Courseiva

Palo Alto Networks Certified Network Security Administrator PCNSA (PCNSA) — Questions 376–450

524 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 7

Page 7
376
MCQmedium

Refer to the exhibit. Based on the session information, which type of NAT is being performed?

A.No NAT is being performed
B.Source NAT
C.Port Address Translation (PAT)
D.Destination NAT
AnswerB

The source address is translated from 10.1.1.100 to 192.168.1.100, which is source NAT.

Why this answer

Option A is correct because the source IP is translated from a private IP to a public IP, indicating source NAT (SNAT). Option B is wrong because destination NAT would show a change in destination IP. Option C is wrong because no port information is shown to indicate PAT specifically; the term 'source NAT' encompasses address translation.

Option D is wrong because no IPs are being hidden in the sense of typical network terminology.

Full explanation →
377
Multi-Selecteasy

Which TWO are required to configure a Forward Proxy Decryption rule?

Select 2 answers
A.A Certificate
B.A Decryption Profile
C.A Destination Zone
D.A Source Zone
E.A URL Category
AnswersA, B

A certificate is required to impersonate the destination server.

Why this answer

A certificate is required for a Forward Proxy Decryption rule because the firewall must generate and sign a certificate on-the-fly to impersonate the destination server to the client. Without a valid certificate (typically from an internal CA or a decryption-specific CA), the client browser will reject the connection with a certificate error. The certificate is used to establish a trusted TLS session between the client and the firewall, allowing the firewall to decrypt and inspect the traffic.

Exam trap

Palo Alto Networks often tests the distinction between mandatory and optional fields in decryption rules, leading candidates to mistakenly include source or destination zones as required when they are actually optional filters.

Full explanation →
378
MCQmedium

An administrator needs to apply a security profile that includes anti-malware and vulnerability protection to all traffic from the internal network to the internet. However, there is already a rule that allows this traffic without any profiles. What is the most efficient way to apply the profiles?

A.Create a new rule above the existing rule with the profiles and action 'deny'.
B.Remove the existing rule and replace it with a new rule that includes the profiles.
C.Create a new rule above the existing rule with the profiles and action 'allow', and ensure the rule is before the existing allow rule.
D.Edit the existing rule to add the security profiles.
AnswerC

This ensures the new rule matches first and applies profiles.

Why this answer

Option C is correct because creating a new rule above the existing rule with the profiles and action 'allow' will match first and enforce the profiles without modifying the existing rule. Option A is also possible but less efficient if the existing rule is complex. Option B would block traffic.

Option D is disruptive.

Full explanation →
379
MCQmedium

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

A.The commit on Panorama failed for vsys2 due to a validation error.
B.The admin user does not have sufficient privileges to push configuration to vsys2.
C.The vsys2 is not included in the device group on Panorama.
D.The firewall's serial number is not registered correctly in Panorama for vsys2.
AnswerC

For Panorama to push configuration to a specific vsys, that vsys must be part of the device group. If vsys2 is omitted, it won't receive the update.

Why this answer

Option C is correct because Panorama pushes configuration to firewalls based on device group membership. If vsys2 is not included in the device group assigned to the firewall, Panorama will not push the updated configuration to that virtual system, even if the firewall itself is reachable and other vsys are updated. The administrator verified the template stack assignment, but the device group inclusion is a separate prerequisite for configuration delivery.

Exam trap

The trap here is that candidates often confuse device group membership with template stack assignment, assuming both are required for configuration push, but only device group membership controls policy delivery to specific vsys.

How to eliminate wrong answers

Option A is wrong because a commit failure on Panorama would typically generate an error message or log entry, and the administrator did not report any validation errors; also, other vsys updated successfully, indicating the commit succeeded globally. Option B is wrong because admin privileges in Panorama are role-based and apply to the entire firewall or device group, not per vsys; if the admin could push to other vsys, they have sufficient privileges. Option D is wrong because the firewall's serial number is registered at the firewall level, not per vsys; if the firewall can reach Panorama and other vsys are updated, the serial number registration is correct.

Full explanation →
380
Multi-Selectmedium

A security administrator is configuring Panorama to manage multiple firewalls. Which two actions are required to ensure that a firewall receives its configuration from Panorama? (Choose two.)

Select 2 answers
A.Commit the Panorama configuration.
B.Create a local admin account on the firewall.
C.Add the firewall to a template stack.
D.Add the firewall to a device group.
E.Enable 'Panorama Managed' on the firewall.
AnswersC, E

Template stacks contain device settings applied to firewalls.

Why this answer

Option C is correct because a firewall must be added to a template stack to receive device-level settings (such as network interfaces and security zones) from Panorama. Template stacks allow hierarchical configuration of device-specific parameters, ensuring the firewall inherits the correct operational settings.

Exam trap

The trap here is that candidates often confuse device groups with template stacks, assuming that adding a firewall to a device group alone is sufficient to receive all configuration, but Panorama requires both a template stack for device-level settings and the 'Panorama Managed' flag to establish management connectivity.

Full explanation →
381
MCQmedium

A company wants to centrally manage multiple firewalls using Panorama. They need to reduce management IP usage on the firewalls. Which Panorama deployment model best achieves this?

A.Use the firewall's default management mode with out-of-band management
B.Deploy firewalls in an Active/Active HA cluster
C.Configure a dedicated management subnet for each firewall
D.Use Panorama in 'panorama' mode with templates and device groups
AnswerD

This centralizes management and reduces individual management IP overhead.

Why this answer

Option D is correct because Panorama's 'panorama' mode with templates and device groups allows centralized management of multiple firewalls without requiring a dedicated management IP for each firewall. Instead, firewalls can share a single management interface or use in-band management, reducing IP address consumption. This model streamlines configuration and policy deployment while minimizing management IP overhead.

Exam trap

The trap here is that candidates may confuse 'reducing management IP usage' with 'reducing management traffic' or 'improving security,' leading them to choose out-of-band management (Option A) or dedicated subnets (Option C), which actually increase IP consumption rather than reduce it.

How to eliminate wrong answers

Option A is wrong because using the firewall's default management mode with out-of-band management still requires a dedicated management IP per firewall, which does not reduce IP usage. Option B is wrong because deploying firewalls in an Active/Active HA cluster does not reduce management IP usage; each firewall still needs its own management IP, and the cluster adds complexity without addressing IP conservation. Option C is wrong because configuring a dedicated management subnet for each firewall increases IP usage by requiring separate subnets and IPs, contrary to the goal of reducing management IP consumption.

Full explanation →
382
Multi-Selecthard

Which THREE actions can a Security policy rule perform on traffic?

Select 3 answers
A.Drop
B.Reset
C.Deny
D.Block
E.Allow
AnswersA, C, E

Correct: Drop silently discards the packet.

Why this answer

A Security policy rule in Palo Alto Networks firewalls can explicitly drop traffic, which silently discards the packet without sending any notification to the source. This is a valid action for blocking unwanted traffic while minimizing network overhead and avoiding unnecessary responses.

Exam trap

The trap here is that candidates often confuse 'Deny' and 'Drop' as the same action, but Palo Alto Networks distinguishes them by whether a reset or unreachable message is sent, and 'Block' is not a valid Security policy rule action at all.

Full explanation →
383
MCQmedium

A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?

A.Create a security policy with a log setting at the end of the rulebase that matches traffic to the group.
B.Configure a log forwarding profile and apply it to each policy using the group.
C.Use a policy optimizer to automatically add logging to policies.
D.Use the address group in a security policy and enable logging at session end in that policy.
AnswerD

This single policy, when placed appropriately, will log all sessions to the group with minimal overhead.

Why this answer

Option D is correct because it allows the administrator to enable logging at session end directly on a single security policy that uses the address group 'Medical-Servers' as the destination. This ensures all traffic matching that policy is logged without needing to modify multiple policies, reducing administrative overhead while meeting compliance requirements.

Exam trap

The trap here is that candidates may think a log forwarding profile is required to enable logging, when in fact logging at session end is a per-rule setting, and forwarding profiles only handle log export and filtering.

How to eliminate wrong answers

Option A is wrong because placing a generic catch-all policy at the end of the rulebase would log all traffic, not just traffic to the Medical-Servers group, and could introduce security gaps by matching unintended traffic. Option B is wrong because applying a log forwarding profile to each policy individually increases administrative overhead, contradicting the goal of reducing it, and log forwarding profiles control where logs are sent, not whether session end logging is enabled. Option C is wrong because the policy optimizer is used to analyze and suggest rule changes based on traffic patterns, not to automatically add logging settings to existing policies.

