaluates rules based on zones (which are configured for virtual wire interfaces), and 'No rule matched' can still occur if zone configuration is incorrect, so transparent mode is not a direct cause.

Practice this question →
11
Multi-Selecthard

Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)

Select 3 answers
A.The server sends a TCP RST packet to the client.
B.The firewall's application override is incorrectly matching the traffic.
C.The session reaches the configured idle timeout.
D.A decryption error occurs during SSL handshake.
E.The firewall runs out of session resources and starts dropping new sessions.
AnswersA, B, D

The firewall records the RST as the session end reason.

Why this answer

A TCP RST packet from the server indicates that the server has abruptly terminated the connection, often due to an application-layer error or a protocol violation. The firewall logs this as 'tcp-rst-from-server' in the session end reason, reflecting that the reset originated from the server side.

Exam trap

The trap here is that candidates may confuse session termination reasons, assuming any abnormal end is due to resource exhaustion or timeouts, but the question specifically targets TCP RST flags, which are tied to endpoint behavior, not firewall resource management.

Practice this question →
12
MCQeasy

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

A.Ensure that the administrator account has superuser privileges.
B.Verify that the firewall's PAN-OS version is supported by the Panorama version.
C.Check that the firewall is connected to the internet for cloud services.
D.Review the system logs on the firewall for disk space errors.
AnswerB

Incompatible versions between Panorama and firewalls can cause template validation failures during push.

Why this answer

The 'template validation error' during a commit indicates that the configuration templates being pushed are incompatible with the target firewall's PAN-OS version. Panorama templates may include features or syntax not supported by older firewall versions, causing the validation to fail. Therefore, verifying that the firewall's PAN-OS version is within the supported matrix for the Panorama version is the first logical step.

Exam trap

The trap here is that candidates often assume a 'validation error' is due to permissions or connectivity, but in the context of a Panorama commit, it almost always points to a version mismatch between Panorama and the managed firewall.

How to eliminate wrong answers

Option A is wrong because administrator privileges (superuser or otherwise) do not affect template validation errors; these errors are version-related, not permission-related. Option C is wrong because internet connectivity for cloud services is unrelated to template validation during a commit; cloud services are used for features like threat updates, not configuration pushes. Option D is wrong because disk space errors on the firewall would typically cause commit failures with specific 'disk full' messages, not a generic 'template validation error'; the error points to a version mismatch, not storage issues.

Practice this question →
13
MCQeasy

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

A.DNS resolution failure
B.Asymmetric routing
C.Security policy configured with service 'any'
D.Incomplete TCP three-way handshake
AnswerB

Asymmetric routing causes the firewall to see packets that don't match existing sessions, leading to drops or session re-creation.

Why this answer

Asymmetric routing causes the firewall to see only one direction of a TCP session, leading to session timeouts despite active session entries. When traffic from the client to the database server traverses one firewall and return traffic takes a different path, the firewall cannot properly track the TCP state, resulting in dropped packets and intermittent connectivity.

Exam trap

The trap here is that candidates see 'active sessions' in the table and assume the firewall is working correctly, overlooking that asymmetric routing can leave stale entries while actual data flow is disrupted.

How to eliminate wrong answers

Option A is wrong because DNS resolution failure would prevent the initial connection entirely, not cause intermittent timeouts with active sessions in the table. Option C is wrong because a security policy with service 'any' would allow all traffic, not cause timeouts; it might increase security risk but does not disrupt established sessions. Option D is wrong because an incomplete TCP three-way handshake would prevent session establishment, not cause intermittent timeouts after sessions are already active in the table.

Practice this question →
14
MCQmedium

A company has two Palo Alto Networks firewalls in an active/passive high availability pair. The firewalls are configured with a virtual IP (VIP) for the internal network. Recently, the passive firewall was upgraded to a new PAN-OS version. After the upgrade, the active firewall is still running the old version. The administrator wants to perform a failover to make the upgraded firewall active. However, when the administrator attempts to manually failover, the new passive firewall does not become active. The HA synchronization status shows 'synchronized' but the preemption is disabled. The administrator checks the HA configuration and finds that the peer's version is not compatible. What should the administrator do to successfully failover to the upgraded firewall?

A.Disable HA, then reconfigure HA on both firewalls
B.Upgrade the active firewall to the same PAN-OS version as the passive firewall
C.Force the failover via the CLI using 'request high-availability state suspend' on the active firewall
D.Downgrade the passive firewall back to the old version
AnswerB

Both firewalls must run the same version for proper HA operation; upgrading the active is the correct action.

Why this answer

PAN-OS requires both firewalls in an active/passive HA pair to run the same major version to form a compatible HA connection. Even if synchronization status shows 'synchronized', the version mismatch prevents failover from succeeding. Upgrading the active firewall to match the passive firewall's version restores version compatibility and allows the failover to proceed.

Exam trap

The trap here is that candidates assume 'synchronized' status means HA is fully functional and failover will work, but they overlook that version compatibility is a prerequisite for stateful failover, not just configuration sync.

How to eliminate wrong answers

Option A is wrong because disabling and reconfiguring HA does not address the root cause—the version mismatch—and would cause unnecessary downtime and configuration loss. Option C is wrong because the 'request high-availability state suspend' command on the active firewall would force it to suspend, but the passive firewall still cannot become active due to the incompatible PAN-OS version, so failover would fail. Option D is wrong because downgrading the passive firewall back to the old version would revert the upgrade, defeating the purpose of making the upgraded firewall active, and is not a best practice for maintaining security and feature updates.

Practice this question →
15
MCQhard

A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?

A.Use the CLI command 'show running resource-monitor' to view CPU usage per module.
B.Review the security policy rule hit counts to see if a specific rule is hit frequently.
C.Check the number of active sessions using 'show session info'.
D.Inspect the packet buffer usage with 'show counter packet-buffer'.
AnswerA

Resource monitor breaks down CPU usage by dataplane and control plane, helping identify the culprit.

Why this answer

The 'show running resource-monitor' CLI command provides a per-module breakdown of CPU utilization, including dataplane, management plane, and individual packet processing threads. This granular view is the most effective first step because high CPU on a Palo Alto firewall is often caused by a specific module (e.g., a dataplane core processing excessive traffic or a session table scan), and isolating the module directs further troubleshooting. Other options, like checking rule hit counts or session counts, are secondary steps that do not pinpoint the CPU-consuming component.

Exam trap

The trap here is that candidates often jump to checking session counts or rule hits, assuming high traffic volume is the cause, but Palo Alto firewalls can experience high CPU from non-traffic sources like logging storms, routing updates, or management plane tasks, which the resource-monitor command directly reveals.

How to eliminate wrong answers

Option B is wrong because security policy rule hit counts indicate which rules are matched frequently, but they do not directly correlate to CPU utilization; a rule with high hits may not cause high CPU if the traffic is simple forwarding. Option C is wrong because checking the number of active sessions with 'show session info' shows session count, which is a symptom of high CPU but not the root cause; high CPU can occur with low session counts due to other factors like logging or decryption. Option D is wrong because inspecting packet buffer usage with 'show counter packet-buffer' reveals buffer exhaustion or drops, which is a consequence of high CPU or other issues, not a direct diagnostic for identifying the CPU-consuming process.

Practice this question →
16
MCQeasy

A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?

A.The firewall is not configured for TLS decryption.
B.The user-ID agent is not installed.
C.The firewall does not have network access to the domain controller.
D.The domain controller security policy is blocking RPC traffic.
AnswerD

RPC is used for User-ID polling; if blocked, mapping fails.

