Knowledge + Practice

Palo Alto Networks Certified Network Security Administrator PCNSA (PCNSA) — Questions 1–75

524 questions total · 7pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 7

1

MCQeasy

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

A.SSL Forward Proxy

B.Inbound Inspection

C.SSH Proxy

D.Decryption Mirror

AnswerC

SSH Proxy is designed to decrypt SSH traffic.

Why this answer

SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Exam trap

The trap here is that candidates confuse SSH decryption with SSL decryption and select 'SSL Forward Proxy' because they assume all encrypted traffic is handled by the same mechanism, but SSH uses a completely different protocol and requires a dedicated SSH proxy.

How to eliminate wrong answers

Option A is wrong because SSL Forward Proxy is designed to decrypt SSL/TLS traffic (HTTPS), not SSH traffic, which uses a different encryption protocol and port 22. Option B is wrong because Inbound Inspection is a general traffic inspection policy, not a specific decryption method; it does not inherently decrypt SSH or any encrypted protocol. Option D is wrong because Decryption Mirror is a passive monitoring feature that copies traffic to an external tool for analysis, but it does not perform active decryption of SSH sessions.

Full explanation →

2

Matchingmedium

Match each firewall deployment mode to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Passively monitors traffic without blocking

Transparent layer 2 deployment

Routable mode with IP addresses

Failover configuration with one standby unit

Why these pairings

These are common firewall deployment modes.

Full explanation →

3

MCQhard

Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?

A.The tag is misspelled

B.The dynamic group requires a commit after adding the object

C.The address object is not tagged

D.The group match type is 'all' not 'any'

AnswerB

A commit is necessary for the dynamic group to reflect the new member.

Why this answer

In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.

Exam trap

The trap here is that candidates assume dynamic groups update instantly when an object is tagged, overlooking the mandatory commit step required to synchronize the candidate configuration with the active running configuration.

How to eliminate wrong answers

Option A is wrong because the tag is correctly applied as 'database' and the question states it is tagged with 'database', so a misspelling is not indicated. Option C is wrong because the address object is explicitly tagged with 'database' as stated in the scenario, so the object is indeed tagged. Option D is wrong because the group match type being 'all' or 'any' affects whether all tags must match or any tag can match, but it does not prevent a correctly tagged object from appearing; the issue is the lack of commit, not the match logic.

Full explanation →

4

MCQhard

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

A.The group automatically updates and removes the IP address.

B.The group retains the IP address until manually removed.

C.The group is deleted.

D.The group requires a commit to update.

AnswerA

Dynamic groups reflect tag changes in real-time.

Why this answer

Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Full explanation →

5

MCQhard

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

A.Change the service to TCP/443 and allow all applications

B.Remove the URL Filtering profile from the security rule

C.Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block

D.Change the URL Filtering action for 'hacking' category to 'allow'

AnswerC

URL Filtering profiles support override rules to allow or block specific URLs with higher priority.

Why this answer

Option C is correct because placing an override rule for the specific URL above the category block rule allows fine-grained control. Option A is wrong because disabling URL Filtering altogether removes protection. Option B is wrong because changing action to 'allow' on the existing rule would allow all hacking sites.

Option D is wrong because using a different service does not bypass URL filtering.

Full explanation →

6

MCQhard

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

A.The rule must have at least one security profile attached.

B.The firewall must have a valid support license.

C.The rule must have logging disabled.

D.The rule must be in the top 10 rules by hit count.

AnswerB

Policy Optimizer is a licensed feature.

Why this answer

Option C is correct because Policy Optimizer requires a valid support license. Options A, B, and D are not prerequisites.

Full explanation →

7

MCQmedium

A company has two Palo Alto Networks firewalls in active/passive HA. The passive firewall failed and was replaced with a new unit. The network administrator initiates a configuration sync from the active to the new passive. After the sync, the passive unit shows as 'Active' instead of 'Passive'. What is the most likely cause?

A.The HA link is misconfigured on both units.

B.The passive unit's HA configuration was set to 'Stateful Inspection' instead of 'Passive'.

C.The active firewall's HA settings were missing the new device's serial number.

D.The passive unit had a different version of Panorama template.

AnswerC

Missing serial number prevents authentication, causing passive to become active.

Why this answer

Option C is correct because in an active/passive HA pair, the active firewall maintains a list of allowed peer serial numbers. If the new passive unit's serial number is not included in the active firewall's HA configuration, the active will not recognize the passive as a valid peer. Consequently, the passive unit, lacking a proper HA heartbeat from the active, will assume the active role (become 'Active') due to a loss of the HA link or misidentification, as it defaults to active state when it cannot establish a proper HA relationship.

Exam trap

The trap here is that candidates often assume a configuration sync will automatically update the peer serial number or that the HA role is determined solely by the 'device priority' setting, overlooking the explicit serial number validation required for HA peer authentication.

How to eliminate wrong answers

Option A is wrong because a misconfigured HA link (e.g., incorrect IP addresses or subnet masks on the HA control/data interfaces) would prevent the units from communicating, but it would not specifically cause the passive to become 'Active'—both units would likely show as 'Active' or 'Non-Functional' due to loss of heartbeat, not a targeted role flip. Option B is wrong because 'Stateful Inspection' is not an HA role setting; HA roles are 'Active' or 'Passive', and 'Stateful Inspection' refers to a firewall feature for session tracking, not an HA configuration option. Option D is wrong because Panorama template version differences affect policy and object synchronization, not the HA state or role election; the HA state is determined by local HA configuration and peer serial number validation, not Panorama templates.

Full explanation →

8

MCQhard

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

A.Use Panorama

B.Use CLI scripts

C.Use a dedicated management server

D.Use SNMP

AnswerA

Panorama is designed for centralized management.

Why this answer

Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Exam trap

The trap here is that candidates often confuse centralized management with generic monitoring tools like SNMP or assume any dedicated server can replace Panorama, but only Panorama provides the full suite of centralized policy management, log collection, and device orchestration specific to Palo Alto firewalls.

How to eliminate wrong answers

Option B is wrong because CLI scripts are used for automation on individual firewalls but lack centralized visibility, log aggregation, and policy conflict detection that Panorama provides. Option C is wrong because a dedicated management server is a generic concept; Palo Alto Networks specifically requires Panorama (physical or virtual appliance) for centralized management, not any generic server. Option D is wrong because SNMP is a monitoring protocol for reading device statistics and sending traps, not for managing firewall policies or configurations centrally.

Full explanation →

9

MCQeasy

A company has a PA-5250 firewall with 10 Gbps threat prevention throughput. They are planning to enable SSL decryption for all traffic. What is the most likely impact on the firewall's throughput?

A.Throughput will decrease, typically by 30-50% depending on traffic.

B.Throughput will remain the same because the firewall uses dedicated hardware.

C.Throughput will increase due to offloading encryption to hardware.

D.Throughput will decrease only if decryption is applied to video traffic.

AnswerA

Decryption consumes CPU resources, reducing throughput.

Why this answer

SSL decryption requires the firewall to intercept, decrypt, inspect, and re-encrypt traffic. This process is computationally intensive, especially for high-throughput environments. Even with dedicated hardware, the PA-5250's threat prevention throughput is rated without decryption; enabling it typically reduces throughput by 30-50% due to the overhead of cryptographic operations and deep packet inspection on decrypted content.

Exam trap

The trap here is that candidates assume dedicated hardware offloads all encryption overhead, ignoring that SSL decryption requires additional processing for inspection and re-encryption, which reduces overall throughput even with hardware acceleration.

How to eliminate wrong answers

Option B is wrong because while the PA-5250 uses dedicated hardware (e.g., DP processors), SSL decryption still imposes significant CPU and memory overhead for key exchange, certificate validation, and encryption/decryption, so throughput does not remain the same. Option C is wrong because offloading encryption to hardware reduces the overhead of encryption/decryption but does not increase throughput; the firewall must still perform inspection on decrypted traffic, which consumes resources. Option D is wrong because throughput decrease is not limited to video traffic; all decrypted traffic (HTTP, SMTP, etc.) requires inspection, and the performance impact is proportional to the volume and complexity of decrypted sessions.

Full explanation →

10

MCQhard

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

A.BitTorrent is not part of the peer-to-peer application category.

B.The security rule is using an application group instead of an application filter.

C.The firewall does not have the latest App-ID update and cannot identify BitTorrent.

D.The rule is placed after an allow rule that matches the traffic.

AnswerD

If a preceding rule allows the traffic, the deny rule will not be evaluated.

Why this answer

Option D is correct because in Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Exam trap

The trap here is that candidates often focus on App-ID configuration details (like categories or updates) and overlook the fundamental concept of rule ordering, which is a common cause of policy bypass in firewall management.

How to eliminate wrong answers

Option A is wrong because BitTorrent is indeed classified under the 'peer-to-peer' application category in Palo Alto Networks App-ID, so the category should match. Option B is wrong because the question states the rule includes the 'peer-to-peer category', which can be applied via an application filter or group; using an application group would still work if it contains the correct applications, but the issue is rule ordering, not the method of application selection. Option C is wrong because the traffic logs show the application as 'bittorrent', meaning App-ID has successfully identified it; a missing update would result in 'incomplete' or 'unknown' application identification, not a correctly identified application that fails to match.