Full explanation →
384
MCQmedium

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

A.Dynamic IP and Port (DIPP) with source NAT.
B.Bidirectional NAT.
C.Static NAT with source NAT.
D.Destination NAT with port forwarding.
AnswerA

DIPP translates internal IPs to public IPs with port multiplexing, suitable for outbound internet access.

Why this answer

Option A is correct because Dynamic IP and Port (DIPP) allows many internal IPs to share a pool of public IPs using port address translation. Option B is for static 1-to-1 mapping. Option C is for inbound traffic.

Option D is for two-way NAT.

Full explanation →
385
MCQhard

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

A.The firewall is rejecting many sessions due to certificate errors.
B.There are a few sessions failing due to TLS version mismatch.
C.The decryption policy is not being hit because of low policy hits.
D.The current decryption session count is at its peak.
AnswerB

5 TLS version failures indicate some issues.

Why this answer

The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Exam trap

Palo Alto Networks often tests the ability to distinguish between different decryption failure reasons (TLS version mismatch vs. certificate errors vs. cipher mismatch), and the trap here is that candidates may assume any decryption failure is due to certificate issues, ignoring the specific error message in the output.

How to eliminate wrong answers

Option A is wrong because certificate errors would be logged as 'certificate validation failure' or 'certificate revoked' in the decryption session log, not as 'TLS version mismatch'. Option C is wrong because the decryption policy is being hit (sessions are being decrypted), as evidenced by the large number of decryption sessions; low policy hits would show few or no decryption sessions. Option D is wrong because the output does not provide any historical or peak data; the current session count could be high but there is no baseline to determine if it is at its peak.

Full explanation →
386
MCQeasy

An administrator needs to perform a scheduled reboot of the firewall for maintenance. Which method provides the most control over the reboot timing?

A.Use the CLI command 'request restart system' with a scheduled time
B.Schedule a commit with the 'reboot at' option
C.Use the GUI 'Restart' button
D.Use the CLI command 'request shutdown system'
AnswerA

This allows scheduling the reboot.

Why this answer

The CLI command 'request restart system' with a scheduled time provides the most control because it allows you to specify an exact date and time for the reboot, ensuring the maintenance window is precisely managed without manual intervention. This method is designed for granular scheduling, unlike other options that either lack scheduling capability or are intended for different purposes.

Exam trap

The trap here is that candidates confuse the 'commit' command's configuration role with system operations, or assume the GUI 'Restart' button offers scheduling options when it does not, leading them to overlook the CLI's precise scheduling capability.

How to eliminate wrong answers

Option B is wrong because the 'commit' command is used to apply configuration changes, not to schedule a reboot; there is no 'reboot at' option within a commit operation. Option C is wrong because the GUI 'Restart' button initiates an immediate reboot without any scheduling capability, offering no control over timing. Option D is wrong because 'request shutdown system' is used to power off the firewall, not to reboot it, and it also lacks scheduling features.

Full explanation →
387
Multi-Selecthard

Which THREE actions are valid when configuring App-ID in a security policy? (Choose three.)

Select 3 answers
A.Reset-Client
B.Deny
C.Apply
D.Allow
E.Decrypt
AnswersA, B, D

Reset-Client sends a TCP reset to the client, a valid action.

Why this answer

A is correct because 'Reset-Client' is a valid action in App-ID security policy rules that terminates the client session by sending a TCP reset (RST) packet. This action is used to block traffic while providing immediate feedback to the client that the connection was refused, rather than silently dropping packets.

Exam trap

The trap here is confusing security policy actions with decryption policy actions, leading candidates to incorrectly select 'Decrypt' as a valid App-ID action when it belongs to a separate policy type.

Full explanation →
388
MCQhard

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

A.SSL decryption is not enabled for the custom application.
B.The custom application needs to be added to the 'ssl' application group.
C.The security rule that allows the traffic does not include the custom application.
D.The application override was not committed.
AnswerC

The traffic may be matching a different rule that doesn't have the custom app.

Why this answer

Option C is correct because the security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Exam trap

The trap here is that candidates assume an application override alone will make the traffic match an existing rule that allows 'ssl' or 'web-browsing', but the override creates a new App-ID that must be explicitly added to the security rule's application list.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not required for application override to work; application override identifies the application based on port and IP, not decryption. Option B is wrong because adding the custom application to the 'ssl' application group would not change its App-ID; the override already assigns a custom App-ID, and groups do not affect identification. Option D is wrong because if the override were not committed, the traffic would still be identified as 'unknown-tcp', but the question states the override was applied; the most likely reason is the security rule missing the custom application, not a commit issue.

Full explanation →
389
MCQmedium

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

A.The firewall's CRL server is unreachable.
B.The server is using an unsupported cipher suite.
C.The decryption policy is not matching the traffic.
D.The firewall's certificate is not trusted by clients.
AnswerB

Cipher mismatches commonly cause handshake failures.

Why this answer

The output shows a large number of handshake failures, which typically occur during the SSL/TLS handshake when the client and server cannot agree on a common cipher suite. If the server only supports weak or outdated ciphers that the firewall's decryption policy does not allow, or if the firewall's SSL forward proxy engine does not support the server's chosen cipher, the handshake will fail. This is the most likely cause because cipher suite mismatch is a common source of handshake failures in decryption environments.

Exam trap

The trap here is that candidates often confuse handshake failures with certificate validation issues, but handshake failures specifically indicate a failure in the initial negotiation phase (e.g., cipher mismatch or protocol version incompatibility), not a trust or CRL problem.

How to eliminate wrong answers

Option A is wrong because an unreachable CRL server would cause certificate validation failures, not handshake failures; handshake failures occur before certificate validation in the SSL/TLS handshake. Option C is wrong because if the decryption policy is not matching the traffic, the firewall would simply not decrypt it (passing it through), which would not generate handshake failures. Option D is wrong because if the firewall's certificate is not trusted by clients, clients would generate certificate warnings or errors, but the handshake itself would complete; the failure would occur at the client's trust validation step, not during the handshake.

Full explanation →
390
Drag & Dropmedium

Drag and drop the steps to configure a GlobalProtect portal and gateway on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

GlobalProtect requires portal, gateway, security policy, assignment, and testing.

Full explanation →
391
MCQeasy

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

A.Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.
B.Use a Zone Protection profile to block the IP.
C.Create a security rule with source IP address and action deny.
D.Use a DoS protection policy to block the IP.
AnswerA

This is straightforward and effective; the rule denies traffic from that IP immediately.

Why this answer

Option D is correct because creating a security rule with source zone, source IP, and action deny placed at the top of the rulebase is the direct and simplest method. Option A lacks source zone. Options B and C are more complex and intended for different purposes.

Full explanation →
392
MCQhard

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

A.The server's certificate is using an unsupported cipher
B.The decryption profile's 'Unsupported Modes' is set to 'Block'
C.The decryption policy is not matching the traffic
D.The firewall is not configured with the root CA certificate
AnswerD

Without the full chain, the firewall sends only the server certificate, which browsers may not trust.

Why this answer

When a firewall performs inbound inspection decryption, it re-encrypts traffic using the server's certificate. If the firewall does not have the root CA certificate that issued the server's certificate, the firewall cannot present a complete certificate chain to clients. Clients then see the certificate as untrusted because the issuing CA is not recognized, even though the server's certificate and private key are correctly imported.

Exam trap

Palo Alto Networks often tests the distinction between importing the server certificate (for re-encryption) and importing the root CA certificate (for chain completeness), leading candidates to assume the server certificate alone is sufficient for trust.

How to eliminate wrong answers

Option A is wrong because unsupported ciphers would cause a decryption failure or connection drop, not an 'untrusted certificate' warning; the warning is a client-side trust issue, not a cipher mismatch. Option B is wrong because the 'Unsupported Modes' setting in the decryption profile controls how the firewall handles traffic that cannot be decrypted (e.g., block or allow), not the trust status of a successfully decrypted and re-encrypted certificate. Option C is wrong because if the decryption policy were not matching the traffic, the firewall would not perform decryption at all, and clients would connect directly to the server without seeing any firewall-generated certificate; the 'untrusted certificate' warning specifically indicates the firewall is intercepting and re-encrypting, but the certificate chain is incomplete.

Full explanation →
393
MCQmedium

An administrator configures a security policy rule to block traffic from IP address 10.1.1.1 to 10.2.2.2 on any service. However, traffic from 10.1.1.1 to 10.2.2.2 is still passing through the firewall. After checking all rules, what is the most likely cause?

A.The rule is placed after an allow rule that matches the traffic
B.The source and destination zones are set to 'any'
C.There is an implicit allow rule that overrides the block rule
D.The rule is configured in the PBF rulebase instead of the Security rulebase
AnswerD

Policy-Based Forwarding rules do not enforce security; they only redirect traffic. If the rule was accidentally placed in PBF, it would not block.