Why this answer

User-ID mapping via domain controller polling relies on the firewall querying the domain controller's security event logs using RPC (Remote Procedure Call). If the domain controller's security policy blocks RPC traffic (typically TCP port 135 and dynamic RPC ports), the firewall cannot retrieve the login events needed to map users to IP addresses, causing incorrect or missing User-ID mappings.

Exam trap

The trap here is that candidates often assume User-ID requires a separate agent (Option B) or that network connectivity alone is sufficient (Option C), overlooking the specific RPC protocol dependency that is commonly blocked by domain controller security policies.

How to eliminate wrong answers

Option A is wrong because TLS decryption is unrelated to User-ID mapping; it is used for decrypting SSL/TLS traffic for threat inspection, not for retrieving user login events from a domain controller. Option B is wrong because User-ID mapping via domain controller polling does not require a separate User-ID Agent; the firewall itself can poll the domain controller directly using the configured polling settings. Option C is wrong because while network access to the domain controller is necessary, the question specifies that the firewall is configured for polling, implying connectivity exists; the most likely cause is a security policy blocking the specific RPC protocol required for event log retrieval, not a general lack of network access.

Practice this question →
17
Multi-Selectmedium

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Select 2 answers
A.Use the packet capture tool to capture the traffic
B.Check the rule order to see if a rule earlier in the policy is also matching
C.Enable logging at session end for all rules
D.Review the security rule that matched the session to ensure it is configured correctly
E.Check the server's network connectivity
AnswersB, D

Multiple rules may match; an earlier rule might deny the traffic.

Why this answer

When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Exam trap

The trap here is that candidates often assume the issue is with the server or network connectivity (Option E) or jump to packet capture (Option A) instead of focusing on the security policy itself, which is the direct cause indicated by the log's 'dropped by security rule' message.

Practice this question →
18
MCQmedium

A network engineer is troubleshooting a slow file transfer through a PA-5200. The file transfer is between two sites connected via IPsec VPN. The firewall has a symmetric crypto profile with AES-256 and SHA-256. The throughput is lower than expected. The engineer checks the dataplane CPU and sees it is 30%. The firewall's interface counters show no errors. What should be the first step to improve throughput?

A.Disable anti-replay protection.
B.Enable hardware acceleration for VPN.
C.Change the encryption algorithm to AES-128.
D.Increase the MTU on the tunnel interface.
AnswerB

Hardware acceleration uses dedicated chips to handle crypto, freeing CPU and increasing throughput.

Why this answer

The PA-5200 firewall has dedicated hardware acceleration for IPsec VPN processing, which offloads crypto operations from the dataplane CPU. With the dataplane CPU at only 30% and no interface errors, the bottleneck is likely that the VPN traffic is being processed in software rather than hardware. Enabling hardware acceleration (option B) allows the firewall to use its onboard crypto engine, significantly improving throughput for AES-256 and SHA-256 operations.

Exam trap

The trap here is that candidates assume low CPU means no bottleneck, but in VPN scenarios, software-based crypto can be the limiting factor even with low CPU because the dataplane CPU is not the only resource involved; hardware acceleration must be explicitly enabled.

How to eliminate wrong answers

Option A is wrong because disabling anti-replay protection reduces security by allowing replay attacks and does not address the underlying throughput issue; anti-replay is a stateful check with minimal CPU impact. Option C is wrong because changing the encryption algorithm to AES-128 would only reduce security and not improve throughput if the bottleneck is software-based processing; AES-256 is already supported by hardware acceleration. Option D is wrong because increasing the MTU on the tunnel interface could cause fragmentation issues or require matching MTU adjustments across the path, and the problem is not related to packet size or interface errors.

Practice this question →
19
MCQmedium

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

A.The firewall's system log rate is exceeded and logs are dropped.
B.The rule has logging disabled for the 'deny' action.
C.The rule is not being matched because a previous rule allows the traffic.
D.The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.
AnswerD

Denied sessions are not established; they end immediately. Logging at session end does not trigger for sessions that never start. To log denied traffic, enable logging at session start.

Why this answer

When a security policy rule is configured with a deny action and logging is set to 'log at session end', the firewall will not generate a log entry because the session is denied immediately and never reaches a normal session end. In Palo Alto Networks firewalls, session end logging requires the session to be established and then terminate naturally; a denied session is dropped before any session state is created, so no log is generated. To capture logs for denied traffic, logging must be explicitly enabled at session start or the rule must be configured to log at session start.

Exam trap

The trap here is that candidates assume 'log at session end' will always generate a log for deny actions, not realizing that deny actions never create a session, so the session end event never occurs.

How to eliminate wrong answers

Option A is wrong because system log rate limits affect the logging subsystem's ability to write logs, but they do not prevent the firewall from generating a log entry for a denied session; logs would be dropped after generation, not suppressed entirely. Option B is wrong because the question states the rule is configured to deny traffic, and by default, deny rules in Palo Alto firewalls have logging enabled at session end; the issue is not that logging is disabled, but that the logging trigger (session end) never occurs. Option C is wrong because if a previous rule allows the traffic, the deny rule would never be evaluated, and the traffic would be permitted, not denied; the question specifies that traffic is denied, so the deny rule is being matched.

Practice this question →
20
MCQeasy

A new application is not being identified by the firewall. Traffic for the application is being treated as 'unknown-tcp'. Which action should be taken to resolve this?

A.Modify the security policy rule to allow 'unknown-tcp'.
B.Update the application and threat signatures.
C.Disable application identification on the zone.
D.Create an application override for the application.
AnswerD

An application override allows the firewall to identify traffic based on port and IP criteria, useful for custom applications.

Why this answer

When a firewall fails to identify an application and treats its traffic as 'unknown-tcp', the most direct and efficient solution is to create an application override. This manually maps the traffic (based on IP/port/protocol) to the correct application, bypassing the firewall's signature-based identification. Option D is correct because it immediately resolves the misclassification without waiting for signature updates or weakening security by broadly allowing unknown traffic.

Exam trap

The trap here is that candidates often choose 'Update the application and threat signatures' (Option B) thinking it's the standard fix, but the question implies the application is new or custom and may never be identified by signatures, making an application override the correct immediate solution.

How to eliminate wrong answers

Option A is wrong because modifying the security policy to allow 'unknown-tcp' would permit all unrecognized TCP traffic, bypassing application-level controls and creating a significant security gap. Option B is wrong because updating application and threat signatures is a reactive, long-term fix that may not immediately address the issue if the application is custom or not yet covered by Palo Alto Networks signatures. Option C is wrong because disabling application identification on the zone would turn off all application-based inspection for that zone, severely degrading security and policy enforcement, rather than solving the specific unknown-tcp classification.

Practice this question →
21
MCQhard

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

A.The traffic matched a security rule that explicitly denies it
B.A threat prevention profile detected and blocked the session
C.The traffic was blocked because the application is not allowed
D.The destination URL is categorized as prohibited
AnswerA

The log clearly indicates rule 'deny-rule' matched, causing the drop.

Why this answer

The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Exam trap

The trap here is that candidates may confuse a security rule's 'deny' action with a block caused by a security profile (like Threat Prevention or URL Filtering), but the log explicitly shows the rule matched is 'deny-rule', indicating the drop is from the rule itself, not from any profile-based inspection.

How to eliminate wrong answers

Option B is wrong because a threat prevention profile blocking a session would be logged with a different action (e.g., 'reset-both' or 'drop') and would reference a specific threat ID or vulnerability signature, not simply show a rule match of 'deny-rule'. Option C is wrong because if the application were not allowed, the firewall would typically log an 'application not allowed' or 'deny' action with a different rule match, but the log explicitly shows the rule 'deny-rule' as the matched rule, indicating the deny is due to the rule itself, not an application-based policy. Option D is wrong because URL filtering blocks would be logged with a URL filtering profile action (e.g., 'block' or 'override') and would reference a URL category, not simply show a rule match of 'deny-rule'; the log does not indicate any URL filtering profile involvement.