Full explanation →

11

MCQmedium

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

A.Export Traffic logs to CSV and analyze in Excel

B.Use the Top Applications report in the Reports tab

C.Use the ACC (Application Command Center) and filter by user group and time range

D.Use the Monitor tab's Session Browser with a filter for the user group

AnswerC

ACC provides a customizable dashboard with historical data by application and user group.

Why this answer

The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

Exam trap

The trap here is that candidates confuse the Session Browser (for live sessions) with the ACC (for historical application analytics), or assume that exporting logs to Excel is a valid 'efficient' method, when Cisco tests the understanding that the ACC is the dedicated tool for application-centric reporting.

How to eliminate wrong answers

Option A is wrong because exporting Traffic logs to CSV and analyzing in Excel is inefficient and manual; it requires extra steps and lacks real-time filtering by user group. Option B is wrong because the Top Applications report in the Reports tab is a static, scheduled report that cannot be dynamically filtered by a specific user group for an ad-hoc time range. Option D is wrong because the Monitor tab's Session Browser is designed for real-time session monitoring and troubleshooting, not for generating a historical summary report of applications used over a past week.

Full explanation →

12

MCQmedium

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

A.The traffic is using TLS 1.3 which is not supported by the firewall.

B.The firewall's encryption algorithm settings do not match the server's cipher suite.

C.The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

D.A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.

AnswerD

Decryption policy rules are evaluated top-down; a preceding no-decrypt rule would prevent decryption.

Why this answer

In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Exam trap

The trap here is that candidates often assume the issue is with TLS version support or certificate validation, overlooking the fundamental rule-ordering logic in decryption policy that can cause a no-decrypt rule to preempt a decrypt rule.

How to eliminate wrong answers

Option A is wrong because Palo Alto Networks firewalls support TLS 1.3 decryption in forward proxy mode since PAN-OS 9.0, so TLS 1.3 is not a blocking factor. Option B is wrong because the firewall's encryption algorithm settings in the SSL/TLS decryption profile control which cipher suites the firewall offers to the server; if there is a mismatch, the firewall would typically fall back to a mutually supported cipher rather than skip decryption entirely. Option C is wrong because blocking sessions with expired certificates would cause the session to be terminated or blocked, not silently bypass decryption; the traffic would still be evaluated by the decryption rule.

Full explanation →

13

MCQmedium

Users report that some internal services are not accessible when connected via VPN, but they work when on the local network. The firewall has a policy allowing all traffic from the VPN zone to the internal zone. What should the administrator check first?

A.Check if SSL decryption is breaking the traffic.

B.Check if there are NAT rules that affect the VPN zone traffic, such as missing reverse NAT.

C.Check if the zone protection profile is dropping traffic.

D.Check if the security policy rule order is correct.

AnswerB

Often, internal servers are behind NAT, and VPN traffic may require proper NAT rules to handle return traffic.

Why this answer

Option A is correct. NAT rules can cause issues if return traffic is not handled properly, especially if the destination NAT is only applied to a specific zone. Option B is wrong because the policy is already allowing traffic.

Option C is wrong because zone protection profiles are not likely to cause this selective issue. Option D is wrong because decryption is usually for outbound traffic, not internal service access.

Full explanation →

14

MCQmedium

Refer to the exhibit. What is the status of the commit job?

A.Completed

B.Canceled

C.Failed

D.Pending

AnswerD

The output clearly shows 'Pending' as the status.

Why this answer

The commit job status is 'Pending' because the commit operation has been initiated but not yet completed. In Palo Alto Networks firewalls, when a commit is in progress, the job status shows as 'Pending' until the configuration is successfully applied or an error occurs. The exhibit likely shows a commit job with a status of 'Pending', indicating that the system is still processing the configuration changes.

Exam trap

Palo Alto Networks often tests the distinction between 'Pending' and 'Failed' by showing a commit job that appears stuck or slow, leading candidates to assume it has failed when it is actually still processing.

How to eliminate wrong answers

Option A is wrong because 'Completed' would indicate that the commit job has finished successfully, but the exhibit shows the job is still in progress. Option B is wrong because 'Canceled' would mean the commit was manually aborted or timed out, which is not indicated by a 'Pending' status. Option C is wrong because 'Failed' would mean the commit encountered an error and did not apply the configuration, whereas 'Pending' means the job is still running and has not yet reached a final state.

Full explanation →

15

MCQeasy

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

A.Use URL Filtering to block BitTorrent.

B.Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.

C.Use Data Filtering to block BitTorrent traffic.

D.Block the commonly used ports for BitTorrent.

AnswerB

App-ID identifies BitTorrent across any port.

Why this answer

Option B is correct because Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Exam trap

The trap here is that candidates often default to port-based blocking (Option D) or think URL Filtering (Option A) can block application traffic, failing to recognize that App-ID is the only method that can identify and block applications like BitTorrent irrespective of port or encryption.

How to eliminate wrong answers

Option A is wrong because URL Filtering is designed to block access to specific websites or URL categories, not to identify or block application-layer protocols like BitTorrent. Option C is wrong because Data Filtering is used to block or alert on sensitive data patterns (e.g., credit card numbers) within allowed traffic, not to block entire application protocols. Option D is wrong because BitTorrent can dynamically use any port (including port 80 or 443) to evade simple port-based blocking, making port-based rules ineffective.

Full explanation →

16

MCQmedium

A company needs to restrict access to a critical server from external IP addresses, but internal users should have full access. Which rule structure should be used?

A.Create a deny rule for external IP addresses, then an allow rule for internal.

B.Place the allow rule after the deny rule.

C.Create an allow rule for internal source addresses, then a deny rule for any source.

D.Create a single rule with a 'Deny' action and apply a user-ID condition.

AnswerC

Internal traffic is allowed by the first rule, and all other (external) traffic is denied by the second rule.

Why this answer

Option A is correct because rules are evaluated top-down; placing the internal allow rule first ensures internal traffic is allowed, and then external traffic is denied by the second rule. Option B is wrong because denying external first would also deny internal traffic if it matches the deny rule (if source IP ranges overlap). Option C is wrong because using a single rule cannot differentiate between internal and external sources easily.

Option D is wrong because reverse order would allow external if it matches allow rule.

Full explanation →

17

Multi-Selecthard

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Select 3 answers

A.Configuration of the Panorama IP address on the firewall

B.DNS resolution for the Panorama hostname

C.A valid Panorama auth key on the firewall

D.A DHCP server to assign an IP to the management interface

E.Network connectivity between the firewall and Panorama

AnswersA, C, E

The firewall needs to know where to connect.

Why this answer

Option A is correct because the firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Exam trap

The trap here is that candidates often assume DNS resolution is mandatory for Panorama connectivity, but it is only needed if the Panorama server is specified by hostname rather than IP address.

Full explanation →

18

MCQeasy

A company has a pair of PA-5220 firewalls configured in an active/passive high-availability (HA) cluster. The devices are managed via Panorama, which also manages other firewalls. The security team reports that after a recent commit on Panorama, the passive firewall in the HA pair stops responding to management pings. The active firewall continues to pass traffic and is manageable. Upon investigation, the passive firewall shows the following on its console: 'Management plane is down.' The administrator suspects the passive firewall might have received a configuration that disables the management interface. What should the administrator do to restore management access to the passive firewall without affecting production traffic?

A.From the active firewall CLI, run 'request high-availability sync-to-remote running-config'.

B.Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.

C.Disconnect the HA link and reset the passive firewall to factory defaults.

D.Reboot the passive firewall to load the previous running configuration.

AnswerB

Password recovery mode allows resetting management access without affecting other configurations.

Why this answer

Option B is correct because when the passive firewall's management plane is down and it is unresponsive to management pings, console access is the only way to interact with it. Password recovery mode allows the administrator to reset the management interface configuration without affecting the active firewall or production traffic, as the passive firewall is not forwarding data traffic in an active/passive HA cluster.

Exam trap

The trap here is that candidates assume a reboot or configuration sync will fix the issue, but they fail to recognize that the passive firewall's management plane is down due to a committed configuration error, requiring console-based recovery to restore management access without disrupting the active firewall.

How to eliminate wrong answers

Option A is wrong because 'request high-availability sync-to-remote running-config' synchronizes the running configuration from the active to the passive firewall, but if the passive firewall's management interface is disabled, it cannot receive or apply the sync, and the command does not address the management plane being down. Option C is wrong because disconnecting the HA link and resetting the passive firewall to factory defaults is overly destructive, would erase all configuration, and would require full reconfiguration and re-synchronization, unnecessarily impacting the HA pair's readiness. Option D is wrong because rebooting the passive firewall will load the same committed configuration that caused the management interface to be disabled; it does not revert to a previous running configuration unless a prior commit was saved, and the issue is a configuration error, not a transient software fault.

Full explanation →

19

MCQhard

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

A.The traffic will be allowed if the user uses HTTP instead.

B.The traffic will be allowed because the rule has log-start enabled.

C.The traffic will be allowed because the source and destination zones match.

D.The traffic will be denied by the implicit deny rule because the application does not match.

AnswerD

No rule matches HTTPS; implicit deny applies.

Why this answer

Option D is correct because the security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it.

Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Exam trap

The trap here is that candidates assume that because the source and destination zones match and the port is standard (TCP 443), the rule will permit the traffic, but they overlook the critical requirement that the application must also match the rule's application condition.