Why this answer

Policy-Based Forwarding (PBF) rules are evaluated before security rules and can override security policy decisions. If the traffic matches a PBF rule, it may be forwarded without being subject to the security rulebase, even if a security rule explicitly blocks it. This is the most likely cause because the administrator configured the block in the wrong rulebase.

Exam trap

The trap here is that candidates often assume all traffic filtering is done in the security rulebase and overlook the existence and precedence of the PBF rulebase, which can cause traffic to bypass security rules entirely.

How to eliminate wrong answers

Option A is wrong because security rules are evaluated in order from top to bottom, and a block rule placed after an allow rule that matches the same traffic would still be evaluated; however, the first matching rule (the allow rule) would permit the traffic, so the block rule would never be reached. Option B is wrong because setting source and destination zones to 'any' does not prevent a block rule from matching; it actually broadens the rule's scope and would still block traffic if it were in the correct rulebase. Option C is wrong because there is no implicit allow rule in Palo Alto Networks firewalls; the default action is to deny traffic that does not match any security rule, so an implicit allow does not exist.

Full explanation →
394
MCQhard

Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?

A.Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.
B.Remove the service restriction from rule1.
C.Create a custom application that matches TCP port 8080 and add it to rule1.
D.Change the application in rule1 to 'any' to match all applications.
AnswerC

A custom application allows App-ID to correctly identify HTTP traffic on non-standard ports, and adding it to the rule allows the traffic.

Why this answer

The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.

Exam trap

The trap here is that candidates assume changing the service to 'any' or removing the service restriction will allow the traffic, but they overlook that the application 'web-browsing' still has a default port binding of 80, so the traffic on port 8080 will not be matched by the rule.

How to eliminate wrong answers

Option A is wrong because adding a new rule before rule1 with application 'web-browsing' and service 'tcp-8080' would still not match the traffic, as 'web-browsing' application is typically defined for port 80, not 8080. Option B is wrong because removing the service restriction from rule1 would allow any service, but the application 'web-browsing' still only matches port 80, so the traffic would not be identified as matching the rule. Option D is wrong because changing the application to 'any' would bypass application identification, which is not a best practice and does not address the need to match the specific port 8080 traffic; the firewall would still need a service or application definition for port 8080.

Full explanation →
395
Multi-Selecteasy

Which TWO are best practices for securing management access to a Palo Alto firewall? (Select two)

Select 2 answers
A.Use HTTPS with self-signed certificates
B.Use SNMP v1 for monitoring
C.Use a dedicated management subnet
D.Disable ping on the management interface
E.Restrict management access to specific IP addresses
AnswersC, E

Segregates management traffic from production.

Why this answer

Option C is correct because using a dedicated management subnet (out-of-band management) isolates management traffic from production data traffic, reducing the attack surface and ensuring management access remains available even if the data plane is compromised. This is a foundational security best practice for any network device, including Palo Alto firewalls.

Exam trap

The trap here is that candidates often confuse 'disabling ping' (a minor, non-critical hardening step) with the core best practices of network segmentation and access control, leading them to select Option D instead of the more impactful Options C and E.

Full explanation →
396
MCQmedium

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

A.Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
B.Create a VPC peering connection between the two subnets and attach the firewall.
C.Attach the firewall to a single subnet and use it as a default gateway for both subnets.
D.Configure AWS security groups to route traffic through the firewall.
AnswerA

This allows the firewall to inspect traffic between the subnets.

Why this answer

Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.

Exam trap

The trap here is that candidates often assume a single firewall interface can act as a default gateway for multiple subnets, failing to understand that AWS route tables require explicit next-hop entries for inter-subnet traffic and that the local VPC route cannot be removed.

How to eliminate wrong answers

Option B is wrong because VPC peering connects entire VPCs, not subnets within the same VPC, and it does not inherently route traffic through a firewall; it simply enables direct connectivity. Option C is wrong because attaching the firewall to a single subnet and using it as a default gateway for both subnets would not force inter-subnet traffic through the firewall; default gateways handle traffic destined outside the VPC, not between subnets within the same VPC. Option D is wrong because AWS security groups are stateful virtual firewalls that control inbound/outbound traffic at the instance level, but they cannot be configured to route traffic through a separate firewall appliance; they lack routing capabilities.

Full explanation →
397
MCQhard

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

A.Issue the 'revert to last known good configuration' command.
B.Use 'show configuration saved' and copy the previous config.
C.Use the 'commit revert' command to revert to before the problematic commit.
D.Reboot the firewall to load the previous running config.
AnswerC

Correct: This reverts the configuration to the previous state while keeping uncommitted changes in the candidate.

Why this answer

Option C is correct because the 'commit revert' command in Palo Alto Networks firewalls allows an administrator to revert to the previous committed configuration while preserving any uncommitted changes made after that commit. This is exactly the scenario described: the administrator needs to undo a problematic commit without losing the day's work that has not yet been committed.

Exam trap

The trap here is that candidates may confuse 'commit revert' with a simple rollback or reboot, not realizing that Palo Alto Networks specifically preserves uncommitted changes in the candidate configuration when using 'commit revert'.

How to eliminate wrong answers

Option A is wrong because 'revert to last known good configuration' is not a valid command in Palo Alto Networks; the correct mechanism is 'commit revert'. Option B is wrong because 'show configuration saved' displays the configuration that was saved to disk at the last commit, not the running configuration before the problematic commit, and manually copying it would not preserve uncommitted changes. Option D is wrong because rebooting the firewall loads the last committed configuration from disk, which would discard any uncommitted changes made earlier in the day.

Full explanation →
398
MCQhard

Refer to the exhibit. What is the default gateway of the firewall?

A.10.0.0.1
B.ethernet1/1
C.10.0.0.0
D.0.0.0.0
AnswerA

The default route shows next hop 10.0.0.1.

Why this answer

The default gateway for a firewall is the IP address of the next-hop router that the firewall uses to reach networks not directly connected. In the exhibit, the route with destination 0.0.0.0/0 (the default route) points to next-hop 10.0.0.1, making 10.0.0.1 the default gateway. This is the standard behavior in PAN-OS: the default gateway is defined by the static default route, not by an interface IP.

Exam trap

Palo Alto Networks often tests the distinction between the default route's destination (0.0.0.0/0) and the next-hop IP address, causing candidates to mistakenly select 0.0.0.0 as the gateway.

How to eliminate wrong answers

Option B is wrong because ethernet1/1 is an interface name, not an IP address; the default gateway must be an IP address of a next-hop router. Option C is wrong because 10.0.0.0 is the network address of the subnet, not a usable host address for a gateway. Option D is wrong because 0.0.0.0 is the destination prefix for the default route, not the next-hop gateway address.

Full explanation →
399
MCQhard

An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?

A.Use prefix-based naming conventions for address objects.
B.Use separate device groups in Panorama.
C.Use tags to isolate objects per tenant.
D.Use separate virtual systems (vsys) for each tenant.
AnswerD

Virtual systems create independent logical firewalls, ensuring complete isolation of objects and policies.

Why this answer

Option D is correct because virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.

Exam trap

The trap here is that candidates often confuse administrative separation (like device groups or tags) with true multi-tenant isolation, assuming that naming conventions or Panorama constructs can enforce object boundaries when only virtual systems provide the necessary hardware-enforced separation.

How to eliminate wrong answers

Option A is wrong because prefix-based naming conventions are a manual organizational method and do not prevent a policy from referencing an object from another tenant; they rely on administrator discipline and offer no technical enforcement. Option B is wrong because device groups in Panorama are used for centralized management and template/policy sharing across firewalls, but they do not isolate objects within a single firewall; objects in different device groups can still be referenced in policies if the firewall belongs to multiple groups. Option C is wrong because tags are metadata labels used for filtering and reporting, not for access control or policy enforcement; they do not restrict which objects can be used in security policies.

Full explanation →
400
MCQhard

An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?

A.Install a virtual wire between the virtual routers.
B.Add static routes for the remote subnets in each virtual router.
C.Configure a default route in each virtual router pointing to the other.
D.Create a Security policy rule that allows traffic between the virtual routers.
AnswerD

Inter-virtual-router traffic must be permitted by Security policy to be inspected.

Why this answer

Option D is correct because traffic between virtual routers must be explicitly permitted by a Security policy rule. Even though virtual routers provide separate routing tables, the firewall still enforces policy enforcement points; without a Security rule allowing the traffic, it will be denied by default. This ensures that inter-virtual-router traffic is inspected and controlled by the firewall's security engine.