Practice this question →
22
MCQhard

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

A.The service 'application-default' does not match port 443; a custom service must be used.
B.The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.
C.The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.
D.SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.
AnswerB

Although not shown here, if an application-group containing 'ssl' is in a deny rule higher in the order, it would deny the traffic.

Why this answer

The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Exam trap

The trap here is that candidates assume a more specific allow rule will automatically override a broader deny rule, but PAN-OS uses first-match logic, so rule order determines the outcome, not specificity.

How to eliminate wrong answers

Option A is wrong because the service 'application-default' automatically matches the default port for the identified application (SSL uses port 443 by default), so no custom service is needed. Option C is wrong because disabling logging at session start does not affect whether traffic is allowed or denied; it only suppresses the log entry, and the session would still be permitted if the rule matched. Option D is wrong because SSL decryption is not required for the firewall to identify the application as 'ssl'; the firewall can identify SSL based on the TLS handshake without decryption, and the question states the application was correctly identified as 'ssl'.

Practice this question →
23
Multi-Selecthard

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Select 3 answers
A.Matching IKE version and encryption algorithms
B.Same firewall model
C.Same certificate authority
D.Matching proxy IDs (local/remote subnets)
E.Matching pre-shared keys or certificates
AnswersA, D, E

These are phase 1 parameters that must match.

Why this answer

IKE (Internet Key Exchange) is the protocol that establishes the security association (SA) for an IPsec VPN. Both firewalls must agree on the IKE version (v1 or v2) and the encryption algorithms (e.g., AES-256, 3DES) during Phase 1 negotiation; a mismatch will cause the tunnel to fail to establish.

Exam trap

The trap here is that candidates often assume hardware or CA compatibility is required, but the PCNSE exam tests that only IKE parameters, authentication credentials, and proxy IDs must match—not the firewall model or a shared CA.

Practice this question →
24
MCQmedium

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

A.The LDAP server certificate has expired.
B.The RADIUS server is not reachable.
C.The authentication sequence changed after upgrade.
D.The GP portal certificate is not trusted by the client.
AnswerC

Upgrades can rearrange authentication profiles or require re-selection, leading to authentication failures.

Why this answer

After upgrading the GlobalProtect portal and gateway from version 5.0 to 5.1, the authentication sequence may have been reset or changed. If the authentication profile uses LDAP but the sequence now includes a RADIUS server that is unreachable or misconfigured, the user will fail to authenticate even though the LDAP bind works from the CLI. The error 'Unable to connect to gateway' combined with authentication failure points to a change in the authentication order, not a certificate or connectivity issue.

Exam trap

The trap here is that candidates assume the LDAP bind success from the CLI confirms the entire authentication path works, but they overlook that the authentication sequence may have changed after the upgrade, causing the firewall to attempt a different method (like RADIUS) before falling back to LDAP.

How to eliminate wrong answers

Option A is wrong because an expired LDAP server certificate would not prevent the administrator from successfully binding to the LDAP server from the CLI; the CLI bind uses a simple bind or StartTLS without requiring certificate validation by the firewall. Option B is wrong because the RADIUS server not being reachable would only matter if RADIUS is part of the authentication sequence, but the question states the authentication profile uses LDAP, and the administrator can bind to LDAP successfully. Option D is wrong because the GP portal certificate not being trusted by the client would cause a certificate warning or 'untrusted server' error on the client side, not an 'Unable to connect to gateway' error with authentication failure in the firewall logs.

Practice this question →
25
MCQeasy

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

A.Configuration log
B.Traffic log
C.Threat log
D.System log
AnswerB

Traffic logs show session details including the security rule that matched.

Why this answer

The Traffic log records every session that matches a security rule, including the rule ID, source/destination IPs, ports, and action (allow/deny). To verify that a specific security rule is being hit, you must examine the Traffic log, as it shows which rule processed each session. Configuration, Threat, and System logs do not contain per-session rule match data.

Exam trap

The trap here is that candidates confuse the Traffic log with the Threat log, thinking that only malicious traffic generates logs, but the Traffic log records all allowed and denied sessions regardless of threat status.

How to eliminate wrong answers

Option A is wrong because the Configuration log records administrative changes to the firewall (e.g., rule modifications, commits), not traffic matching events. Option C is wrong because the Threat log captures intrusion prevention, antivirus, or vulnerability exploits, not standard rule hits. Option D is wrong because the System log contains system-level events (e.g., HA state changes, disk errors, license expiry), not per-session rule match information.

Practice this question →
26
MCQmedium

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

A.The security policy rule's logging setting
B.The interface management profile
C.The log retention settings
D.The system log severity level
AnswerA

The rule may have 'Log at Session End' set to 'None' instead of 'Enabled', which would suppress logs.

Why this answer

Even though the security policy rule has 'Log at Session End' enabled, logs may still not be generated if the setting is not correctly applied to the rule or if a logging profile overrides it. The engineer should verify the rule's logging configuration to ensure it is properly set and that no other rule or logging profile is suppressing the logs. Option A is correct because checking the logging setting on the rule is the first step to troubleshoot missing logs.

Exam trap

The trap here is that candidates often confuse 'Log at Session End' with other logging mechanisms (like system logs or interface management) and assume logs are generated by default for allowed traffic, when in fact they must be explicitly enabled per security policy rule.

How to eliminate wrong answers

Option B is wrong because the interface management profile controls administrative access (e.g., ping, SSH, HTTPS) to the firewall interface, not the generation of traffic logs for allowed sessions. Option C is wrong because log retention settings determine how long logs are stored (e.g., on disk or forwarded to an external collector), not whether logs are initially generated for a session. Option D is wrong because the system log severity level filters system-level events (e.g., critical, warning) sent to syslog, not the generation of traffic logs for allowed sessions, which are controlled by the security policy rule's logging configuration.

Practice this question →
27
MCQeasy

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

A.The source and destination zones in the security policy
B.The firewall's DNS settings
C.The server's SSL certificate
D.The interface management profile
AnswerA

Mismatched zones are a common reason for policy not matching traffic.

Why this answer

The most common reason for traffic failing despite a security policy allowing it is a zone mismatch. In Palo Alto Networks firewalls, security policies are zone-based, meaning the source and destination zones in the policy must exactly match the ingress and egress zones of the traffic. If the administrator configured the policy with the wrong zones (e.g., using 'trust' for the source when the client is in 'dmz'), the traffic will be denied even if all other parameters (IP, port, application) are correct.

This is the first thing to verify because it directly controls whether the policy is evaluated for the session.

Exam trap

The trap here is that candidates often jump to checking DNS or certificates (common web server issues) instead of first verifying the fundamental zone-based policy matching, which is unique to Palo Alto Networks firewalls and a frequent cause of silent traffic drops.

How to eliminate wrong answers

Option B is wrong because DNS settings on the firewall affect only the firewall's own name resolution (e.g., for FQDN objects or external services), not the ability for users to reach an internal web server; client-side DNS resolution is independent of the firewall's DNS configuration. Option C is wrong because the server's SSL certificate is irrelevant to basic connectivity; certificate issues cause browser warnings or TLS handshake failures, not a complete inability to reach the server (which would be a network-layer problem). Option D is wrong because the interface management profile controls administrative access (e.g., HTTPS, SSH, ping) to the firewall interface itself, not the forwarding of user traffic through the firewall.