How to eliminate wrong answers

Option A is wrong because the rule does not specify HTTP (TCP 80) as an allowed application, and changing the protocol does not automatically permit the traffic; the user would need a separate rule allowing HTTP. Option B is wrong because log-start enabled only logs the start of a session; it does not affect the allow/deny decision of the rule. Option C is wrong because matching source and destination zones alone is insufficient; the rule also requires matching the application, user, and other attributes for the traffic to be permitted.

Full explanation →

20

MCQhard

An organization is using outbound SSL decryption with a forward proxy. They notice that mobile devices (iOS/Android) are having trouble connecting to many HTTPS sites after decryption is enabled. IT has installed the root CA certificate on all devices. What is the most likely reason?

A.The decryption profile does not allow TLS 1.3 connections.

B.The firewall's decryption certificate uses a weak key length.

C.The root CA certificate is not trusted by mobile OS due to certificate transparency or pinning.

D.The firewall is not configured to decrypt traffic from mobile devices.

AnswerC

Mobile devices enforce CT or certificate pinning, causing the intercepted certificate to be rejected.

Why this answer

Option C is correct because mobile operating systems (iOS and Android) implement certificate transparency (CT) requirements and certificate pinning for many HTTPS sites. Even if the root CA certificate is installed, the firewall's decryption certificate is not logged in public CT logs, causing the OS to reject the connection. Additionally, pinned certificates (e.g., for Google or Apple services) will fail validation when the firewall presents its own certificate instead of the original server certificate.

Exam trap

The trap here is that candidates assume installing the root CA certificate is sufficient for all devices, overlooking that mobile OSes enforce additional trust mechanisms like certificate transparency and pinning that are not bypassed by a locally installed root CA.

How to eliminate wrong answers

Option A is wrong because TLS 1.3 is fully supported by Palo Alto Networks decryption profiles, and disabling it would affect all clients, not just mobile devices. Option B is wrong because weak key length (e.g., 1024-bit RSA) would cause browser warnings but not outright connection failures on mobile devices; modern mobile OSes accept 2048-bit keys, which are standard. Option D is wrong because the firewall's decryption policy is based on source zones, IP addresses, or user groups, not device type; if mobile devices are in the same zone as other clients, they will be decrypted unless explicitly excluded.

Full explanation →

21

MCQmedium

A firewall administrator notices that after a power outage, the firewall boots up but fails to load the last committed configuration. What should the administrator do to recover the configuration?

A.Perform a factory reset

B.Load a config file from the previous backup

C.Reinstall the PAN-OS image

D.Use the 'load config from' command via CLI to restore from the most recent saved config

AnswerD

Direct method to load a saved configuration file.

Why this answer

Option D is correct because the 'load config from' CLI command allows the administrator to load a previously saved configuration file (e.g., from the most recent backup) into the running configuration without affecting the startup configuration. After loading, the administrator must commit the configuration to make it persistent. This is the standard recovery method when the last committed configuration fails to load after a reboot, as the firewall retains saved configuration files in its filesystem.

Exam trap

The trap here is that candidates may confuse the 'load config from' command with a factory reset or OS reinstall, assuming a corrupted boot requires a full system restore, when in fact the configuration files are often still accessible and can be reloaded via CLI.

How to eliminate wrong answers

Option A is wrong because a factory reset erases all configurations, including any saved backups, and is only used as a last resort when no configuration can be recovered. Option B is wrong because loading a config file from a previous backup is vague and does not specify the correct CLI command; the proper method is to use the 'load config from' command to load a specific file, not just any backup. Option C is wrong because reinstalling the PAN-OS image is unnecessary and destructive; it would wipe the system and require complete reconfiguration, whereas the issue is only with the configuration file, not the operating system.

Full explanation →

22

Multi-Selectmedium

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Select 2 answers

A.Create a service object with port range 1000-2000

B.Create a service object with port 1000 and use an application override

C.Create a service group with two service objects (one for 1000, one for 2000)

D.Create a custom application that includes both ports

E.Create a single service object with port 1000 and a separate rule for port 2000

AnswersC, D

This groups the two service objects into a single group for use in a rule.

Why this answer

Option C is correct because a service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.

Exam trap

The trap here is that candidates often confuse a service group with a port range object, assuming that a range like 1000-2000 is equivalent to specifying only the endpoints, but in reality, it includes every port in between.

Full explanation →

23

Multi-Selecthard

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Select 3 answers

A.Use a script that logs in via SSH and runs 'save config to scp/tftp'

B.Use the CLI command 'request system backup config schedule'

C.Configure a scheduled backup via the web UI under Device > Setup > Operations

D.Set a recurring cron job via the firewall's built-in cron

E.Use Panorama to schedule backups for managed firewalls

AnswersA, C, E

Correct: External scripts can perform backups manually.

Why this answer

Option A is correct because the firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Exam trap

The trap here is that candidates may assume the firewall has a native CLI command to schedule backups (Option B) or that the built-in cron is user-configurable (Option D), when in fact PAN-OS restricts scheduling to the web UI and Panorama to maintain security and consistency.

Full explanation →

24

Multi-Selectmedium

Which THREE are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose three.)

Select 3 answers

A.IPsec Decryption

B.SSH Proxy

C.SSL Inbound Inspection

D.Decryption Mirror

E.SSL Forward Proxy

AnswersB, C, E

Decrypts SSH traffic for inspection.

Why this answer

SSH Proxy is a valid method for decrypting SSL/TLS traffic on a Palo Alto Networks firewall because it allows the firewall to act as a man-in-the-middle for SSH connections, decrypting the SSH tunnel to inspect the encapsulated traffic. This is distinct from SSL/TLS decryption but is grouped under the same decryption feature set for inspecting encrypted protocols.

Exam trap

The trap here is that candidates may confuse Decryption Mirror (a monitoring tool) with a decryption method, or mistakenly think IPsec Decryption applies to SSL/TLS, when in fact IPsec operates at a different layer and is not used for SSL/TLS traffic inspection.

Full explanation →

25

Multi-Selectmedium

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Select 2 answers

A.Using the GUI under Device > Dynamic Updates > Software

B.Using the CLI command 'request system software upgrade install version <version>'

C.Using the GUI under Device > Dynamic Updates > Content Updates

D.Downloading the image via SCP and using 'load software'

E.Using Panorama's 'Software' tab to push an upgrade to the firewall

AnswersA, B

The GUI method is under Device > Dynamic Updates > Software.

Why this answer

Option A is correct because the PAN-OS software upgrade can be initiated via the GUI under Device > Dynamic Updates > Software, where administrators can download and install new PAN-OS versions. This is a standard method for upgrading the firewall's operating system through the web interface.

Exam trap

The trap here is confusing content updates (signatures) with software updates (PAN-OS version), leading candidates to select the Content Updates path as a valid upgrade method.

Full explanation →

26

MCQmedium

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

A.The decryption policy uses 'No Decrypt' for the internal application's URL category.

B.The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

C.The firewall's CA certificate is not installed in the trusted root store on user endpoints.

D.The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

AnswerC

Without trust, browsers show certificate errors and block the connection.

Why this answer

Option C is correct because SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Exam trap

Palo Alto Networks often tests the misconception that decryption failures are caused by policy misconfigurations or performance issues, rather than the fundamental requirement of installing the firewall's CA certificate on all client devices.

How to eliminate wrong answers

Option A is wrong because if the decryption policy used 'No Decrypt' for the internal application's URL category, the traffic would bypass decryption entirely and should work normally, not fail. Option B is wrong because while performance bottlenecks can occur with heavy decryption, they would cause slowdowns or timeouts, not outright application failures due to certificate trust issues. Option D is wrong because decryption configuration for internal vs external zones does not directly cause application failures; the issue is the lack of trusted CA on endpoints, not the zone direction.

Full explanation →

27

MCQeasy

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

A.Source Zone, Destination Zone, Application, and User

B.Source Zone, Destination Zone, Application, and Service

C.Source Zone, Destination Zone, Service, and Action

D.Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action

AnswerD

These are the minimum required fields in a security policy rule.

Why this answer

Option D is correct because a security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.

Exam trap

The trap here is that candidates often confuse Service with Application, assuming a port-based service (like TCP/80) is mandatory, but Palo Alto emphasizes App-ID as the primary identifier, making Service optional when Application is defined.

How to eliminate wrong answers

Option A is wrong because User is not a mandatory component; it is optional for user-based policy enforcement via User-ID, but not required for basic HTTP traffic. Option B is wrong because Service is not mandatory when Application is defined; App-ID identifies the application (e.g., HTTP) regardless of port, making Service redundant or optional. Option C is wrong because it omits Application and Source/Destination Address, which are mandatory; Service alone cannot replace Application for proper traffic identification, and Action is listed but the rule still lacks required address objects.

Full explanation →

28

MCQhard

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

A.The security profile group applied to the rule is blocking the traffic before the rule is evaluated.

B.The custom object containing the malicious IP was not committed.

C.A rule with a broader match exists above the blocking rule in the rulebase.

D.The device clock is out of sync, causing time-based rules to fail.

AnswerC

Rules are evaluated from top to bottom; a rule above that matches the traffic will apply, bypassing the blocking rule.

Why this answer

In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.

Exam trap

The trap here is that candidates may assume a correctly configured object guarantees enforcement, overlooking the fundamental rulebase ordering principle where a higher-priority allow rule can override a lower-priority block rule.