Exam trap

The trap here is that candidates often confuse routing configuration (static or default routes) with security policy, assuming that if traffic can be routed, it will be allowed, but Palo Alto firewalls require an explicit Security rule to permit traffic between virtual routers.

How to eliminate wrong answers

Option A is wrong because a virtual wire is a Layer 2 transparent interface that bypasses routing and cannot be used to connect virtual routers, which operate at Layer 3. Option B is wrong because static routes only enable routing between virtual routers; they do not allow the firewall to inspect or permit the traffic, which requires a Security policy rule. Option C is wrong because default routes provide a path for traffic but do not override the implicit deny rule; the firewall still blocks inter-virtual-router traffic unless a Security rule explicitly allows it.

Full explanation →
401
MCQeasy

A network administrator wants to ensure that if the primary firewall fails, a secondary firewall takes over without any manual intervention. Which high availability feature is essential for this automatic failover?

A.Heartbeat monitoring
B.Session synchronization
C.Floating IP addresses
D.Preemptive mode
AnswerA

Heartbeat (keepalive) is required for detecting failure and triggering automatic failover.

Why this answer

Heartbeat monitoring is the essential feature for automatic failover because it allows the secondary firewall to detect the primary firewall's failure through continuous health checks. When the heartbeat is lost, the secondary firewall automatically assumes the active role without manual intervention, ensuring high availability.

Exam trap

The trap here is that candidates often confuse session synchronization (which maintains session state) with the actual failover trigger, but without heartbeat monitoring, the secondary firewall would never know when to take over.

How to eliminate wrong answers

Option B is wrong because session synchronization ensures that active sessions are preserved during failover, but it does not trigger the failover itself. Option C is wrong because floating IP addresses provide a consistent virtual IP for client traffic, but they are a mechanism for traffic redirection, not the trigger for automatic failover. Option D is wrong because preemptive mode controls whether the primary firewall automatically resumes the active role after recovery, but it does not enable the initial automatic failover detection.

Full explanation →
402
MCQmedium

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

A.The destination NAT is causing asymmetric routing.
B.The rule is too far down in the rulebase and a previous implicit deny is blocking.
C.A previous rule with a broader match is denying the traffic before reaching the permit rule.
D.The application override is misconfigured.
AnswerC

A rule with deny and broader match earlier in rulebase will block traffic.

Why this answer

Option B is correct because rule order matters; a previous rule with a broader match and deny action will block traffic before reaching the permit rule. Option A is wrong because the implicit deny is at the end, but rules above can deny. Option C is irrelevant; application override does not cause denial.

Option D is about NAT, not denial.

Full explanation →
403
Multi-Selecthard

A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)

Select 2 answers
A.Application
B.User
C.Source address
D.Destination address
E.Service
AnswersC, D

Every rule must have a source address (can be 'any').

Why this answer

In Palo Alto Networks security policy rules, the source and destination addresses are mandatory because the firewall must know which traffic to evaluate. Without a source or destination address, the rule cannot define the traffic flow and would be invalid. The 'allow' action requires at least these two address objects to create a valid rule.

Exam trap

Palo Alto Networks often tests the misconception that Application or Service are mandatory for an 'allow' rule, but Palo Alto Networks allows 'any' for these fields, making source and destination addresses the only mandatory objects.

Full explanation →
404
MCQmedium

A security engineer is creating a security policy that should allow access to Salesforce.com for the sales team. The engineer configures the policy to allow application 'ssl' with no restriction on URL category. How can the engineer ensure that only traffic to Salesforce.com is allowed and not all SSL traffic?

A.Use a destination address object for the known Salesforce IP addresses.
B.Change the application to 'web-browsing' and restrict by URL category.
C.Use App-ID to identify the 'salesforce' application and add a URL category for Salesforce domains.
D.Enable SSL decryption to inspect the traffic.
AnswerC

This combination provides precise identification of Salesforce traffic regardless of IP or encryption.

Why this answer

Option D is correct because using App-ID to identify 'salesforce' application and configuring a URL category for Salesforce domains ensures precise control. Option A is wrong because allowing all SSL traffic is too broad. Option B is wrong because the destination address does not cover all Salesforce IPs, and it's less precise.

Option C is wrong because SSL decryption alone does not restrict access to specific sites without policy application.

Full explanation →
405
MCQeasy

Which of the following is NOT a valid method for upgrading PAN-OS software on a Palo Alto firewall?

A.Using an FTP server
B.Using the CLI
C.Using the Web GUI
D.Using Panorama
AnswerA

FTP is not supported for PAN-OS upgrade.

Why this answer

PAN-OS software upgrades on Palo Alto firewalls are supported via the CLI, the Web GUI, and Panorama. FTP is not a supported method because the firewall's upgrade mechanism relies on HTTP/HTTPS for downloading images from the Palo Alto Networks update server or a local web server; FTP protocol is not implemented in the upgrade process.

Exam trap

The trap here is that candidates may assume FTP is a valid method because it is a common file transfer protocol, but Palo Alto Networks explicitly does not support FTP for PAN-OS upgrades, only HTTP/HTTPS-based downloads.

How to eliminate wrong answers

Option B is wrong because the CLI is a valid upgrade method using commands like 'request system software upgrade'. Option C is wrong because the Web GUI provides a graphical interface under Device > Software to download and install updates. Option D is wrong because Panorama can push PAN-OS upgrades to managed firewalls via the 'Software' tab in the Device Group or Template context.

Full explanation →
406
MCQmedium

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

A.The route via 10.0.0.3 on ethernet1/4
B.The route via 10.0.0.2 on ethernet1/3
C.The route via 10.0.0.4 on ethernet1/5
D.All three routes are used in ECMP
AnswerB

Correct: Lowest preference (10) and lowest metric (10).

Why this answer

The firewall selects the route with the lowest administrative distance (AD) for forwarding traffic to 10.0.1.1. In this scenario, the route via 10.0.0.2 on ethernet1/3 has an AD of 10 (typically OSPF), which is lower than the AD of 20 (static route) and 110 (RIP). Therefore, it is the preferred route.

Exam trap

The trap here is that candidates often assume ECMP applies whenever multiple routes exist, but they overlook that ECMP requires identical administrative distances and metrics, not just the same destination network.

How to eliminate wrong answers

Option A is wrong because the route via 10.0.0.3 on ethernet1/4 has an AD of 20 (static route), which is higher than the AD of 10 for the OSPF route, so it is not the best path. Option C is wrong because the route via 10.0.0.4 on ethernet1/5 has an AD of 110 (RIP), which is the highest among the three, making it the least preferred. Option D is wrong because ECMP (Equal-Cost Multi-Path) requires routes to have identical metrics and AD values; here, the ADs differ (10, 20, 110), so they are not equal-cost and cannot be used in ECMP.

Full explanation →
407
MCQeasy

A small company runs a Palo Alto Networks PA-220 firewall with three zones: trust (internal users), untrust (internet), and dmz (public-facing services). They host a web server on IP 10.0.1.10 in the dmz zone, serving HTTPS content. The administrator created a security policy rule that allows traffic from untrust to dmz with source 'any', destination 10.0.1.10, service HTTPS, and action allow. No security profiles are applied to this rule. Users outside the company can access the web server successfully. However, the administrator notices from log reports that certain application-based attacks, such as SQL injection and cross-site scripting, are reaching the web server undetected. The firewall has the required threat prevention licenses installed. What is the best course of action to improve security posture?

A.Add a decryption policy to decrypt HTTPS traffic for inspection.
B.Change the rule's security profile group to include threat prevention profiles.
C.Move the web server to the trust zone and adjust routing.
D.Enable vulnerability protection profile on the existing rule.
AnswerA

Decryption allows the firewall to see the plaintext content of HTTPS sessions, enabling security profiles to detect and block application-layer attacks.

Why this answer

The correct answer is A because the traffic is HTTPS, which is encrypted. Without decryption, the firewall cannot inspect the payload for application-based attacks like SQL injection or XSS, even with threat prevention licenses. Adding a decryption policy allows the firewall to decrypt the traffic, apply threat prevention profiles, and detect these attacks.

Exam trap

The trap here is that candidates assume threat prevention profiles alone can inspect encrypted traffic, but without decryption, the firewall cannot see the application-layer payload, making profiles ineffective against HTTPS-based attacks.

How to eliminate wrong answers

Option B is wrong because security profiles cannot inspect encrypted traffic without decryption; applying a profile group without decryption would still leave attacks undetected. Option C is wrong because moving the web server to the trust zone would expose internal users to the public-facing service, violating security best practices and not addressing the inspection issue. Option D is wrong because enabling a vulnerability protection profile on the existing rule will not inspect encrypted HTTPS payloads; decryption is a prerequisite for any deep inspection of encrypted traffic.