Practice this question →
28
MCQeasy

A company with multiple branch offices connects to headquarters using IPSec VPN tunnels terminated on PA-220 firewalls. Users at one branch report intermittent connectivity issues when accessing critical applications hosted at HQ. Ping tests to HQ servers succeed consistently, but TCP-based applications (e.g., file transfers, web access) frequently drop connections after a few seconds, particularly when transferring large data. The VPN tunnel status shows 'active' with no rekeys. Security policies are configured to allow all required application traffic. Interface statistics show no discards or errors. Which action should be taken to resolve the issue?

A.Disable TCP checksum offloading on the clients.
B.Change the IPSec encryption algorithm from AES-256 to AES-128.
C.Increase the TCP timeout value in the security policy.
D.Reduce the MTU on the branch firewall's WAN interface to 1400.
AnswerD

MTU mismatch across VPN can cause packet fragmentation and reassembly issues, leading to drops for large packets. Reducing MTU ensures packets fit within the tunnel.

Why this answer

The symptoms—consistent pings but TCP drops on large transfers—strongly point to a Path MTU Discovery (PMTUD) failure. When the VPN tunnel encapsulates packets with IPsec headers, the effective MTU shrinks. If the WAN interface MTU remains at the default 1500, large TCP segments get fragmented or dropped, causing TCP connections to stall.

Reducing the MTU on the branch firewall's WAN interface to 1400 ensures that the total packet size (including IPsec overhead) stays within the path's physical MTU, allowing PMTUD to work correctly and preventing silent packet drops.

Exam trap

The trap here is that candidates see 'VPN tunnel active' and 'no errors' and assume the issue is application-layer or security-policy-related, overlooking the classic symptom of PMTUD failure where pings succeed (small packets) but TCP transfers fail (large packets).

How to eliminate wrong answers

Option A is wrong because disabling TCP checksum offloading on clients addresses NIC-level checksum errors, not MTU or fragmentation issues; the interface statistics show no errors, ruling out checksum problems. Option B is wrong because changing the encryption algorithm from AES-256 to AES-128 does not affect packet size or fragmentation—both add the same IPsec overhead (block size difference is negligible) and would not resolve PMTUD failures. Option C is wrong because increasing the TCP timeout in the security policy only extends how long the firewall keeps a session open without traffic; it does not fix the underlying packet loss caused by oversized packets being silently dropped.

Practice this question →
29
Multi-Selectmedium

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Select 2 answers
A.TCP sequence number mismatch due to packet reordering
B.Firewall interface speed mismatch
C.Security policy change after session creation
D.DNS resolution failure
E.Asymmetric routing
AnswersA, E

Reordering can cause the firewall to drop packets as out-of-state.

Why this answer

TCP sequence number mismatches can occur when packets are reordered, causing the firewall's TCP state engine to see an unexpected sequence number and drop the session. The firewall tracks TCP sequence numbers to validate that packets belong to an established session; if a packet arrives with a sequence number that does not match the expected window, the firewall may interpret it as a spoofed or invalid packet and terminate the session.

Exam trap

The trap here is that candidates often confuse session drops caused by policy changes (Option C) with stateful inspection issues, but Palo Alto firewalls do not retroactively apply policy changes to existing sessions unless explicitly configured to do so.

Practice this question →
30
MCQhard

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

A.Session offload is causing the packet to bypass security checks
B.The firewall is unable to resolve the destination MAC address
C.Asymmetric routing causes the firewall to drop the SYN packet
D.The destination NAT is misconfigured
AnswerC

The firewall might receive the SYN but if the return path is different, it can drop the packet or not forward it properly.

Why this answer

The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Exam trap

The trap here is that candidates often assume a security policy hit means the packet is fully allowed, but they forget that stateful inspection requires symmetric traffic flow for the TCP handshake to complete, and the firewall will drop the SYN-ACK if it arrives on a different interface or firewall.

How to eliminate wrong answers

Option A is wrong because session offload (hardware acceleration) does not bypass security checks; it offloads established session processing to hardware while still enforcing policy, and the issue occurs before the session is established. Option B is wrong because if the firewall could not resolve the destination MAC address, it would generate an ARP failure and the session would not be created at all, yet the firewall sees the session hit the rule. Option D is wrong because a misconfigured destination NAT would cause the firewall to translate the destination IP incorrectly or not at all, resulting in the server receiving the request at a wrong IP or the firewall dropping the packet due to NAT rule mismatch, but the scenario states the server does not receive the request at all, which aligns with asymmetric routing dropping the SYN-ACK before it reaches the server.

Practice this question →
31
MCQeasy

A network engineer notices that traffic from a specific subnet is being dropped by the firewall. The traffic log shows 'drop' with reason 'policy deny'. The engineer checks the security policy and confirms there is an allow rule for that subnet. What should be checked next?

A.Check the application override.
B.Check the QoS policy.
C.Check the rule order and ensure the allow rule is above any deny rules.
D.Check the NAT policy for the traffic.
AnswerC

A rule order issue is the most common cause when a policy deny occurs despite an allow rule existing.

Why this answer

When a traffic log shows 'policy deny' despite an existing allow rule, the most common cause is rule order: Palo Alto firewalls evaluate security rules from top to bottom, and the first matching rule is applied. If a deny rule appears above the allow rule for the same subnet, the deny rule will match first and drop the traffic, making it essential to verify the rule sequence.

Exam trap

The common mistake is assuming that if an allow rule exists for the subnet, it will always be applied, ignoring that Palo Alto firewalls evaluate rules top-down and a higher-priority deny rule can preempt the allow rule.

How to eliminate wrong answers

Option A is wrong because application override is used to bypass App-ID for specific traffic, not to resolve policy deny issues caused by rule order; it would not change the matching behavior of security rules. Option B is wrong because QoS policy controls bandwidth allocation and prioritization, not access control; a QoS misconfiguration would not cause a 'policy deny' log entry. Option D is wrong because NAT policy is processed after security policy matching; if traffic is denied by security policy, it never reaches the NAT stage, so checking NAT would not address the deny reason.

Practice this question →
32
MCQmedium

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

A.The application is using asymmetric routing
B.The security policy is not logging the traffic correctly
C.The firewall is not inspecting UDP traffic correctly
D.The firewall is dropping the return traffic due to a missing policy
AnswerD

The application may require responses; if the return traffic is not allowed by policy, the application breaks.

Why this answer

Even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Exam trap

The trap here is that candidates assume that because the outbound traffic is allowed and logged, the application should work, but they overlook the requirement for a return policy in stateful firewall operation, especially for UDP which is connectionless and does not have a built-in handshake like TCP.

How to eliminate wrong answers

Option A is wrong because asymmetric routing would cause the firewall to see traffic in one direction only, but the logs show the traffic is allowed, and the issue is specifically about missing return policy, not routing asymmetry. Option B is wrong because the logs correctly show the traffic as allowed, so the logging is functioning properly; the problem is that the return traffic is not logged because it is dropped by a missing policy. Option C is wrong because Palo Alto Networks firewalls inspect UDP traffic correctly by default, and the issue is not about inspection but about the absence of a security policy for the return path.

Practice this question →
33
MCQmedium

A security administrator reports that they can ping and access internal resources, but cannot access any external websites. The firewall is configured with a default route pointing to the internet router, and the NAT policy includes a source NAT rule for the internal subnet. Which step should the administrator take first to troubleshoot this issue?

A.Check the NAT rule for correct interface assignment.
B.Check the DNS proxy configuration on the firewall.
C.Review the security policy to ensure traffic from the internal zone to the external zone is allowed.
D.Verify that the default route is active by checking the routing table.
AnswerC

If internal access works but external website access fails, the most likely cause is a security policy blocking web traffic. Checking the security policy is the logical first step.

Why this answer

The administrator can ping and access internal resources but cannot reach external websites, which indicates that basic IP connectivity and internal routing are functional. Since the firewall has a default route and a source NAT rule configured, the most likely cause is that a security policy is blocking traffic from the internal zone to the external zone. In Palo Alto Networks firewalls, security policies are evaluated before NAT, so even with correct NAT and routing, traffic will be dropped if no allow rule exists for the session.