How to eliminate wrong answers

Option A is wrong because security profile groups are applied after a rule is matched and do not block traffic before rule evaluation; they inspect allowed traffic. Option B is wrong because the administrator verified the custom object is correctly listed, implying it was committed; uncommitted objects would not be listed in the rule. Option D is wrong because an out-of-sync device clock affects time-based rules only if the rule has a schedule configured, and the question does not mention any time-based condition.

Full explanation →

29

MCQmedium

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

A.Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

B.Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.

C.Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

D.Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

AnswerB

This skips decryption for finance sites.

Why this answer

SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Exam trap

The trap here is that candidates may think a 'Decrypt' rule with a specific category is needed to handle financial traffic, but the correct approach is to explicitly exclude it with 'No Decrypt' to comply with regulations.

How to eliminate wrong answers

Option A is wrong because a 'Decrypt' action with destination zone 'Untrust' would decrypt all outbound traffic, including financial websites, violating compliance. Option C is wrong because a 'No Decrypt' rule for all traffic would prevent decryption entirely, defeating the purpose of SSL Forward Proxy; the rule order would not allow selective decryption. Option D is wrong because a 'Decrypt' action for 'Financial Services' would explicitly decrypt financial traffic, which is the opposite of the compliance requirement.

Full explanation →

30

MCQeasy

An administrator modifies a security policy but the change does not take effect. What must the administrator do?

A.Commit the configuration.

B.Import the configuration.

C.Save the configuration.

D.Reboot the firewall.

AnswerA

Changes must be committed to become active.

Why this answer

In Palo Alto Networks firewalls, configuration changes are made in a candidate configuration that is not active until explicitly committed. The administrator must commit the configuration to apply the changes to the running configuration and enforce the new security policy. Without a commit, the modification remains pending and does not affect traffic.

Exam trap

Palo Alto Networks often tests the misconception that saving a configuration (e.g., via 'save config' or clicking Save) is sufficient to apply changes, but in Palo Alto firewalls, a commit is mandatory to move changes from candidate to active state.

How to eliminate wrong answers

Option B is wrong because importing a configuration is used to load a configuration file from an external source, not to apply pending changes. Option C is wrong because saving the configuration in the GUI or CLI only stores the candidate configuration to persistent storage but does not activate it; a commit is still required. Option D is wrong because rebooting the firewall would cause downtime and does not apply uncommitted changes; the candidate configuration would be lost if not saved, and even if saved, a commit is still necessary to activate it.

Full explanation →

31

Multi-Selecteasy

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Select 2 answers

A.Microsoft Hyper-V

B.KVM

C.VMware ESXi

D.Docker

E.Oracle VirtualBox

AnswersB, C

KVM is a supported hypervisor for VM-Series firewalls.

Why this answer

KVM (Kernel-based Virtual Machine) is a supported hypervisor for Palo Alto Networks firewalls, allowing deployment as a virtual machine (VM) on Linux-based virtualization platforms. Palo Alto Networks provides specific VM images (e.g., KVM-compatible QCOW2 format) for KVM environments, making it a valid method for virtualized deployments.

Exam trap

The trap here is that candidates often assume any popular virtualization platform (like Hyper-V or VirtualBox) is supported, but Palo Alto Networks strictly validates only KVM and VMware ESXi for on-premises virtual firewalls, excluding others due to lack of driver optimization and testing.

Full explanation →

32

MCQmedium

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

A.The firewall's CPU and memory are insufficient for the new PAN-OS version.

B.The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.

C.The firewall is performing a backup of the configuration.

D.The rulebase has grown too large.

AnswerB

After an upgrade, the system often performs a full commit to apply structural changes, which is slower.

Why this answer

Option B is correct because after a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Exam trap

The trap here is that candidates may attribute the slower commit to hardware limitations (Option A) or rulebase size (Option D), overlooking the fundamental difference between a full and partial commit triggered by a PAN-OS upgrade.

How to eliminate wrong answers

Option A is wrong because insufficient CPU and memory would cause performance degradation during normal operations, not specifically a longer commit time immediately after an upgrade; the commit operation is CPU-intensive but the primary reason for the delay is the full configuration processing, not resource insufficiency. Option C is wrong because configuration backups are not triggered by a commit operation; backups are scheduled or manual tasks and do not affect commit duration. Option D is wrong because a large rulebase would cause slow commits regardless of the upgrade, but the question specifies that the commit time increased significantly after the upgrade, indicating a change in commit behavior (full vs. partial) rather than a pre-existing rulebase size issue.

Full explanation →

33

MCQhard

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

A.The firewall does not support wildcard certificates for inbound decryption.

B.The web server is not properly configured to handle decrypted traffic.

C.The decryption profile is set to 'Block sessions with untrusted certificates'.

D.The decryption rule is configured with the forward proxy method.

AnswerD

Inbound decryption must use 'SSL Inbound Inspection'; forward proxy is for outbound and mismatches cause handshake failures.

Why this answer

Option D is correct because inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule.

Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Exam trap

The trap here is that candidates confuse the forward proxy method (used for outbound decryption) with the SSL Inbound Inspection method (required for inbound decryption), assuming any decryption rule will work for inbound traffic as long as a certificate is imported.

How to eliminate wrong answers

Option A is wrong because Palo Alto Networks firewalls do support wildcard certificates for inbound decryption; the issue is the decryption method, not the certificate type. Option B is wrong because the web server does not need special configuration for decrypted traffic—the firewall decrypts and re-encrypts transparently; the error is on the client side due to certificate mismatch. Option C is wrong because the decryption profile setting 'Block sessions with untrusted certificates' would block sessions and generate a decryption error in logs, but the logs show no decryption errors and the traffic is matched to the rule with no action taken, indicating the rule is misconfigured, not that the certificate is untrusted.

Full explanation →

34

MCQhard

A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?

A.80

B.443

C.22

D.8080

AnswerB

MyService defines port 443.

Why this answer

The correct answer is B (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.

Exam trap

The trap here is that candidates often assume the destination port is derived from the server group's common service (e.g., HTTP on port 80) rather than recognizing that the service object explicitly defines the port in the security rule.

How to eliminate wrong answers

Option A (80) is wrong because port 80 is associated with HTTP, not the 'MyService' object which is configured for HTTPS (443). Option C (22) is wrong because port 22 is used for SSH, a management protocol not typically defined in a service object named 'MyService' for web traffic. Option D (8080) is wrong because port 8080 is an alternate HTTP port, often used for proxies or development, and does not match the standard HTTPS port 443 defined in 'MyService'.

Full explanation →

35

MCQmedium

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

A.Application override configured for HTTP

B.Asymmetric routing

C.DNS resolution failure

D.NAT policy mismatch

AnswerB

Asymmetric routing causes return traffic to take a different path, so the firewall does not see the return packets and cannot match them to the existing session.

Why this answer

The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Exam trap

The trap here is that candidates may confuse a NAT policy mismatch (which affects address translation) with a session state issue, but the key clue is that the session is initiated correctly—pointing to a routing asymmetry rather than a translation or policy problem.

How to eliminate wrong answers

Option A is wrong because an application override for HTTP would not cause return traffic to fail matching an existing session; it would instead affect how the firewall identifies the application, not the session's stateful tracking. Option C is wrong because DNS resolution failure would prevent the initial connection attempt altogether (the user could not resolve the server's IP), but the engineer already sees the session initiated correctly, indicating DNS worked. Option D is wrong because a NAT policy mismatch would typically cause the initial session to fail or be misrouted, not specifically cause return traffic to not match an existing session that was already established.

Full explanation →

36

MCQhard

A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?

A.Configure intra-vsys security policy for each vsys and allow the traffic.

B.Enable inter-vsys traffic globally in the firewall settings.

C.Traffic between vsys is automatically allowed.

D.Create a security policy rule with source zone from vsys1 and destination zone from vsys2, action allow.

AnswerD

Inter-vsys traffic is controlled by security policies using zones from different vsys.

Why this answer

Option C is correct because inter-vsys traffic is controlled by a security policy with source zone in vsys1 and destination zone in vsys2. Option A is wrong because inter-vsys rules exist, it's not automatic. Option B is wrong because there is no global setting.

Option D is wrong because intra-vsys is within same vsys.

Full explanation →

37

MCQeasy

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

A.Block the social-networking category and allow a custom URL category containing LinkedIn URLs.

B.Alert the social-networking category and block a custom URL category for LinkedIn.

C.Block the social-networking category and block a custom URL category for LinkedIn.

D.Allow the social-networking category and block a custom URL category for LinkedIn.

AnswerA

Block the category, then allow the specific override.

Why this answer

Option C is correct because blocking the social-networking category and then creating a custom URL category with LinkedIn's URLs set to allow overrides the block. Option A is wrong because allowing social-networking would allow all social media. Option B is wrong because blocking LinkedIn specifically would also block it.

Option D is wrong because alert does not block.

Full explanation →

38

Multi-Selecthard

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Select 2 answers

A.Enable DNS Security on the outbound DNS traffic.

B.Configure DNS policies to block requests to unknown domains.

C.Allow all TCP traffic on port 53.

D.Enable logging on all DNS traffic for analysis.

E.Block all UDP traffic on port 53.

AnswersA, B

DNS Security detects tunneling attempts.