Full explanation →
408
MCQeasy

A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.

A.The rule order is incorrect; the allow rule is below the 'Deny All' rule.
B.The application 'web-browsing' is not being properly identified by App-ID.
C.The source address object for the allow rule is misconfigured with a wrong subnet mask.
D.The User-ID agent is overriding the allow rule and triggering a block action.
AnswerA

Since the logs show the traffic matches the deny rule, the allow rule must be positioned lower in the rulebase.

Why this answer

Option A is correct because in Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.

Full explanation →
409
MCQmedium

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

A.The TCP sequence numbers are out of order, causing the packets to be out of the expected window.
B.The NAT policy is misconfigured, causing the source IP to not be translated correctly.
C.The security policy uses an incorrect service object that doesn't match the application.
D.Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.
AnswerD

Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.

Why this answer

When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.

Exam trap

The trap here is that candidates often confuse 'tcp-non-syn' with TCP sequence number issues or NAT problems, but the key is recognizing that this drop occurs only when the firewall has no session state, which points directly to asymmetric routing.

How to eliminate wrong answers

Option A is wrong because out-of-order sequence numbers cause 'tcp-out-of-window' drops, not 'tcp-non-syn'; the firewall tracks sequence numbers within the established session window. Option B is wrong because a misconfigured NAT policy would typically cause translation failures or session timeouts, not a 'tcp-non-syn' drop; the firewall would still see the SYN and create a session. Option C is wrong because an incorrect service object would cause a policy match failure or application misidentification, but the firewall would still process the SYN and create a session if the traffic is allowed; the 'tcp-non-syn' drop specifically indicates no prior SYN was seen.

Full explanation →
410
MCQhard

A security engineer must ensure that all traffic from a specific branch office to the internet is inspected by the company's Palo Alto firewall before reaching the internet. However, the branch office has a local router that routes directly to the ISP. What architectural change is required to enforce this?

A.Route all traffic from the branch to the hub site through a VPN tunnel where the firewall is located.
B.Use global VPN to backhaul all traffic to the data center.
C.Install a Palo Alto firewall at the branch office and configure policy-based forwarding.
D.Configure NAT on the branch router to force traffic through the firewall.
AnswerA

By routing traffic through a VPN to the hub where the firewall is located, all traffic can be inspected. This is a common hub-and-spoke architecture.

Why this answer

Option A is correct because it describes a hub-and-spoke VPN topology where all branch office traffic is tunneled to a central hub site that hosts the Palo Alto firewall. This ensures the firewall can inspect all outbound traffic before it reaches the internet, bypassing the branch's direct ISP route. The VPN tunnel (e.g., IPsec) forces traffic through the firewall at the hub, providing centralized security enforcement without requiring a local firewall at the branch.

Exam trap

The trap here is that candidates may confuse GlobalProtect (a remote access VPN) with site-to-site VPN backhaul, or assume that NAT or local PBF can redirect traffic to a remote firewall without a tunnel.

How to eliminate wrong answers

Option B is wrong because GlobalProtect VPN is a remote access VPN solution for individual users, not a site-to-site backhaul mechanism; it does not automatically route all branch traffic to a data center firewall. Option C is wrong because installing a Palo Alto firewall at the branch and using policy-based forwarding (PBF) would enforce inspection locally, but the question requires traffic to be inspected by the company's existing firewall (presumably at a central location), not a new branch firewall. Option D is wrong because configuring NAT on the branch router does not force traffic through a remote firewall; NAT only translates addresses and cannot redirect traffic to a different path without additional routing or tunneling mechanisms.

Full explanation →
411
MCQhard

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

A.Region
B.Address
C.Service
D.Application
AnswerD

Application objects identify traffic by application signatures, allowing port-independent policy enforcement.

Why this answer

The correct answer is D because the question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Exam trap

The trap here is that candidates often confuse Service objects (port-based) with Application objects (app-based), assuming that specifying a port like TCP/443 is sufficient to allow HTTPS traffic, but the PCNSA exam emphasizes that App-ID is required for true application-level control.

How to eliminate wrong answers

Option A is wrong because a Region object is used to group IP addresses by geographic location (e.g., country or continent) for geo-blocking or geo-allow policies, not for identifying applications. Option B is wrong because an Address object defines a specific IP address or subnet (e.g., 10.0.0.0/8) for source or destination matching, not the application layer. Option C is wrong because a Service object defines a protocol and port number (e.g., TCP/443 for HTTPS), which matches traffic based solely on Layer 4 criteria, not the application identity.

Full explanation →
412
MCQeasy

Two Palo Alto Networks firewalls are deployed in an active/passive high availability pair. The passive firewall does not synchronize configuration changes. What is the most likely cause?

A.Link monitoring is disabled.
B.The passive firewall is not configured as a peer.
C.The firewalls are different models.
D.Configuration synchronization is not enabled.
AnswerD

Configuration sync must be enabled in the HA settings to push config from active to passive.

Why this answer

Option D is correct. If session synchronization is enabled but configuration synchronization is not, the passive unit will not receive config changes. Option A is wrong because HA requires both to be the same model and PAN-OS version.

Option B is wrong because link monitoring does not affect config sync. Option C is wrong because the passive unit must be configured as part of the HA pair.

Full explanation →
413
Multi-Selecteasy

An administrator wants to configure SNMP traps to send critical events from a firewall to a receiver at 192.168.1.100. Which TWO configuration objects must be created? (Choose two.)

Select 2 answers
A.Log forwarding profile
B.Email server profile
C.SNMP server profile for traps
D.Syslog server profile
E.SNMP manager object
AnswersA, C

Correct: Selects which logs generate traps.

Why this answer

Option A is correct because a Log Forwarding Profile on a Palo Alto Networks firewall is the configuration object that defines how logs and SNMP traps are sent to external receivers. It allows you to specify the SNMP trap receiver (e.g., 192.168.1.100) and the severity level (e.g., critical) for forwarding events. Option C is correct because an SNMP Server Profile for traps must be created to define the SNMP version, community string, and trap destination, which is then referenced by the Log Forwarding Profile.

Exam trap

The trap here is that candidates often confuse SNMP trap configuration with syslog or email profiles, or mistakenly think a single 'SNMP manager' object is sufficient, when Palo Alto Networks requires both a Log Forwarding Profile and an SNMP Server Profile to be created and linked.

Full explanation →
414
MCQeasy

An administrator configured NTP servers as shown. After committing, the firewall's time is not synchronized. Which additional configuration is required?

A.Configure an authentication key
B.Set time zone manually
C.Enable NTP service under Device > Setup > Services
D.Specify a source interface for NTP
E.Restart NTP service
AnswerC

The NTP service must be enabled to allow synchronization.

Why this answer

Option C is correct because the NTP service must be explicitly enabled on the firewall under Device > Setup > Services before it will synchronize time with any configured NTP servers. Without enabling the NTP service, the firewall ignores the NTP server configuration entirely, even if the servers are reachable and correctly specified.

Exam trap

The trap here is that candidates assume simply configuring NTP server IP addresses under Device > Setup > NTP is sufficient, but Palo Alto Networks requires an explicit enable step under Device > Setup > Services to activate the NTP client service.

How to eliminate wrong answers

Option A is wrong because authentication keys are optional for NTP and are only required if the NTP servers enforce authentication; the question does not indicate that authentication is needed. Option B is wrong because setting the time zone manually is a separate configuration step that does not affect NTP synchronization; NTP synchronizes UTC time, and the time zone is applied afterward. Option D is wrong because specifying a source interface for NTP is optional and only needed when the firewall has multiple interfaces and you want to control which IP address is used for NTP packets; it is not a prerequisite for synchronization.

Option E is wrong because restarting the NTP service is unnecessary if the service has never been enabled; the service must first be turned on before it can be restarted.

Full explanation →
415
MCQmedium

A company requires automatic daily backups of the firewall configuration. Which method should be used?

A.Backup the config using TFTP from the CLI
B.Schedule a configuration backup under Device > Setup > Operations
C.Write a script using the PAN-OS API to copy the running config
D.Use the 'Export Device State' feature manually
AnswerB

Scheduled configuration backups are built-in under Device > Setup > Operations.

Why this answer

Option B is correct because the PAN-OS web interface provides a built-in scheduler under Device > Setup > Operations that allows administrators to automate daily configuration backups without external scripts or manual intervention. This method is the simplest and most reliable way to ensure consistent backups, as it leverages the firewall's native scheduling capability.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing API scripting or manual export, failing to recognize that PAN-OS includes a native, straightforward scheduling mechanism for configuration backups that meets the requirement without additional complexity.