Exam trap

The trap here is that candidates often jump to checking NAT or routing first because those are common misconfigurations, but the PCNSE exam emphasizes that security policy is the first gatekeeper in the firewall's processing order, and without an allow rule, no traffic passes regardless of NAT or route correctness.

How to eliminate wrong answers

Option A is wrong because the NAT rule's interface assignment is less likely the issue when internal resources are accessible and the default route exists; NAT policy is applied after security policy, and a misconfigured interface would typically cause asymmetric routing or NAT failures, not a complete block of external access. Option B is wrong because DNS proxy configuration affects name resolution, not the ability to reach external websites via IP; if the user can ping external IPs (not tested here), DNS would be the next step, but the symptom is no external access at all, suggesting a policy block. Option D is wrong because the default route is already implied to be present (the firewall is configured with one), and the administrator can ping internal resources, so the routing table is likely correct; checking the route is a secondary step after verifying security policy.

Practice this question →
34
Multi-Selecthard

Which THREE components should be verified when troubleshooting a site-to-site IPSec VPN that is not coming up?

Select 3 answers
A.Zone protection profile on the untrust zone
B.Interface management profile on the external interface
C.Pre-shared key configuration on both ends
D.Peer IP address in the tunnel interface configuration
E.IKE version (v1 vs v2) compatibility
AnswersC, D, E

Mismatched PSK will prevent IKE authentication.

Why this answer

The pre-shared key (PSK) must match exactly on both VPN peers. If the PSK differs, IKE Phase 1 authentication fails, preventing the tunnel from establishing. This is a fundamental requirement for both IKEv1 and IKEv2, as the PSK is used to generate authentication keys during the main or aggressive mode exchange.

Exam trap

The trap here is that candidates often confuse zone protection profiles or interface management profiles with VPN-related security settings, but these profiles only affect data-plane or management-plane traffic, not the control-plane IKE negotiation required for tunnel establishment.

Practice this question →
35
MCQmedium

Refer to the exhibit. The session is in FIN_WAIT state. What does this indicate about the TCP connection?

A.The connection is actively transferring data
B.The firewall has closed the connection and is waiting for the client or server to finish
C.The connection has timed out and is being removed
D.The firewall is waiting for a SYN-ACK from the destination
AnswerB

FIN_WAIT means the firewall initiated the close and is waiting for final packets.

Why this answer

The FIN_WAIT state indicates that the firewall has sent a FIN packet to close its side of the TCP connection and is now waiting for the corresponding FIN acknowledgment (ACK) from the remote endpoint. This is a normal part of the TCP connection termination process, where the firewall initiates the close and waits for the peer to finish sending data and acknowledge the closure.

Exam trap

The PCNSE exam often tests the misconception that FIN_WAIT indicates active data transfer or a timeout, when in fact it is a normal intermediate state in the graceful TCP teardown process initiated by the firewall.

How to eliminate wrong answers

Option A is wrong because FIN_WAIT is part of the TCP teardown process, not active data transfer; data transfer occurs in ESTABLISHED state. Option C is wrong because a timed-out connection would transition to CLOSED or be removed from the session table, not remain in FIN_WAIT. Option D is wrong because waiting for a SYN-ACK occurs during the three-way handshake in SYN_SENT state, not during connection termination.

Practice this question →
36
MCQhard

A Panorama-managed firewall is not sending logs to Panorama. The firewall is operational and policies are being pushed successfully. Which of the following is the most likely cause?

A.The security policy rules do not have a Log Forwarding profile applied.
B.The Panorama collector group is not configured correctly.
C.The firewall's management interface is not reachable from Panorama.
D.The log buffer on the firewall is full.
AnswerA

Without a Log Forwarding profile, logs are not sent to Panorama; they remain local.

Why this answer

The firewall is operational and policies are being pushed successfully, indicating that Panorama management connectivity is intact. Logs are generated only when a security policy rule matches traffic, and by default, logs are not sent to Panorama unless a Log Forwarding profile is explicitly applied to the rule. Without this profile, the firewall does not forward logs to the Panorama collector, even though the rule is enforced.

Exam trap

The trap here is that candidates assume log forwarding is automatic once Panorama is configured, overlooking the requirement to attach a Log Forwarding profile to each security rule that should generate forwarded logs.

How to eliminate wrong answers

Option B is wrong because if the collector group were misconfigured, the firewall would still attempt to send logs but would fail; the question states logs are not being sent, implying no attempt is made. Option C is wrong because the firewall is operational and policies are pushed successfully, which requires management interface reachability from Panorama. Option D is wrong because a full log buffer would cause log loss or overwriting, but the firewall would still attempt to send logs to Panorama; the issue here is that logs are not being sent at all.

Practice this question →
37
MCQhard

A large enterprise uses a PA-5250 as a perimeter firewall with multiple virtual systems (vsys). One vsys is for the DMZ, and it is logging high amounts of dropped traffic. The administrator notices that the firewall's dataplane CPU is consistently above 80%. The logs show many 'application-id timeout' drops. The DMZ hosts are running custom applications on non-standard ports. What is the first step to mitigate the issue?

A.Disable application identification for the DMZ zone.
B.Reduce the number of security rules in the DMZ.
C.Use a custom application signature for the custom applications.
D.Increase the application identification timeout for the custom applications.
AnswerC

Custom app signatures allow the firewall to identify traffic without deep packet inspection, reducing CPU.

Why this answer

Creating custom application signatures reduces the need for heuristic analysis of unknown traffic, lowering CPU load.

Practice this question →
38
MCQmedium

During a troubleshooting session, a user reports that they cannot access an internal web server through the firewall's public IP. The firewall is configured with destination NAT. The engineer checks the NAT policy and sees the rule is active. What should be the next step to verify the NAT is functioning correctly?

A.Check the session table to see if the NAT translation is occurring.
B.Check the application dependency.
C.Check the security policy for the post-NAT zone.
D.Check the routing table for the destination.
AnswerA

The session table shows the original and translated IPs, confirming NAT is working.

Why this answer

Checking the session table (e.g., using 'show session all' or 'show session id <id>') directly confirms whether the destination NAT (DNAT) translation is being applied to the traffic. If the session shows the original destination IP being translated to the internal server's IP, the NAT rule is functioning; if not, the issue lies elsewhere (e.g., policy order, matching conditions). This is the most immediate and definitive verification step in a Palo Alto Networks firewall.

Exam trap

The trap here is that candidates often jump to checking security policies or routing first, forgetting that the session table provides the most direct evidence of whether the NAT translation is actually being applied to the traffic.

How to eliminate wrong answers

Option B is wrong because application dependency checks are relevant for App-ID or SSL decryption issues, not for verifying whether a NAT translation is occurring. Option C is wrong because checking the security policy for the post-NAT zone is a subsequent step after confirming NAT is working; the security policy uses the post-NAT zone, but verifying NAT itself requires looking at the session table first. Option D is wrong because checking the routing table for the destination is relevant for routing issues (e.g., next-hop reachability), but does not confirm whether the NAT translation is actually being performed on the traffic.

Practice this question →
39
MCQeasy

A healthcare organization recently replaced their primary internet circuit and changed the next-hop IP for the default route from 203.0.113.1 to 198.51.100.1. After the change, all internet traffic is failing. The firewall is a PA-220 running PAN-OS 9.1. The administrator verifies that the new default route is present in the virtual router and that the security policies are unchanged. The IP address configuration on the ethernet interface is correct and the link is up. When pinging 8.8.8.8 from the firewall's management interface, it succeeds. But traffic from internal hosts fails. The traffic log shows 'drop' with reason 'route - no route to host'. What is the most likely cause?