Why this answer

Option A is correct because DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.

Exam trap

The trap here is that candidates often confuse passive monitoring (logging) with active prevention, or mistakenly think blocking all UDP on port 53 is a viable solution, not realizing it breaks legitimate DNS traffic.

Full explanation →

39

MCQmedium

A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?

A.Verify the source and destination zones are correct.

B.Ensure the application is identified by App-ID and that the correct application name is used.

C.Confirm that the action is set to allow.

D.Check the order of security rules.

AnswerB

Unknown or uncategorized applications may not match the rule.

Why this answer

Option D is correct because the application might not be identified by App-ID if the traffic is encrypted or unknown. The administrator should verify the application is recognized. Option A is wrong because rule order is less likely if the rule matches.

Option B is wrong because zones are configured. Option C is wrong because the rule already allows application; blocking is a different action.

Full explanation →

40

MCQmedium

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

A.NAT rules are evaluated after security rules

B.NAT rules are evaluated from top to bottom, and the first match is applied

C.NAT rules use longest prefix match on the destination address

D.NAT rules cannot combine source and destination NAT in a single rule

AnswerB

NAT rules are ordered; the first rule that matches the traffic is used.

Why this answer

Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Exam trap

The trap here is that candidates familiar with Cisco ASA or router NAT (which often uses order-independent or longest-match logic) assume the same applies to Palo Alto, but Palo Alto strictly uses top-down first-match evaluation for NAT rules, and NAT is processed before security rules.

How to eliminate wrong answers

Option A is wrong because NAT rules are evaluated before security rules, not after; the firewall performs destination NAT first to determine the true destination, then evaluates security rules against the post-NAT packet. Option C is wrong because NAT rules do not use longest prefix match on the destination address; they use a top-down first-match order, and prefix matching applies only to route lookups, not NAT rule selection. Option D is wrong because a single NAT rule can combine both source and destination NAT (bidirectional NAT) using the 'Source Translation' and 'Destination Translation' tabs in the same rule.

Full explanation →

41

MCQmedium

Refer to the exhibit. The administrator wants to remove unused rules to improve performance. Which rule should be removed?

A.deny-all

B.allow-dns

C.deny-ssh

D.allow-web

AnswerC

This rule has 0 hit count; it is unused and candidate for removal.

Why this answer

Option B is correct because rule 'deny-ssh' has 0 hit count, indicating it is not being used. Option A is wrong because deny-all has 73 hits. Option C is wrong because allow-web has many hits.

Option D is wrong because allow-dns has many hits.

Full explanation →

42

Multi-Selectmedium

Which TWO are best practices for managing security policies in a Palo Alto Networks firewall?

Select 2 answers

A.Enable logging on all rules for maximum visibility.

B.Place most specific rules at the top of the rulebase.

C.Use a single 'allow all' rule to simplify management.

D.Regularly review and remove unused rules using hit counts.

E.Disable unused rules instead of removing them.

AnswersB, D

Specific rules should be first to avoid unnecessary matching and ensure intended behavior.

Why this answer

A and C are correct. Placing most specific rules first reduces latency and ensures correct match. Reviewing and removing unused rules improves performance and security.

B is wrong because using a single rule for all traffic is poor practice. D is wrong because disabling rules leaves clutter. E is wrong because logging all sessions can impact performance and storage.

Full explanation →

43

MCQhard

An administrator needs to implement a policy where traffic from the 'Sales' zone to the 'Finance' zone is allowed only for the 'ms-office365' application, but traffic from 'Sales' to 'Finance' using any other application must be denied. Which rule design meets this requirement efficiently?

A.Create a rule that denies all traffic from Sales to Finance, and then an application default deny rule that allows ms-office365.

B.Create a rule that allows all traffic from Sales to Finance, then a rule that denies ms-office365.

C.Create a rule that allows ms-office365 from Sales to Finance, and place a deny all rule after it.

D.Create one rule that allows ms-office365 and denies all other traffic from Sales to Finance.

AnswerC

The first rule allows the specific application, and the second deny rule blocks all other traffic.

Why this answer

Option D is correct because a rule allowing the specific application and a subsequent deny rule for other traffic is the simplest and most efficient. Option A is wrong because it allows all and then denies ms-office365, which is opposite. Option B is wrong because application default deny would need explicit deny for other apps.

Option C is wrong because combining allow and deny in one rule is not possible.

Full explanation →

44

Matchingmedium

Match each Palo Alto Networks feature to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Identifies applications regardless of port

Maps IP addresses to usernames

Inspects files and data for threats

Cloud-based malware analysis

VPN client for remote access

Why these pairings

These are core Palo Alto Networks security features.

Full explanation →

45

MCQeasy

How can an administrator quickly identify which security rules are not being used in order to clean up the rulebase?

A.Use the 'show rulebase' command.

B.Check the commit logs for recent changes.

C.Sort rules by rule number in descending order.

D.Use the Policy Optimizer tool to view rule hit counts.

AnswerD

Policy Optimizer shows hit counts, enabling identification of unused rules.

Why this answer

Option A is correct; Policy Optimizer provides rule hit counts. Option B is not a method. Option C shows changes, not usage.

Option D 'show rulebase' alone does not show hits.

Full explanation →

46

MCQmedium

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

A.Check that the SNMP manager supports SNMPv3

B.Verify that the firewall's management IP is reachable from the SNMP manager

C.Ensure the SNMP manager is running on the same subnet as the firewall

D.Verify the SNMP community string and allowed management IPs in the SNMP server profile

AnswerD

These are essential for SNMP access.

Why this answer

The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Exam trap

The trap here is that candidates often assume the problem is network connectivity (Option B) or subnet mismatch (Option C), but the PCNSA exam emphasizes that SNMP-specific configuration errors—especially the community string and allowed IP list—are the most frequent first-check items.

How to eliminate wrong answers

Option A is wrong because the question does not specify which SNMP version is configured; checking manager support for SNMPv3 is irrelevant if the firewall is using SNMPv2c or if the issue is a community string mismatch. Option B is wrong because basic IP reachability is a lower-layer check that should be performed after verifying the SNMP-specific configuration, as the firewall may still drop SNMP packets even if pingable. Option C is wrong because SNMP managers can poll firewalls across different subnets via routed networks; there is no requirement for them to be on the same subnet.

Full explanation →

47

MCQmedium

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

A.The 'strict' profile is misconfigured

B.The Decrypt-Web rule has a profile that blocks decryption

C.The Default-No-Decrypt rule is above Decrypt-Web and matches all traffic

D.The source is set to 'any' in the Decrypt-Web rule

AnswerC

Rules are evaluated top-down; the no-decrypt rule matches before the decrypt rule.

Why this answer

In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If the 'Default-No-Decrypt' rule is placed above the 'Decrypt-Web' rule and matches all traffic (e.g., source/destination 'any'), then all traffic, including traffic to the web server, will match this rule first and will not be decrypted, preventing the 'Decrypt-Web' rule from ever being evaluated.

Exam trap

Palo Alto Networks often tests the concept of rule order in decryption policies, where candidates mistakenly focus on profile settings or source/destination fields instead of recognizing that a higher-priority 'no-decrypt' rule matching all traffic will override any lower-priority decrypt rule.

How to eliminate wrong answers

Option A is wrong because a 'strict' profile is related to SSL/TLS forward proxy settings (e.g., certificate validation, protocol version checks) and does not inherently block decryption; it only enforces security checks on decrypted traffic. Option B is wrong because a decryption profile does not block decryption itself; it controls actions like blocking sessions with expired certificates or unsupported cipher suites, but the rule's action (decrypt vs. no-decrypt) is set in the rule, not the profile. Option D is wrong because setting the source to 'any' in the 'Decrypt-Web' rule would actually broaden its match scope, not prevent decryption; the issue is rule order, not the source field.

Full explanation →

48

MCQeasy

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

A.The VLAN interface needs an IP address configured

B.The VLAN interface must be assigned to a virtual router

C.The firewall needs a commit to apply the changes

D.The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed

AnswerD

For a VLAN interface to be up, the parent Ethernet interface must be in layer 2 mode and the VLAN tag must be in the allowed list.

Why this answer

For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Exam trap

The trap here is that candidates often assume a VLAN interface only needs an IP address or a virtual router assignment to come up, overlooking the prerequisite that the parent Ethernet interface must be in Layer 2 mode with the VLAN tag allowed.

How to eliminate wrong answers

Option A is wrong because a VLAN interface can be created without an IP address and still be administratively up; an IP address is only required for routing or management access, not for the interface to come up. Option B is wrong because assigning a VLAN interface to a virtual router is necessary for Layer 3 forwarding, but the interface will still show as down if the underlying Ethernet port is not in Layer 2 mode or the VLAN tag is not allowed. Option C is wrong because while a commit is required to make configuration changes permanent, the VLAN interface will remain down even after a commit if the Ethernet interface is not properly configured for VLAN tagging.

Full explanation →

49

MCQmedium

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

A.A DDoS attack is flooding the firewall with SYN packets.

B.An application on the internal network is not completing TCP handshakes.

C.The firewall's TCP timeout setting is too short.

D.The firewall's hardware is failing.

AnswerB

Half-open connections indicate incomplete handshakes, likely due to application failure.

Why this answer

A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.