How to eliminate wrong answers

Option A is wrong because TFTP is not a secure protocol and is not recommended for automated daily backups; it also requires an external TFTP server and manual CLI commands, lacking native scheduling. Option C is wrong because writing a script using the PAN-OS API is a valid but unnecessarily complex method for a simple daily backup requirement, and it introduces potential scripting errors and maintenance overhead. Option D is wrong because the 'Export Device State' feature is a manual operation that requires administrator intervention each time, making it unsuitable for automatic daily backups.

Full explanation →
416
Multi-Selecteasy

Which TWO of the following are valid log types on a Palo Alto Networks firewall?

Select 2 answers
A.Authentication logs
B.System logs
C.Traffic logs
D.DHCP logs
E.Threat logs
AnswersC, E

Traffic logs record every session allowed or denied.

Why this answer

Traffic logs are a core log type on Palo Alto Networks firewalls, recording every session that traverses the firewall, including source/destination IPs, ports, and application IDs. Threat logs are also valid, capturing security events such as intrusions, malware, and spyware detected by the firewall's threat prevention engine.

Exam trap

The trap here is that candidates may confuse 'DHCP logs' as a valid log type because DHCP is a common network service, but Palo Alto does not have a dedicated DHCP log category; instead, DHCP events appear in system logs or traffic logs if explicitly configured.

Full explanation →
417
MCQhard

Refer to the exhibit. The firewall cannot reach the Internet. Based on the routing table, what is the most likely cause?

A.The default route is not active because the interface ethernet1/1 is down
B.The next hop 10.1.1.1 is not reachable
C.There is no default route configured
D.The route table is empty because the virtual-router is misconfigured
AnswerA

The route flags show 'A' (active), but the table indicates 0 routes, so the route might be inactive; interface down is a common cause.

Why this answer

The routing table shows a default route (0.0.0.0/0) configured with a next hop of 10.1.1.1 via interface ethernet1/1, but the route is not active (no 'C' flag for candidate). In Palo Alto Networks firewalls, a static route is only installed into the forwarding table if the specified egress interface is administratively up and operationally active. Since ethernet1/1 is down, the route cannot be used, and the firewall has no path to the Internet.

Exam trap

The trap here is that candidates see a default route in the routing table and assume it is active, overlooking the critical detail that the interface is down, which prevents the route from being used for forwarding.

How to eliminate wrong answers

Option B is wrong because the next hop 10.1.1.1 is not reachable only as a consequence of the interface being down; the route itself would still be active if the interface were up and the next hop were unreachable (e.g., via ARP failure), but here the route is not even installed. Option C is wrong because the routing table clearly shows a default route configured (0.0.0.0/0 via 10.1.1.1), so the issue is not a missing default route. Option D is wrong because the routing table is not empty; it contains a default route entry, and the virtual-router is correctly configured to hold that route—the problem is the interface state, not the virtual-router configuration.

Full explanation →
418
Multi-Selecteasy

A network administrator needs to configure certificate-based authentication for administrative access to the firewall's web interface. Which two actions are required?

Select 2 answers
A.Generate a self-signed server certificate on the firewall.
B.Create a local user with a certificate profile.
C.Import a CRL from the issuing CA.
D.Import a CA-signed certificate for the firewall.
E.Assign the certificate to the HTTPS management interface.
AnswersD, E

A CA-signed certificate is needed for trusted HTTPS access.

Why this answer

For certificate-based authentication of administrative access to the firewall's web interface, you must import a CA-signed certificate for the firewall (Option D) because the browser must trust the certificate presented by the firewall during the TLS handshake. Additionally, you must assign that certificate to the HTTPS management interface (Option E) so the firewall uses it for TLS sessions on the management web interface.

Exam trap

The trap here is that candidates confuse server certificate configuration (for the firewall's web interface) with client certificate authentication (for user login), leading them to select options like creating a local user with a certificate profile instead of focusing on the server-side certificate assignment.

Full explanation →
419
MCQmedium

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

A.Tags are case-sensitive
B.The address objects are not in the same zone
C.The group needs a commit after tagging
D.Tags are not case-sensitive
AnswerA

Tags are case-sensitive; 'Production' and 'production' are different.

Why this answer

Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Exam trap

The trap here is that candidates may assume tags are case-insensitive (like many other network device configurations) and overlook the exact-match requirement, leading them to choose Option D or incorrectly attribute the issue to a commit requirement.

How to eliminate wrong answers

Option B is wrong because dynamic address groups match tags globally across all zones; zone membership does not affect tag-based inclusion. Option C is wrong because tagging address objects does not require a commit to update the dynamic group membership — the group is evaluated in real time based on current tags. Option D is wrong because tags are explicitly case-sensitive in Palo Alto Networks firewalls, as demonstrated by the mismatch in this scenario.

Full explanation →
420
MCQhard

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

A.Ensure the application uses a standard port.
B.Ensure SSL decryption is enabled for the application.
C.Check if the application override is applied to the correct rule.
D.Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.
AnswerD

If traffic is blocked by an earlier rule, App-ID never processes it.

Why this answer

Option D is correct because App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Exam trap

The trap here is that candidates assume an application override is a standalone fix that works regardless of the security policy rule's App-ID setting, when in fact the override is only evaluated if the rule has App-ID enabled and the traffic matches that rule.

How to eliminate wrong answers

Option A is wrong because App-ID is designed to identify applications regardless of port, and application overrides do not require a standard port; in fact, many custom applications use non-standard ports. Option B is wrong because SSL decryption is only needed if the application traffic is encrypted and you want to inspect the payload, but the application override itself does not require decryption to be enabled. Option C is wrong because the application override is a configuration object that maps a custom application to a specific signature or port, and while it must be applied to a rule, the first verification step is to confirm the traffic is actually hitting a security policy rule with App-ID enabled, not just that the override is attached to any rule.

Full explanation →
421
MCQmedium

A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?

A.Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10
B.Search Threat logs for the destination IP
C.Search Config logs for any rule changes
D.Search System logs for the user's IP
AnswerA

Traffic logs show the action (allow/deny/drop) for each session, and filtering by IPs narrows down the specific session.

Why this answer

Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.

Exam trap

The trap here is that candidates may assume a block must be due to a threat or misconfiguration, leading them to check Threat or Config logs, but the correct approach is to examine Traffic logs where the firewall records all session dispositions, including implicit denials.

How to eliminate wrong answers

Option B is wrong because Threat logs record intrusion prevention system (IPS) and antivirus events, not basic traffic denials; a block due to missing rules would not appear there. Option C is wrong because Config logs track administrative changes to the firewall configuration, not real-time traffic decisions; they would not show why current traffic is blocked. Option D is wrong because System logs contain system-level events (e.g., reboots, license expirations) and do not include per-session traffic details; they cannot reveal why a specific flow is denied.

Full explanation →
422
MCQeasy

Refer to the exhibit. A firewall administrator is reviewing a Panorama template configuration. What is the purpose of the 'profile' statement under the interface?

A.It applies a security rule.
B.It applies a QoS profile.
C.It applies a Zone Protection profile.
D.It applies an interface management profile.
AnswerD

Correct: The 'profile' under an interface refers to the management profile that defines allowed services (like ping, SSH).

Why this answer

The 'profile' statement under an interface in Panorama template configuration is used to apply an interface management profile. This profile controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface, thereby securing administrative access. It does not apply security rules, QoS, or zone protection, which are configured elsewhere.

Exam trap

The trap here is that candidates often confuse the 'profile' statement with a security profile (like Anti-Virus or Vulnerability Protection) or a Zone Protection profile, but in the context of interface configuration, it specifically refers to the interface management profile that controls administrative access.

How to eliminate wrong answers

Option A is wrong because security rules are applied via Security policy rules in Panorama, not through an interface's 'profile' statement. Option B is wrong because QoS profiles are configured under the QoS policy or interface QoS settings, not via the 'profile' statement under the interface. Option C is wrong because Zone Protection profiles are applied to zones, not directly to interfaces; the 'profile' statement under the interface specifically refers to management access control.

Full explanation →
423
Multi-Selectmedium

Which TWO of the following are methods to identify users for User-ID? (Choose two.)

Select 2 answers
A.Captive Portal
B.Kerberos Authentication
C.LDAP Synchronization
D.XML API
E.User-ID Agent
AnswersA, E

Captive Portal authenticates users directly and maps IPs.

Why this answer

Options A and D are correct. User-ID agent collects user mappings from AD; Captive Portal authenticates users directly. LDAP sync is not a method for User-ID; it's a protocol.

XML API can be used but not standard method. Kerberos is not directly used.