A.The default route is not in the same virtual router as the internal zones.
B.The new internet circuit does not allow ICMP.
C.The internal hosts have incorrect DNS settings.
D.The ARP table for the gateway is stale.
AnswerA

If internal zones are in a different VR, traffic from them cannot use the default route, resulting in no route to host.

Why this answer

The traffic log shows 'route - no route to host', which indicates the firewall cannot find a valid path for the traffic. Even though the default route is present in the virtual router, if the internal zones (e.g., trust zone) are in a different virtual router than the one containing the default route, the firewall will not use that default route for traffic from those zones. Each virtual router maintains its own routing table, and inter-virtual-router routing requires explicit route leaking or redistribution.

Exam trap

The trap here is that candidates assume a default route in any virtual router applies globally, but PAN-OS enforces strict virtual router isolation per zone, so the route must be in the same virtual router as the source zone's interface.

How to eliminate wrong answers

Option B is wrong because ICMP blocking would cause ping failures but the log shows a routing error, not an ICMP-specific drop; the firewall would still attempt to route the packet and drop it with a different reason if ICMP were blocked. Option C is wrong because incorrect DNS settings would cause name resolution failures, not a 'no route to host' drop; the traffic log indicates the packet is being dropped at the routing layer before any DNS lookup occurs. Option D is wrong because a stale ARP entry would cause a different drop reason (e.g., 'arp - no ARP entry') or a timeout, not 'route - no route to host'; the firewall would still have a route but fail to resolve the next-hop MAC.

Practice this question →
40
MCQhard

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

A.The portal service is not running
B.The portal's IP address is not routable from the internet
C.The portal certificate's subject name does not match the portal URL
D.The client does not trust the certificate authority that signed the portal certificate
AnswerD

The TLS handshake fails because the client cannot verify the server certificate.

Why this answer

The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Exam trap

The trap here is that candidates often confuse a certificate name mismatch (subject name vs. URL) with a trust issue, but the 'TLS handshake failed' log entry specifically points to a failure in the certificate chain validation, not a name mismatch, which would produce a different error or warning.

How to eliminate wrong answers

Option A is wrong because if the portal service were not running, the connection would fail at a lower level (e.g., TCP connection refused or timeout), not specifically with a 'TLS handshake failed' log entry. Option B is wrong because the scenario explicitly states that users can reach the portal's IP address from the internet, so the IP is routable and connectivity exists. Option C is wrong because a subject name mismatch would typically cause a browser warning or a 'certificate name mismatch' error, not a generic 'TLS handshake failed' log entry; the TLS handshake can still complete if the client trusts the CA, even if the name doesn't match, though the client may then disconnect.

Practice this question →
41
MCQmedium

A remote user is unable to connect to the GlobalProtect gateway. The user's client shows 'Connecting' but never establishes a tunnel. The firewall shows no drops in the GlobalProtect logs. Which of the following should be checked first?

A.Verify that the GlobalProtect portal is reachable from the internet.
B.Check if the user's authentication credentials are correct.
C.Confirm that the user's client is on the same subnet as the gateway.
D.Ensure the gateway's certificate is trusted by the client machine.
AnswerD

If the client does not trust the gateway certificate, the SSL handshake fails and the connection never establishes.

Why this answer

When the GlobalProtect client shows 'Connecting' but never establishes a tunnel, and the firewall logs show no drops, the issue is likely a certificate trust failure during the TLS handshake. The gateway's certificate must be trusted by the client machine (e.g., via a trusted root CA or imported certificate), otherwise the client cannot validate the gateway and will hang at 'Connecting' without generating a log drop on the firewall.

Exam trap

The trap here is that candidates assume 'Connecting' means a network or authentication issue, but the key clue is the absence of drops in the GlobalProtect logs, which points to a pre-authentication TLS failure rather than a firewall policy or credential problem.

How to eliminate wrong answers

Option A is wrong because if the portal were unreachable, the client would typically show 'No Portal' or 'Cannot connect to portal', not 'Connecting' indefinitely; the question states the client shows 'Connecting', implying network reachability is not the primary issue. Option B is wrong because authentication credentials are checked after the tunnel is established; the client never gets to that stage if it cannot complete the TLS handshake. Option C is wrong because the client does not need to be on the same subnet as the gateway; GlobalProtect is designed for remote access across different subnets or the internet, and being on the same subnet would be irrelevant for a remote user.

Practice this question →
42
MCQeasy

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

A.show running nat-policy
B.show session all filter source 10.1.1.100
C.show nat rule
D.show address 10.1.1.100
AnswerB

This command displays all active sessions from the specified source, including NAT source and destination translations.

Why this answer

The 'show session all filter source 10.1.1.100' command displays active sessions in the firewall's session table, including the source IP, destination IP, and the translated (NAT) IP addresses. This allows the administrator to verify whether the internal IP 10.1.1.100 is being NATed to a public IP when accessing the internet, as the session table shows both the pre-NAT and post-NAT source addresses.

Exam trap

The trap here is that candidates confuse viewing NAT policy configuration (which shows rules) with viewing active NAT translations (which requires session table inspection), leading them to pick 'show running nat-policy' instead of the session-based command.

How to eliminate wrong answers

Option A is wrong because 'show running nat-policy' displays the configured NAT policy rules, not the active translations or sessions; it shows what should happen, not what is currently happening. Option C is wrong because 'show nat rule' is not a valid CLI command on Palo Alto Networks firewalls; the correct command for viewing NAT rules is 'show running nat-policy' or 'show nat-policy'. Option D is wrong because 'show address 10.1.1.100' is not a valid command; the correct command to view address objects is 'show address' or 'show address-group', and it does not show translation or session information.

Practice this question →
43
MCQhard

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

A.The firewall's App-ID identified the traffic as a different application than the one specified in the rule
B.The application is not recognized by the firewall and is treated as unknown
C.The security rule is not configured to allow any application
D.The firewall's SSL decryption is misconfigured
AnswerA

The firewall uses App-ID to identify traffic; if the application detected does not match the rule's allowed application, the session is denied.

Why this answer

The 'application mismatch' log reason indicates that the firewall's App-ID engine identified the traffic as a different application than the one specified in the security rule. Even though the rule allows the application you intended, the actual traffic does not match that App-ID signature, so the session is denied. This is a common scenario when the application classification does not align with the rule's application object.

Exam trap

The trap here is that candidates often assume 'application mismatch' means the application is unknown or unsupported, but it specifically means the traffic was identified as a different application than what the rule expects, highlighting the importance of verifying App-ID results versus rule configuration.

How to eliminate wrong answers

Option B is wrong because 'application mismatch' is a specific denial reason that occurs when the traffic is recognized but as a different application, not when it is unknown (unknown traffic would show 'unknown-tcp' or 'incomplete' App-ID). Option C is wrong because the scenario explicitly states the security policy allows the application, so the rule is configured to allow an application; the issue is a mismatch, not a missing 'any' application. Option D is wrong because SSL decryption misconfiguration would cause decryption errors or 'ssl-decrypt' related drops, not an 'application mismatch' denial; App-ID can still match encrypted traffic based on metadata or SNI.

Practice this question →
44
MCQeasy

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

A.Disable URL filtering on the existing security rule
B.Check the user-ID mapping to ensure the user is authenticated
C.Create a new security rule allowing the user's IP to any
D.Add the URL to an allow list in the URL filtering profile
AnswerD

This allows the specific URL while keeping the profile active.

Why this answer

The traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Exam trap

The trap here is that candidates may assume disabling URL filtering entirely (Option A) is the quickest fix, but the PCNSE exam tests the understanding that URL filtering profiles should be modified granularly using allow/block lists rather than disabling the feature completely.