Exam trap

The trap here is that candidates often associate high half-open connections exclusively with DDoS SYN floods, but the question specifically asks for a 'likely cause' given the context of a performance issue, and an internal application misbehavior is a common real-world scenario that does not require an attack.

How to eliminate wrong answers

Option A is wrong because a DDoS SYN flood would generate a massive volume of SYN packets, but the firewall's SYN flood protection mechanisms (e.g., SYN cookies, max-session limits) would typically mitigate this; the question describes an unusually high number of half-open connections, not necessarily a flood. Option C is wrong because a TCP timeout that is too short would cause connections to be torn down prematurely, reducing half-open counts, not increasing them. Option D is wrong because hardware failure would likely cause erratic behavior, packet loss, or complete outage, not a specific increase in half-open TCP connections.

Full explanation →

50

MCQhard

A security architect is planning a deployment for a multi-tenant data center where each tenant requires isolated security policies and separate administrators. Which Palo Alto Networks architecture best meets these requirements?

A.Deploy a single firewall with multiple virtual routers and separate zone definitions.

B.Use a single firewall with a single management profile and role-based access control.

C.Deploy multiple physical firewalls, one per tenant.

D.Deploy a single firewall with multiple virtual systems (vsys).

AnswerD

Virtual systems allow logical isolation, separate administrators, and independent policies on a single firewall.

Why this answer

Virtual systems (vsys) allow a single Palo Alto Networks firewall to be partitioned into multiple logical firewalls, each with its own independent security policies, administrators, and virtual routers. This provides complete tenant isolation and separate administrative domains without requiring additional physical hardware, making it the ideal architecture for a multi-tenant data center.

Exam trap

The trap here is that candidates often confuse network segmentation (virtual routers, zones) with full multi-tenancy isolation, not realizing that only virtual systems provide separate administrative domains and independent policy enforcement per tenant.

How to eliminate wrong answers

Option A is wrong because virtual routers and zone definitions provide network segmentation but do not isolate security policies or administrative access per tenant; all policies are still managed under a single firewall context. Option B is wrong because a single management profile with role-based access control (RBAC) can restrict administrator privileges but cannot create fully independent security policy domains; all policies still reside in a single shared configuration space. Option C is wrong because deploying multiple physical firewalls per tenant is cost-prohibitive, increases management complexity, and does not leverage the multi-tenant capabilities built into the PAN-OS architecture.

Full explanation →

51

MCQmedium

A user from 10.0.0.5 tries to access 8.8.8.8 on TCP 443. The traffic is matched to the above rule. Which additional configuration is required for the traffic to be decrypted?

A.A Decryption policy rule matching the same traffic

B.An SSL Forward Proxy certificate installed

C.Both a Decryption policy rule and a Decryption Profile

D.A Decryption Profile with SSL Forward Proxy enabled

AnswerC

Both are necessary to match and execute decryption.

Why this answer

For traffic to be decrypted, a Decryption policy rule must explicitly match the traffic and a Decryption Profile with SSL Forward Proxy enabled must be applied. The rule alone only identifies traffic for potential decryption; the profile defines the decryption method (e.g., SSL Forward Proxy) and controls certificate handling. Without both, the firewall will not perform decryption even if the security rule allows the traffic.

Exam trap

The trap here is that candidates assume a Decryption policy rule alone is enough to decrypt traffic, overlooking that a Decryption Profile must be attached to define the decryption method (e.g., SSL Forward Proxy) and handle certificate validation.

How to eliminate wrong answers

Option A is wrong because a Decryption policy rule alone does not enable decryption; it must reference a Decryption Profile that specifies the decryption type (e.g., SSL Forward Proxy). Option B is wrong because an SSL Forward Proxy certificate is necessary for the firewall to generate on-the-fly certificates, but it is not sufficient without a Decryption policy rule and a Decryption Profile to trigger decryption. Option D is wrong because a Decryption Profile with SSL Forward Proxy enabled cannot be applied to traffic unless a Decryption policy rule first matches the traffic and references that profile.

Full explanation →

52

Multi-Selectmedium

An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)

Select 2 answers

A.Configure NAT policies to translate internal addresses.

B.Define separate security zones for Engineering and Finance.

C.Create a single security zone for all internal traffic.

D.Enable QoS policies between the zones.

E.Apply Threat Prevention profiles to the inter-zone security rules.

AnswersB, E

Separate zones allow fine-grained security policies between departments.

Why this answer

Option B is correct because security zones are the fundamental building blocks for segmenting traffic in Palo Alto Networks firewalls. By placing Engineering and Finance interfaces into separate zones, you create a trust boundary that allows you to enforce inter-zone security rules. Option E is correct because applying Threat Prevention profiles (e.g., antivirus, anti-spyware, vulnerability protection) to the inter-zone rule enables the firewall to inspect and block malicious traffic between the segmented departments.

Exam trap

The trap here is that candidates often confuse NAT or QoS with security controls, thinking address translation or bandwidth management can segment traffic, when in fact only zones and security rules enforce access control and threat inspection.

Full explanation →

53

MCQhard

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

A.The policy "Allow_SSH" has tunnel detection set to none, so it does not match.

B.The application tunnel policy "Block_Tor" is blocking all tunnels.

C.The time-to-live setting prevents SSH tunnel detection.

D.The default action for application tunnels is deny.

AnswerA

Without tunnel detection, the firewall cannot identify SSH tunnels, so the Allow_SSH policy never applies, and tunnels are likely blocked by the default or other rules.

Why this answer

Option D is correct because tunnel detection set to 'none' on the Allow_SSH policy means the firewall does not detect SSH tunnels, so they are not allowed. The default behavior for application tunnels is to check tunnel detection attributes; without detection, the tunnel policy does not match. Option A is wrong because Block_Tor only blocks Tor.

Option B is not necessarily default. Option C is not relevant.

Full explanation →

54

Multi-Selecteasy

An administrator wants to ensure that traffic from the corporate network to the internet is inspected by the firewall's threat prevention features. Which TWO of the following are required to achieve this? (Choose two.)

Select 2 answers

A.Enable decryption to inspect encrypted traffic.

B.Configure NAT policies for outbound traffic.

C.Create a security rule that allows the traffic and includes a security profile group with threat prevention.

D.Ensure the rule's action is set to 'allow'.

E.Use application override to force detection.

AnswersC, D

The rule must allow traffic and apply the threat prevention profile.

Why this answer

Options A and C are correct. A security rule with action 'allow' and a security profile group containing threat prevention is necessary to inspect traffic. Option B is optional for encrypted traffic but not required for all.

Option D is not required for inspection. Option E is not needed.

Full explanation →

55

MCQmedium

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

A.Path monitoring.

B.Heartbeat backup.

C.Session replication.

D.Link monitoring on all interfaces.

AnswerA

Correct: Path monitoring verifies reachability to a target IP and triggers failover if unreachable.

Why this answer

Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Exam trap

The trap here is that candidates often confuse 'link monitoring' (which only checks local interface status) with 'path monitoring' (which checks end-to-end connectivity to a remote target), leading them to select link monitoring when the question explicitly requires detection of internet connectivity loss beyond the first hop.

How to eliminate wrong answers

Option B (Heartbeat backup) is wrong because heartbeat backup refers to the HA control link used for state synchronization and peer liveness detection, not for monitoring external path connectivity. Option C (Session replication) is wrong because session replication is a mechanism to mirror active sessions to the passive firewall for stateful failover, not a monitoring method to detect path loss. Option D (Link monitoring on all interfaces) is wrong because link monitoring only detects physical link state changes (up/down) on local interfaces, not the loss of internet connectivity beyond the first hop.

Full explanation →

56

MCQhard

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

A.The group is configured as static

B.The dynamic group uses 'match all' and the object lacks some tags

C.The administrator added the object directly to the group

D.The address object has multiple tags including the wrong one

AnswerD

A tag matching the group's criteria causes inclusion, even if other tags are different.

Why this answer

Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Exam trap

The trap here is that candidates often assume dynamic groups use 'match all' by default or that tag conflicts are impossible, but the 'match any' operator is common and can cause objects with overlapping tags to be included in unintended groups.

How to eliminate wrong answers

Option A is wrong because a static group does not use tags for membership; objects are manually added or removed, so tag mismatches would not cause incorrect inclusion. Option B is wrong because if the group uses 'match all', the object would need to have all specified tags to be included; lacking some tags would exclude it, not cause incorrect inclusion. Option C is wrong because directly adding an object to a dynamic group is not possible; dynamic groups are populated solely by tag-based matching, not manual addition.

Full explanation →

57

MCQhard

Refer to the exhibit. A network administrator notices that SSL decryption performance has degraded. Based on the exhibit, which factor is most likely contributing to the performance issue?

A.The firewall has been running for too long without a reboot.

B.The session utilization is at 95%, nearing the capacity limit, but decryption sessions are only a small fraction.

C.The decryption policy matches (12000) are high relative to the number of SSL/TLS proxy sessions (5000), indicating many sessions are being decrypted but then possibly dropped or not fully processed.

D.The data plane CPU and memory are both high, indicating resource exhaustion.

AnswerC

A high number of decryption policy matches compared to actual proxy sessions suggests that many decrypted sessions are not being fully proxied, which can cause inefficiency and performance degradation.