Full explanation →
424
MCQhard

Refer to the exhibit. An administrator observes that HTTP requests from the 10.0.0.0/24 network to the 172.16.1.0/24 network are being logged but the logs show that the action taken is 'deny'. What is the most likely cause?

A.The rule 'Allow-Web' is disabled
B.The application 'web-browsing' is not correctly identified
C.The rule 'Allow-Web' is configured with action 'deny'
D.A different rule with higher priority is matching the traffic and denying it
AnswerD

Even though this rule matches, if a higher-priority rule denies the traffic, the log will reflect the deny from the first matching rule.

Why this answer

Option B is correct because the rule has 'log-start' enabled, which generates a log entry before the actual action is determined. If another rule with higher priority denies the traffic, the log will show the result of the first matching rule. Option A is wrong because the rule itself has action allow, so if it matches, it would allow.

Option C is wrong because even if the rule is disabled, it would not produce a log. Option D is wrong because the rule explicitly allows web-browsing.

Full explanation →
425
Matchingmedium

Match each security rule type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Blocks known attack patterns

Controls access to websites

Prevents transfer of specific file types

Prevents sensitive data exfiltration

Why these pairings

These are rule types in Security policies.

Full explanation →
426
MCQmedium

A company is migrating from a legacy firewall to a Palo Alto Networks firewall. The legacy policy has many rules with overlapping source and destination objects. Which feature should the administrator use to simplify the policy before migration?

A.Policy Optimizer
B.WildFire
C.Application Override
D.User-ID
AnswerA

Policy Optimizer identifies unused and redundant rules and suggests optimizations.

Why this answer

Option C is correct because Policy Optimizer analyzes existing rules and suggests merging or removing redundant rules. Option A is wrong because Application Override is not used for simplifying rules. Option B is wrong because WildFire is a threat analysis cloud.

Option D is wrong because User-ID maps users to IPs, not simplify rules.

Full explanation →
427
MCQeasy

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

A.Configure a zone protection profile on the DMZ zone.
B.Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.
C.Create a rule allowing traffic from DMZ to Untrust with a deny action.
D.Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.
AnswerD

The default inter-zone rule blocks all traffic that is not explicitly allowed.

Why this answer

Option D is correct because, by default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Exam trap

The trap here is that candidates often assume they must create an explicit deny rule to block traffic from DMZ to Untrust, not realizing that Palo Alto Networks firewalls already block all inter-zone traffic by default unless a permit rule is explicitly configured.

How to eliminate wrong answers

Option A is wrong because a zone protection profile is used to protect a zone from flood attacks, reconnaissance, or packet-based attacks; it does not control inter-zone traffic flow or block outbound connections from DMZ to Untrust. Option B is wrong because creating a rule allowing traffic from DMZ to Untrust would explicitly permit the very connections the administrator wants to block, violating the security requirement. Option C is wrong because creating a rule with a deny action for DMZ to Untrust is unnecessary and redundant; the default implicit deny already blocks this traffic, and adding an explicit deny rule only adds administrative overhead without changing the behavior.

Full explanation →
428
MCQmedium

A company uses Palo Alto Networks firewalls and wants to decrypt inbound traffic to their web server. Which decryption type should be configured?

A.SSL Inbound Inspection
B.SSH Proxy
C.SSL Inbound Decryption
D.SSL Forward Proxy
AnswerC

This decrypts incoming traffic to servers using the server's private key.

Why this answer

SSL Inbound Decryption is the correct decryption type for decrypting inbound traffic to a web server. It allows the firewall to decrypt traffic destined for a server by presenting a certificate that the client trusts, enabling inspection of the payload for threats. This is distinct from forward proxy decryption, which is used for outbound traffic from internal clients.

Exam trap

The trap here is confusing 'SSL Inbound Decryption' with 'SSL Forward Proxy', as candidates often mistakenly think forward proxy handles all decryption, but it is specifically for outbound traffic, not inbound traffic to a server.

How to eliminate wrong answers

Option A is wrong because 'SSL Inbound Inspection' is not a standard Palo Alto Networks decryption type; the correct term is 'SSL Inbound Decryption'. Option B is wrong because SSH Proxy is used to decrypt SSH traffic for policy control, not for decrypting inbound HTTPS traffic to a web server. Option D is wrong because SSL Forward Proxy is designed to decrypt outbound traffic from internal clients to external servers, not inbound traffic to a company's web server.

Full explanation →
429
Multi-Selecthard

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Select 2 answers
A.Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.
B.Execute 'set address-group <name> add ip <ip>' in CLI.
C.Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.
D.Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.
E.Create a tag, assign it to the IP address, and add the tag to the group.
AnswersA, C

This feature allows adding new address objects directly.

Why this answer

Option A is correct because the 'Show Group Membership' feature in the PAN-OS web interface allows you to view all members of an address group and directly add a new address object by clicking 'Add New Address'. This creates a new address object and adds it to the group in one step. Option C is correct because navigating to Objects > Address Groups, selecting the group, and clicking 'Add' lets you add an existing address object to the group, though you cannot type an IP directly—you must select an existing address object from the list.

Exam trap

The trap here is that candidates confuse the 'Add' button in the address group editor (which only adds existing address objects) with the ability to type an IP directly, and they mistakenly think the CLI command 'set address-group ... add ip' is valid when the correct syntax requires a pre-existing address object.

Full explanation →
430
MCQhard

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

A.Configure each VM-Series firewall independently
B.Rely on cloud-native security groups instead of VM-Series
C.Use a single security policy applied to all firewalls via an API script
D.Deploy Panorama and manage all VM-Series firewalls from a single console
AnswerD

Panorama centralizes policy management, ensuring consistency.

Why this answer

Option D is correct because Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Exam trap

The trap here is that candidates may think a simple API script (Option C) is sufficient for centralized management, overlooking Panorama's built-in features for policy versioning, commit workflows, and multi-device configuration synchronization that are essential for enterprise-scale consistency.

How to eliminate wrong answers

Option A is wrong because configuring each VM-Series firewall independently introduces configuration drift and operational overhead, making consistent policy management across multiple cloud accounts impractical. Option B is wrong because cloud-native security groups lack the advanced threat prevention, application visibility, and granular policy controls that VM-Series firewalls provide, and they cannot be centrally managed via Panorama. Option C is wrong because using a single security policy via an API script is brittle, lacks version control, rollback capabilities, and the structured multi-tenancy features of Panorama, and does not handle device-specific configurations like interfaces or zones.

Full explanation →
431
MCQmedium

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

A.Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow
B.Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow
C.Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow
D.Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow
AnswerC

This correctly permits internal users to access the DMZ web server using web-browsing application.

Why this answer

Option A is correct because traffic from trust to DMZ with application 'web-browsing' permits HTTP/HTTPS access. Option B is wrong because service 'any' is too broad. Option C is wrong because source zone should be 'trust', not 'DMZ'.

Option D is wrong because destination zone should be 'DMZ', not 'trust'.

Full explanation →
432
MCQhard

An administrator configures a custom App-ID signature using a packet buffer override. What is the implication?

A.The custom signature will only match on specific ports.
B.The custom signature will be ignored if it conflicts with built-in.
C.The custom signature requires a separate license.
D.The firewall will use the custom signature instead of the default.
AnswerD

Packet buffer override replaces the built-in signature for that application.

Why this answer

When a custom App-ID signature is configured with a packet buffer override, the firewall is instructed to use the custom signature's definition to identify the application instead of relying on the default built-in App-ID signature. This override ensures that the custom signature takes precedence over any existing default signature for the same application, allowing the administrator to enforce a specific application identification behavior.

Exam trap

The trap here is that candidates mistakenly think a packet buffer override only affects port-based matching or that custom signatures are always subordinate to built-in signatures, when in fact the override explicitly gives the custom signature priority.

How to eliminate wrong answers

Option A is wrong because a packet buffer override does not restrict matching to specific ports; App-ID signatures can match on content regardless of port, and the override only affects which signature is used. Option B is wrong because the packet buffer override is specifically designed to resolve conflicts by making the custom signature take precedence over the built-in one, not to be ignored. Option C is wrong because custom App-ID signatures do not require a separate license; they are a standard feature of the App-ID engine available in the base firewall subscription.

Full explanation →
433
Drag & Dropmedium

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Security policies are configured by first defining zones, then addresses, then application/service, then action, and finally committing.

Full explanation →
434
MCQmedium

Refer to the exhibit. What is the PAN-OS version running on the firewall?

A.10.2.0
B.10.1.0
C.9.1.0
D.10.0.0
AnswerA

The output clearly shows sw-version: 10.2.0.