How to eliminate wrong answers

Option A is wrong because disabling URL filtering on the existing security rule would remove all URL-based controls for that rule, potentially exposing the network to malicious or inappropriate websites, which is an overreaction to a single blocked URL. Option B is wrong because the user-ID mapping is irrelevant to a URL filtering block; URL filtering decisions are based on the URL category or list, not user authentication status, and the traffic log already shows the session is denied due to URL filtering, not authentication. Option C is wrong because creating a new security rule allowing the user's IP to any would bypass all security policies, including URL filtering, but it is an insecure and overly permissive solution that ignores the specific URL filtering block and could allow unrestricted access to any destination.

Practice this question →
45
MCQhard

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

A.The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.
B.The firewall's decryption policy is set to 'no-decrypt' for the application.
C.The firewall's internet link experiences periodic packet loss.
D.The SaaS application's certificate is expired or revoked.
AnswerA

SSL/TLS version mismatch can cause intermittent failures; the firewall may attempt a higher version than the server supports.

Why this answer

In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.

Exam trap

The trap here is that candidates assume intermittent issues must be caused by network problems like packet loss (Option C) or policy misconfigurations (Option B), but the key clue is 'no drops or errors' on the firewall, pointing to a higher-layer TLS negotiation mismatch that does not generate firewall-level drops.

How to eliminate wrong answers

Option B is wrong because if the decryption policy were set to 'no-decrypt' for the application, the firewall would simply pass the traffic through without decryption, which would not cause intermittent connectivity issues—it would either work or not based on the application's certificate handling. Option C is wrong because periodic packet loss on the internet link would typically result in drops or errors visible in the firewall's logs or counters, and the question explicitly states the firewall shows no drops or errors. Option D is wrong because an expired or revoked certificate would cause a consistent failure (e.g., a certificate error or block) rather than intermittent connectivity, and the firewall would likely log a certificate validation error.

Practice this question →
46
MCQmedium

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

A.The security policy rule does not have logging enabled at session end.
B.SSL decryption is enabled but the website certificate is untrusted.
C.A DoS protection profile is configured on the zone and is rate-limiting the user's IP.
D.A URL Filtering profile is applied to the rule and is blocking the website's URL category.
AnswerD

URL Filtering profiles can override application-level allowances by blocking specific URL categories, causing the session to be dropped.

Why this answer

A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.

Exam trap

The trap here is that candidates assume 'web-browsing' allowed means all web traffic is permitted, overlooking that URL Filtering profiles can block specific URLs or categories even when the application is allowed.

How to eliminate wrong answers

Option A is wrong because logging at session end does not affect traffic forwarding; it only controls whether session logs are generated. Option B is wrong because if SSL decryption is enabled and the certificate is untrusted, the firewall typically presents a block page or generates a warning, but the session is not silently dropped; the user would see a certificate error, not a drop. Option C is wrong because a DoS protection profile rate-limits traffic based on thresholds (e.g., max sessions per source IP), but the user reports a single website issue, not general connectivity problems, and rate-limiting would cause intermittent drops or delays, not a consistent block for one specific site.

Practice this question →
47
MCQmedium

After upgrading a PA-5250, the firewall is not passing traffic. The administrator checks the dataplane CPU utilization and sees it is at 100%. Which command should be run to identify the cause?

A.show session all
B.show system resources dataplane
C.show counter global
D.show running resource-monitor
AnswerB

This command displays dataplane CPU and memory, helping identify the bottleneck.

Why this answer

The 'show system resources dataplane' command displays detailed CPU utilization per dataplane core, which is critical for identifying whether a single core is maxed out (e.g., due to a traffic storm or a specific session) or if the load is evenly distributed. In a PA-5250, the dataplane handles packet forwarding; 100% CPU indicates the dataplane is overwhelmed, and this command pinpoints the exact core(s) under stress, guiding further investigation into the root cause.

Exam trap

The trap here is that candidates often confuse 'show system resources dataplane' with 'show running resource-monitor' (which is for management-plane resource thresholds) or assume 'show session all' will reveal CPU overload, but session counts alone do not indicate CPU saturation.

How to eliminate wrong answers

Option A is wrong because 'show session all' lists all active sessions but does not provide CPU utilization data; it would not help identify why the dataplane CPU is at 100%. Option C is wrong because 'show counter global' displays global packet and byte counters for troubleshooting drops or errors, not CPU usage per core. Option D is wrong because 'show running resource-monitor' shows resource protection thresholds and current usage for management-plane resources, not dataplane CPU core utilization.

Practice this question →
48
Multi-Selecteasy

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Select 2 answers
A.Reboot the firewall
B.Change the interface IP address
C.Verify the security policy order
D.Check the session table for the traffic
E.Update the threat prevention signature
AnswersC, D

Misplaced rules can cause traffic to be denied or not matched.

Why this answer

Security policy order determines which rule matches traffic first; if a policy is misordered or a deny rule precedes an allow rule, traffic will be blocked. Verifying policy order ensures that the intended allow rule is evaluated before any conflicting deny rules, which is a fundamental step in troubleshooting traffic flow on a Palo Alto Networks firewall.

Exam trap

The trap here is that candidates often assume rebooting or updating signatures will fix traffic issues, but these actions do not address the most common causes like policy misordering or session state problems, which are directly verifiable through the session table and policy order review.

Practice this question →
49
Multi-Selecteasy

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Select 2 answers
A.show system info
B.show vpn ike-sa
C.show routing route
D.show vpn ipsec-sa
E.show interface all
AnswersB, D

This shows the IKE security associations.

Why this answer

'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often confuse general network commands (like routing or interface status) with VPN-specific commands, assuming that a working route or interface implies a functional IPSec tunnel, when in fact the tunnel may be down due to IKE or IPSec SA failures.

Practice this question →
50
MCQhard

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

A.Heartbeat interface down
B.Firmware version mismatch (one firewall is on 10.1.4)
C.Management IP mismatch
D.License mismatch
AnswerB

HA requires exact PAN-OS version match. Even a minor patch difference can cause synchronization failure.

Why this answer

In an active/passive HA pair, both firewalls must run the same PAN-OS version to form a healthy HA connection. If one firewall is on 10.1.5 and the other on 10.1.4, the passive firewall will show a 'non-functioning' state because the HA configuration synchronization and keepalive mechanisms detect a version mismatch, preventing the HA pair from establishing correctly.

Exam trap

The trap here is that candidates often assume a heartbeat failure or license issue causes the 'non-functioning' state, but the specific PAN-OS version mismatch is the only condition that directly triggers this exact HA state in an active/passive pair.

How to eliminate wrong answers

Option A is wrong because a heartbeat interface down would typically cause the passive firewall to show a 'suspended' or 'down' state, not 'non-functioning', and the HA pair would attempt to use alternate paths or fail to form, but the specific 'non-functioning' state is not directly tied to a heartbeat failure. Option C is wrong because a management IP mismatch does not affect HA state; HA uses dedicated HA interfaces and IPs for control and data synchronization, not the management IP, so the passive firewall would still show a healthy state if other conditions are met. Option D is wrong because license mismatches do not cause a 'non-functioning' HA state; they may generate warnings or prevent certain features from working, but the HA pair itself will form and show active/passive states correctly as long as the PAN-OS versions match and HA configuration is valid.

Practice this question →
51
MCQhard

A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?

A.The gateway's interface is not in the same subnet as the IP pool
B.The GlobalProtect client is outdated
C.The LDAP authentication profile is misconfigured
D.The client certificate is not trusted by the gateway
AnswerA

GlobalProtect gateway requires the IP pool to be on the same subnet as the gateway's interface for proper routing.