Why this answer

The exhibit shows 12000 decryption policy matches but only 5000 SSL/TLS proxy sessions, indicating that many sessions matched the decryption policy but were not fully decrypted (e.g., due to unsupported ciphers or certificate issues), leading to wasted processing and degraded performance.

Full explanation →

58

Multi-Selecteasy

Which three components are part of the Palo Alto Networks Next-Generation Firewall architecture? (Choose three.)

Select 3 answers

A.Application ID engine

B.Single-pass software architecture

C.Policy optimizer

D.GlobalProtect VPN

E.Decoupled control and data plane

AnswersA, B, E

App-ID identifies applications regardless of port.

Why this answer

The Application ID engine is a core component of Palo Alto Networks Next-Generation Firewall architecture because it performs deep packet inspection to identify applications regardless of port, protocol, or encryption. This allows the firewall to apply security policies based on the application identity rather than traditional port-based rules, enabling granular control over traffic.

Exam trap

The trap here is that candidates often confuse features or management tools (like Policy Optimizer or GlobalProtect VPN) with the core architectural components that define the NGFW's processing model, such as the single-pass engine and decoupled planes.

Full explanation →

59

MCQmedium

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

A.Modify the existing decrypt rule to decrypt all categories except those two.

B.Disable decryption entirely for all student traffic.

C.Create a security policy rule to allow traffic to those URL categories without inspection.

D.Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.

AnswerD

This bypasses decryption for compliant categories.

Why this answer

Option D is correct because it creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.

Exam trap

The trap here is that candidates confuse security policy rules with decryption policy rules, thinking that a security rule can bypass decryption, when in fact decryption is controlled exclusively by decryption policy rules with actions like 'Decrypt' or 'No Decrypt'.

How to eliminate wrong answers

Option A is wrong because modifying the existing decrypt rule to decrypt all categories except those two would require excluding the categories within the same rule, but the correct approach is to use a separate 'No Decrypt' rule above the decrypt rule to ensure proper precedence and avoid unintended decryption of sensitive traffic. Option B is wrong because disabling decryption entirely for all student traffic is an overreaction that would eliminate security visibility for all web traffic, not just the problematic categories, and would not align with the goal of maintaining decryption for other sites. Option C is wrong because creating a security policy rule to allow traffic without inspection does not address the decryption issue; security policies control firewall actions (allow/deny), not decryption decisions, and the traffic would still be decrypted by the existing decrypt rule unless a decryption policy explicitly excludes it.

Full explanation →

60

MCQeasy

What does a 'shadowed' rule mean in the context of policy evaluation?

A.A rule that is never evaluated because a previous rule with same or broader match already matches the traffic.

B.A rule that is never hit because it is at the bottom of the rulebase.

C.A rule that is disabled.

D.A rule that matches traffic but has no action configured.

AnswerA

This is the definition of a shadowed rule.

Why this answer

Option D is correct. A shadowed rule is one that is never evaluated because a previous rule with same or broader match already matches the traffic. Option A is wrong because a rule at the bottom is still evaluated if no earlier match.

Option B is not possible. Option C is disabled, not shadowed.

Full explanation →

61

MCQhard

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

A.Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

B.Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

C.Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.

D.Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

AnswerC

This allows trusted certificates to pass without decryption, reducing overhead while still validating certificates.

Why this answer

Option C is correct because setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Exam trap

The trap here is that candidates often assume 'No Decrypt' means no inspection at all, but with certificate status check enabled, the firewall still validates the certificate chain and revocation status, providing security without decryption overhead.

How to eliminate wrong answers

Option A is wrong because 'Decrypt' action would force decryption and re-encryption, causing the exact performance issue the engineer wants to avoid, and a custom URL category does not reduce overhead. Option B is wrong because 'No Decrypt' with certificate status check disabled means the firewall will not inspect the certificate at all, missing potential threats like expired or revoked certificates. Option D is wrong because 'Decrypt' action with source zone 'Untrust' still decrypts all traffic from that zone, increasing overhead unnecessarily for a public CA application that does not require decryption.

Full explanation →

62

MCQeasy

A network administrator is migrating from a legacy firewall to a new Palo Alto Networks firewall. The current firewall has a large number of ACL rules that allow traffic based on source/destination IP and port. The administrator wants to convert these rules to App-ID based policies on the Palo Alto firewall. What is the recommended best practice to ensure a smooth migration while maintaining security?

A.Use the Policy Optimizer feature in Panorama to analyze existing logs and generate App-ID based policy recommendations.

B.Deploy the Palo Alto firewall inline with no policies first, and let it learn the traffic patterns automatically for a week.

C.Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.

D.Convert all existing rules to App-ID by using the application default ports and immediately enforce application blocking.

AnswerC

This ensures no loss of connectivity and provides visibility into applications before switching to App-ID based policies, minimizing risk.

Why this answer

Option A is correct. The recommended approach is to first replicate the existing port-based rules on the Palo Alto firewall to preserve connectivity, then enable App-ID in learning mode (or log and learn) to observe actual applications. This allows the administrator to identify applications without disruption and then gradually create App-ID based policies.

Option B is risky as it leaves no policies, allowing all traffic. Option C could cause outages by enforcing App-ID immediately. Option D refers to Policy Optimizer, which is useful later but not the first step.

Full explanation →

63

MCQeasy

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

A.URL Filtering Profile

B.Application Override

C.File Blocking Profile

D.Data Filtering Profile

AnswerD

Data filtering inspects content for patterns.

Why this answer

Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Exam trap

The trap here is that candidates often confuse Data Filtering with File Blocking, assuming that blocking file attachments is sufficient to prevent data loss, but Data Filtering is specifically designed to inspect and block sensitive text patterns within the body of webmail or other application traffic.

How to eliminate wrong answers

Option A is wrong because URL Filtering Profile controls access to websites based on URL categories and reputation, not the content within webmail messages. Option B is wrong because Application Override is used to force a specific application signature for traffic that is not correctly identified, not to inspect or filter data content. Option C is wrong because File Blocking Profile blocks specific file types (e.g., .exe, .zip) based on file name or type, but it cannot inspect the body of an email for patterns like credit card numbers.

Full explanation →

64

MCQhard

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

A.Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.

B.Use the default log forwarding settings and configure the syslog servers globally.

C.Create a single log forwarding profile with both syslog profiles and assign it to all rules.

D.Configure each firewall rule to specify which syslog server to send logs to.

AnswerA

Correct: Separate profiles allow different log types to be sent to different destinations.

Why this answer

Option A is correct because Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Exam trap

The trap here is that candidates often assume a single log forwarding profile can be assigned to multiple log types with different server destinations, but Palo Alto requires separate profiles to achieve selective routing, as a single profile applies all its servers to all logs it covers.

How to eliminate wrong answers

Option B is wrong because the default log forwarding settings do not allow selective routing to multiple syslog servers; they apply a single global configuration that cannot differentiate between log types or servers. Option C is wrong because a single log forwarding profile with both syslog profiles would send both threat and traffic logs to both servers, failing the requirement to send traffic logs only to long-term storage. Option D is wrong because firewall rules do not directly specify syslog servers; log forwarding is configured via log forwarding profiles, not per-rule syslog server assignments.

Full explanation →

65

MCQmedium

An administrator configured SNMP community and trap destination under Device > Setup > Services, but no traps are received. What additional configuration is needed?

A.Set the source interface

B.Configure SNMP version

C.Create a security policy

D.Add a management profile that allows SNMP

E.Enable SNMP on the interface

AnswerD

The management profile must permit SNMP access to the management interface.

Why this answer

Option D is correct because even after configuring SNMP communities and trap destinations under Device > Setup > Services, the firewall still requires a management profile that explicitly permits SNMP (and optionally traps) on the interface through which the traps will be sent. Without this profile applied to the interface, the firewall will not allow SNMP traffic to egress, and traps will be silently dropped.

Exam trap

Palo Alto Networks often tests the misconception that configuring SNMP under Device > Setup is sufficient, but the trap here is that candidates forget the management profile is a separate, mandatory step to authorize SNMP traffic on the egress interface.

How to eliminate wrong answers

Option A is wrong because setting the source interface is optional and only needed when you want to force traps to originate from a specific IP address; it is not a prerequisite for trap delivery. Option B is wrong because SNMP version is already implicitly selected when you configure the community string (v2c) or user (v3) under the SNMP setup; no separate version configuration is required. Option C is wrong because security policies control inter-zone traffic, but SNMP traps are generated locally by the firewall and egress via the management plane, not through a dataplane security policy.

Option E is wrong because SNMP is not 'enabled' on an interface like a service; instead, you must attach a management profile that includes SNMP to the interface to allow the firewall to send traps out that interface.

Full explanation →

66

Multi-Selecteasy

A small business needs a firewall that supports at least 500 Mbps firewall throughput and includes integrated SD-WAN capabilities. Which TWO Palo Alto Networks platforms meet these requirements? (Choose two.)

Select 2 answers

A.PA-400 series

B.PA-800 series

C.PA-5250

D.PA-7080

E.PA-220

AnswersA, B

PA-400 series supports SD-WAN and provides up to 4 Gbps throughput, exceeding the 500 Mbps requirement.

Why this answer

The PA-400 series supports up to 1 Gbps firewall throughput and includes integrated SD-WAN capabilities, making it suitable for small businesses needing at least 500 Mbps throughput with SD-WAN features.

Exam trap

The trap here is that candidates often assume all Palo Alto firewalls support SD-WAN equally, but only the PA-400 and PA-800 series (and newer models like PA-400R) natively integrate SD-WAN without additional licensing or hardware, while higher-end models like the PA-5250 and PA-7080 focus on raw throughput and advanced threat prevention, not SD-WAN for small business use cases.

Full explanation →

67

MCQeasy

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

A.Use 'any' for source and destination zones to save time

B.Create rules with the most specific conditions first

C.Mix inbound and outbound rules in the same rulebase section

D.Place general rules above specific rules

AnswerB

Specific rules first ensures precise traffic handling.

Why this answer

Placing more specific rules above general rules ensures that specific traffic is matched first, preventing unintended matches. Option A is wrong because disabling logging on all rules reduces visibility. Option C is wrong because using any/any rules is discouraged.

Option D is wrong because security rules should ideally be grouped by zone, not mixed.

Full explanation →

68

MCQmedium

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

A.The firewall is not connected to the cloud for App-ID updates.

B.The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.

C.Decryption is not enabled for Google Drive traffic.

D.An application override is configured for Google Drive.

AnswerB

Google Drive has multiple sub-apps; uploads are a different app-ID.

Why this answer

App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Exam trap

The trap here is that candidates assume a single application signature like 'google-drive-base' covers all traffic for that application, but Palo Alto Networks App-ID often splits applications into multiple sub-application signatures for granular control, and failing to allow the specific sub-application for uploads will result in blocked traffic.

How to eliminate wrong answers

Option A is wrong because App-ID updates are not required for the firewall to recognize Google Drive sub-applications; the signatures are already present in the initial App-ID database and are updated via dynamic updates, but the issue here is a policy misconfiguration, not a connectivity problem. Option C is wrong because decryption is not a prerequisite for App-ID to identify Google Drive traffic; App-ID can identify applications using unencrypted metadata and heuristics, and while decryption improves accuracy, its absence does not cause a specific 'google-drive-upload' signature to be blocked if the rule allows only 'google-drive-base'. Option D is wrong because an application override would replace App-ID identification with a static application definition, which would not cause a selective block of uploads; instead, it would either allow or block all Google Drive traffic based on the override, not differentiate between base and upload functions.

Full explanation →

69

MCQeasy

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

A.22

B.443

C.8080

D.80

AnswerD

Port 80 is the standard port for HTTP.

Why this answer

The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Exam trap

Palo Alto Networks often tests the distinction between HTTP (port 80) and HTTPS (port 443), and the trap here is that candidates may confuse HTTP with HTTPS or assume a common alternate port like 8080 is the default.

How to eliminate wrong answers

Option A is wrong because port 22 is the default port for SSH, not HTTP. Option B is wrong because port 443 is the default port for HTTPS (HTTP over SSL/TLS), not HTTP. Option C is wrong because port 8080 is an alternate port commonly used for HTTP proxies or web servers, but it is not the pre-defined default for the HTTP service object in Palo Alto Networks firewalls.

Full explanation →

70

MCQeasy

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

A.Inbound Inspection Decryption

B.Decryption Mirror

C.Outbound (Forward Proxy) Decryption

D.SSH Proxy

AnswerA

Inbound inspection is specifically designed to decrypt traffic entering the network and destined to internal servers.

Why this answer

Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Exam trap

The trap here is that candidates confuse 'forward proxy' (outbound) with 'reverse proxy' (inbound), leading them to select Outbound (Forward Proxy) Decryption even though the traffic is inbound to the server.

How to eliminate wrong answers

Option B (Decryption Mirror) is wrong because it is not a decryption method; it is a feature that copies traffic to a monitoring tool without decrypting it. Option C (Outbound (Forward Proxy) Decryption) is wrong because it is designed for decrypting traffic initiated by internal clients going to external servers, not inbound traffic to a web server. Option D (SSH Proxy) is wrong because it is used to proxy SSH connections, not to decrypt HTTPS traffic, and it does not apply to inbound web server inspection.

Full explanation →

71

Multi-Selectmedium

Which TWO of the following are valid methods to centrally manage multiple Palo Alto Networks firewalls?

Select 2 answers

A.Deploy a dedicated Log Collector to aggregate logs from multiple firewalls

B.Use the web interface of one firewall to manage others

C.Manually configure each firewall and synchronize via TFTP

D.Deploy a Panorama management server

E.Use CLI scripting to push configurations

AnswersA, D

Log Collectors are part of Panorama architecture and centralize logging.

Why this answer

Option A is correct because a dedicated Log Collector aggregates logs from multiple Palo Alto Networks firewalls, enabling centralized log storage and analysis without managing firewall configurations. This is a valid method for centralizing log data, though it does not manage firewall policies or settings directly. Option D is correct because Panorama is the primary centralized management server for Palo Alto Networks firewalls, allowing administrators to push policies, templates, and configurations to multiple firewalls from a single interface.

Exam trap

The trap here is that candidates may confuse centralized log aggregation (Log Collector) with centralized management (Panorama), or assume that CLI scripting or manual TFTP synchronization are valid enterprise-scale methods, when in fact only Panorama provides full policy and configuration management across multiple firewalls.

Full explanation →

72

MCQhard

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

A.The application 'webapp' is not allowed due to an application override.

B.SSL decryption is not enabled.

C.A file blocking profile is blocking the upload.

D.App-ID is not identifying the application correctly.

AnswerC

File blocking is part of Content-ID and can prevent uploads.

Why this answer

The correct answer is C because a file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Exam trap

The trap here is that candidates often assume the issue is with App-ID misidentification or SSL decryption, but the question explicitly states the application is allowed and Content-ID is enabled, pointing directly to a file blocking profile as the cause of the upload failure.

How to eliminate wrong answers

Option A is wrong because an application override would explicitly allow or deny the application, but the rule already allows 'webapp', so an override would not cause a block unless it was set to deny, which is not indicated. Option B is wrong because SSL decryption is not required for file uploads to a custom web application unless the traffic is encrypted and App-ID or Content-ID needs to inspect the payload; the question does not mention HTTPS, so lack of decryption is not the most likely cause. Option D is wrong because App-ID is correctly identifying the application as 'webapp' (since the rule allows it), and Content-ID is enabled, so the issue is not with identification but with a security profile blocking the upload.

Full explanation →

73

Multi-Selecthard

A security architect is evaluating the VM-Series firewall for a private cloud deployment. Which three features are specific to the VM-Series that differentiate it from physical Palo Alto firewalls? (Choose three.)

Select 3 answers

A.Support for VMware NSX integration

B.Support for active/active HA using cloud load balancers

C.Hardware-based flow acceleration

D.Pay-as-you-grow licensing model

E.Dedicated SSL decryption ASIC

AnswersA, B, D

VM-Series can integrate with NSX for microsegmentation.

Why this answer

Option A is correct because VMware NSX integration is a VM-Series-specific capability that allows the virtual firewall to be managed as part of the NSX fabric, using NSX Service Insertion and distributed firewall rules. This integration is not available on physical Palo Alto Networks firewalls, which rely on hardware-based network interfaces and cannot be inserted into a software-defined network overlay.

Exam trap

The trap here is that candidates confuse hardware acceleration features (like ASICs) with software-defined capabilities, assuming that VM-Series inherits physical firewall hardware features when it actually relies on virtualized resources.

Full explanation →

74

Multi-Selecteasy

Which THREE are default security profile groups in PAN-OS? (Choose three.)

Select 3 answers

A.Strict

B.Server

C.Alert

D.Custom

E.Best Practice

AnswersA, C, E

The 'Strict' group has more restrictive settings.

Why this answer

Options A, C, D are correct. These are predefined profile groups. Option B is wrong because 'Server' is not a default group; there is 'Strict' but not 'Server'.

Option E is wrong because 'Custom' is not a default group; custom groups are user-created.

Full explanation →

75

MCQhard

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

A.Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.

B.Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.

C.Ensure both virtual routers are in the same virtual system.

D.Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.

AnswerA

Inter-vsys routing requires a path between the virtual routers, such as a virtual wire or route leak.

Why this answer

Virtual routers in different virtual systems (Vsys) are isolated by default. To enable inter-Vsys routing, you must configure either a virtual wire (which bridges the two Vsys at Layer 2) or route redistribution (which allows routes from one virtual router to be shared with the other). This provides the necessary Layer 3 connectivity between the Vsys A and Vsys B subnets.

Exam trap

The trap here is that candidates often assume security rules alone are sufficient for inter-Vsys traffic, overlooking the fundamental requirement for a Layer 3 path between the virtual routers.

How to eliminate wrong answers

Option B is wrong because security rules control traffic flow between zones but do not create a routing path; without a route between the virtual routers, the firewall will drop the packet at the routing stage. Option C is wrong because placing both virtual routers in the same virtual system would defeat the purpose of Vsys segmentation and is not required for inter-Vsys routing. Option D is wrong because NAT translates IP addresses but does not establish a route between the two virtual routers; the packet still needs a valid path to reach the destination subnet.

Full explanation →

Page 1 of 7

All pages

Practice PCNSA by domain

Target a specific domain to shore up weak areas.

Managing Objects Policy Evaluation and Management Securing Traffic Core Concepts Palo Alto Networks Platforms and Architecture Device Management and Services App-ID and Content-ID Decryption and Monitoring

See all domains with question counts →