Why this answer

The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.

Exam trap

The trap here is that candidates assume IP pool assignment is independent of the gateway's interface subnet, but the gateway must have a directly connected route to the pool range for the tunnel to establish.

How to eliminate wrong answers

Option B is wrong because an outdated client would typically cause connection or feature issues, not a failure to assign an IP address after successful authentication. Option C is wrong because the LDAP authentication profile is confirmed working—the user authenticates successfully—so the issue lies after authentication. Option D is wrong because client certificate trust is not relevant here; the gateway is using LDAP authentication, not certificate-based authentication, and the client successfully connects to the portal.

Practice this question →
52
MCQeasy

Refer to the exhibit. A firewall system log contains a critical license expiration entry for URL Filtering. What will happen to URL Filtering functionality?

A.The firewall will stop passing traffic until the license is renewed.
B.URL Filtering will stop working immediately until a new license is installed.
C.URL Filtering will continue to use the last downloaded URL database but will not receive updates.
D.The firewall will automatically fall back to a basic URL category list.
AnswerC

Licensed features continue to function with the last downloaded data when the license expires.

Why this answer

When a URL Filtering license expires on a Palo Alto Networks firewall, the device does not immediately disable the feature. Instead, it continues to use the last downloaded URL database to categorize URLs, but it will no longer receive periodic database updates from the Palo Alto Networks update server. This ensures that existing traffic policies based on URL categories remain functional, though new or changed URLs may not be accurately categorized until the license is renewed.

Exam trap

A common misconception is that license expiration immediately disables the associated feature, but Palo Alto Networks firewalls are designed to continue using the last known good data to maintain operational continuity until the license is renewed.

How to eliminate wrong answers

Option A is wrong because the firewall does not stop passing all traffic; only the URL Filtering update mechanism is affected, and traffic continues to flow based on existing policies. Option B is wrong because URL Filtering does not stop working immediately; the last downloaded database remains active and continues to be used for URL categorization. Option D is wrong because the firewall does not automatically fall back to a basic URL category list; it retains the full, last-downloaded database without any automatic downgrade to a simpler list.

Practice this question →
53
Multi-Selectmedium

A security administrator is trying to isolate a performance issue on a PA-3220. Which two commands provide real-time information about the dataplane performance? (Choose two.)

Select 2 answers
A.show system resources dataplane
B.show counter global
C.show running resource-monitor
D.show session info
E.show job all
AnswersA, C

This command displays dataplane-specific resource statistics in real time.

Why this answer

'show system resources dataplane' displays real-time CPU and memory utilization specifically for the dataplane, which directly impacts packet processing performance. Option C is correct because 'show running resource-monitor' provides live counters for dataplane resource usage, including session utilization and flow table capacity, helping isolate performance bottlenecks.

Exam trap

The PCNSE exam often tests the distinction between control-plane and dataplane commands, and the trap here is that candidates mistake 'show counter global' for a performance command when it actually shows traffic statistics, not resource utilization.

Practice this question →
54
MCQhard

An administrator is troubleshooting VPN tunnel flapping. The logs show multiple Phase 2 rekeys. The tunnel uses IKEv2 with pre-shared key. What is the most likely cause?

A.Mismatched IKE version.
B.Dead Peer Detection (DPD) interval too long.
C.The rekey time settings are too short.
D.Incorrect local or peer ID.
AnswerC

Short rekey intervals cause the tunnel to renegotiate frequently, leading to flapping.

Why this answer

Frequent Phase 2 rekeys indicate that the IPsec security associations (SAs) are being renegotiated too often. With IKEv2, the rekey time settings (e.g., lifetime seconds or kilobytes) control how long a Phase 2 SA remains active before it must be refreshed. If these values are set too short, the tunnel will flap as SAs are constantly re-established, causing intermittent connectivity.

Exam trap

The trap here is that candidates often confuse rekey flapping with DPD or misconfiguration issues, but the specific log entry of 'multiple Phase 2 rekeys' directly points to the SA lifetime being too short, not to peer reachability or identity problems.

How to eliminate wrong answers

Option A is wrong because IKEv2 is explicitly specified in the scenario, and a mismatched IKE version would prevent Phase 2 establishment entirely, not cause flapping after initial setup. Option B is wrong because a DPD interval that is too long would delay detection of a dead peer, potentially causing the tunnel to stay up longer, not trigger frequent rekeys; a too-short DPD interval could cause false timeouts, but the logs show Phase 2 rekeys, not DPD-related failures. Option D is wrong because incorrect local or peer ID would typically cause authentication or identity validation failures during Phase 1 or Phase 2, leading to a complete failure to establish the tunnel, not repeated rekeys of an already-established SA.

Practice this question →
55
Multi-Selecthard

An engineer is troubleshooting a scenario where traffic from a specific source IP is not being logged although the security policy log setting is set to 'log at session end'. Which three conditions could prevent logging for that traffic? (Choose three.)

Select 3 answers
A.The traffic is denied by a rule that has logging disabled.
B.The source IP is in a global log filtering exclusion.
C.The session is terminated before session end (e.g., reset).
D.The traffic matches a rule with 'log at session start' only.
E.The firewall is exceeding its log rate capacity.
AnswersA, C, E

If the denying rule has no logging configured, no log is generated.

Why this answer

If a security policy rule denies traffic and has logging disabled, no log entry is generated even if the rule is configured to log at session end. The firewall only logs traffic that matches a rule with logging enabled; if logging is disabled for the deny rule, the session is silently dropped without any log record.

Exam trap

The trap here is that candidates often assume 'log at session end' always generates a log, but they overlook that session termination events (like resets) or log rate capacity exhaustion can prevent the log from being written, and that deny rules with logging disabled will never produce a log regardless of the policy setting.

Practice this question →
56
MCQeasy

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

A.Check the security policy rulebase order and matching
B.Verify the user-ID agent is mapping the IP correctly
C.Check the service configuration for the destination port
D.Check the NAT configuration for the user's subnet
AnswerA

The traffic might be matching a deny rule placed before the allow rule.

Why this answer

The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Exam trap

The trap here is that candidates often jump to NAT or service configuration issues, but the PCNSE exam emphasizes that rule order and first-match logic are the most common root cause of unexpected blocks, especially when a seemingly correct allow rule exists.

How to eliminate wrong answers

Option B is wrong because verifying the User-ID agent mapping is only relevant if the security policy uses user-based criteria (e.g., source user), but the rule in question is based on source IP (subnet 10.1.1.0/24), not user identity. Option C is wrong because checking the service configuration for the destination port is secondary; if the rule is not matched due to order, service configuration is irrelevant until the correct rule is identified. Option D is wrong because NAT configuration affects the translated IP address, not the pre-NAT source IP used for policy matching; the firewall applies security policy before NAT, so NAT issues would not cause the traffic to be blocked by a policy that matches the original source IP.

Practice this question →
57
Multi-Selecthard

Based on the exhibit, which THREE conclusions can be drawn?

Select 3 answers
A.The session was matched by the security rule 'allow-ssl'.
B.The source NAT is not translating the source IP.
C.The traffic is using UDP protocol.
D.The session is in an active state.
E.The session is destined for a public IP address.
AnswersA, D, E

Both Policy ID and Rule show 'allow-ssl'.

Why this answer

The exhibit shows the session matched the security rule 'allow-ssl', which is explicitly listed in the session details. This indicates that the firewall applied this rule to permit the traffic, confirming the session was matched by that specific security rule.

Exam trap

The trap here is that candidates may confuse the protocol field (TCP vs. UDP) or assume NAT is not translating based on a quick glance at the source IP, without verifying the translated IP column or NAT rule details.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Troubleshoot questions.

Start 20-question session