Why this answer

The PAN-OS version is determined by the first two digits of the version string displayed in the CLI output (e.g., '10.2.0'). In the exhibit, the firewall shows '10.2.0', which corresponds to PAN-OS 10.2.0. This is the correct version because the CLI command 'show system info' or the GUI dashboard displays the exact software version installed.

Exam trap

The trap here is that candidates may confuse the major version (e.g., 10) with the full version string, overlooking the minor version digit (e.g., .2) and selecting a wrong but similar-sounding version like 10.0.0 or 10.1.0.

How to eliminate wrong answers

Option B (10.1.0) is wrong because the version string in the exhibit explicitly shows '10.2.0', not '10.1.0', which would indicate a different major release. Option C (9.1.0) is wrong because that version would display as '9.1.0' in the output, and the exhibit shows a higher major version (10.x). Option D (10.0.0) is wrong because the version string is '10.2.0', not '10.0.0'; the second digit (minor version) differs, indicating a different feature release.

Full explanation →
435
MCQeasy

An administrator configures log forwarding to send traffic logs to a syslog server. After applying the log forwarding profile to the security policy, logs are not appearing at the syslog server. The administrator verifies that the syslog server is reachable from the firewall's management IP by using ping, and that the syslog service is running on the server. What is the most likely cause?

A.The security policy matching the traffic does not have logging enabled.
B.The firewall's data port IP is not used for logging.
C.The syslog server is not configured in the Server Profiles.
D.The log forwarding profile is not committed.
AnswerC

The server profile must exist before it can be referenced.

Why this answer

Option C is correct because log forwarding in Palo Alto Networks firewalls requires a syslog server profile to be configured under Device > Server Profiles > Syslog. Without this profile, the firewall has no destination address or port to send logs to, even if the syslog server is reachable via ping. The log forwarding profile references the server profile; if the server profile is missing or misconfigured, logs will not be forwarded.

Exam trap

The trap here is that candidates assume reachability (ping) and a running syslog service are sufficient, overlooking the mandatory server profile configuration that ties the log forwarding profile to an actual syslog destination.

How to eliminate wrong answers

Option A is wrong because the question states that the log forwarding profile was applied to the security policy, which implies logging is enabled at the policy level (logging at session end is a prerequisite for forwarding). Option B is wrong because log forwarding uses the firewall's management plane (management IP) by default, not the data port IP; the data port IP is irrelevant for syslog forwarding. Option D is wrong because the administrator applied the profile after configuring it, and the question does not mention any pending changes; if the profile were not committed, the firewall would typically show an uncommitted change indicator, but the core issue is the missing server profile, not a commit state.

Full explanation →
436
Drag & Dropmedium

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

User-ID setup involves enabling on interface, configuring agent, mapping users, creating policies, and verification.

Full explanation →
437
MCQhard

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

A.Create an allow rule for all users, then a deny rule for HR with application social-media.
B.Create a deny rule for the HR user group with application social-media before the allow rule.
C.Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.
D.Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.
AnswerD

This correctly uses user-ID and places the deny before the allow to block HR users' social media traffic.

Why this answer

Option D is correct because rules are evaluated top-down; the deny rule must come before the allow rule to block the targeted users. Option A lacks user-ID. Option B order is wrong.

Option C places deny after allow, so it will never be hit.

Full explanation →
438
Multi-Selectmedium

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Select 3 answers
A.Schedule
B.User
C.Application group
D.Service
E.Address
AnswersA, D, E

Schedule objects define time-based access.

Why this answer

Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.

Exam trap

The trap here is that candidates may confuse 'User' as a valid object type because it appears in policy configuration, but Palo Alto Networks does not have a standalone 'User' object; instead, users are handled via User-ID and authentication profiles.

Full explanation →
439
MCQhard

An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.

A.The security rule uses application 'ssl' but not 'web-browsing' for the traffic.
B.The firewall is missing the latest content updates for WildFire.
C.The decryption exclusion list includes the domain of the malware source.
D.The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.
AnswerD

The default profile uses only local signatures; without WildFire analysis, new or customized malware can bypass.

Why this answer

Option B is correct because the default malware profile may rely on known signatures and may not detect unknown malware; a profile with WildFire analysis is needed. Option A is incorrect because the domain is not in the excluded category. Option C is plausible but less likely given that the malware uses a custom packer; WildFire would help if enabled.

Option D is incorrect because 'ssl' is the application for decrypted SSL traffic, and 'web-browsing' would also apply if HTTP is used, but the actual application is detected correctly.

Full explanation →
440
Multi-Selecteasy

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Select 3 answers
A.Configure a DNS proxy to resolve domain names.
B.Assign an IP address to the internal interface and set it as a Layer 3 interface.
C.Enable User-ID to identify users on the network.
D.Create a Security policy rule that allows traffic from internal zone to external zone.
E.Configure a source NAT policy to translate internal private IP addresses to the external public IP.
AnswersB, D, E

Required for internal network connectivity.

Why this answer

Option B is correct because the internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.

Exam trap

The trap here is that candidates often confuse optional features like DNS proxy or User-ID as mandatory steps, when in fact the core requirements are interface configuration, security policy, and NAT for outbound access.

Full explanation →
441
MCQmedium

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

A.Denied because the source is not specified in Allow_Web.
B.Denied by rule Block_ALL because it is the last rule.
C.Allowed by rule Allow_Web because service tcp/443 matches.
D.Allowed by rule Allow_Web because application ssl matches.
AnswerC

HTTPS uses tcp/443, and the rule allows that service along with application ssl.

Why this answer

Option C is correct. The rule Allow_Web has application ssl which matches HTTPS, and service tcp/443 matches. So the traffic is allowed.

Option A is partially correct but best answer is C because service is explicitly matched. Option B is not hit as the traffic matches Allow_Web first. Option D is incorrect because source is any.

Full explanation →
442
MCQmedium

Refer to the exhibit. An administrator is analyzing the rulebase. Traffic from source 10.1.1.5 to destination 8.8.8.8 using web-browsing application (HTTP TCP/80). Which rule will match?

A.rule3.
B.rule2.
C.rule1.
D.None, because rule1 and rule2 have specific applications.
AnswerA

rule3 matches the traffic because source subnet includes 10.1.1.5 and application any.

Why this answer

Option B is correct because rule3 has source 10.1.1.0/24 and application any, matching the traffic. rule1 does not match because it only allows ssl application. rule2 does not match because its source is 10.1.0.0/24, which does not include 10.1.1.5. Therefore, rule3 is the first matching rule, and it denies the traffic.

Full explanation →
443
Multi-Selectmedium

Which TWO of the following are valid dataplane components in a Palo Alto Networks firewall?

Select 2 answers
A.Management Plane
B.Routing table
C.Panorama
D.Session table
E.Flow accelerator (FPGA)
AnswersD, E

The session table is part of the dataplane for tracking connections.

Why this answer

The session table is a core dataplane component because it stores the state of active sessions, enabling the firewall to perform stateful inspection and apply security policies at wire speed. The flow accelerator (FPGA) is a hardware-based dataplane component that offloads packet processing from the CPU, accelerating throughput for established sessions.

Exam trap

The trap here is confusing architectural planes (management, control, data) with specific components, leading candidates to mistakenly select the routing table (control plane) or Panorama (management plane) as dataplane components.

Full explanation →
444
Multi-Selectmedium

A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?

Select 2 answers
A.Create an address group and add individual address objects for each server IP.
B.Create a single address object with IP range 192.168.10.1-192.168.10.254.
C.Create a single address object with IP subnet 192.168.10.0/24.
D.Create a dynamic address group using tags applied to individual address objects.
E.Create a predefined address object from the global cache.
AnswersC, D

A subnet address object directly represents the entire subnet and is the most efficient method.

Why this answer

Option C directly uses the subnet as an address object, which is efficient for a contiguous subnet. Option D uses a dynamic address group with tags, allowing flexible grouping without manual updates. Option A uses a range, which is less efficient for a subnet.

Option B requires creating multiple individual objects. Option E is not a valid concept.

Full explanation →
445
MCQhard

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

A.Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.
B.Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.
C.Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.
D.Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.
AnswerA

This allows selective bypassing of threat inspection for video traffic while inspecting the rest.

Why this answer

Option A is correct because it uses two security rules with different priorities: a higher-priority rule for video conferencing traffic with an 'allow' action and no threat profile to bypass inspection, and a lower-priority rule for general traffic with an 'allow' action and a threat profile to enforce malware inspection. This leverages the firewall's rule-ordering logic, where the first matching rule is applied, allowing selective bypass of threat inspection for specific traffic while maintaining security for other traffic.

Exam trap

The trap here is that candidates may assume the firewall can automatically detect and exempt video traffic from inspection without explicit rule configuration, or that a single rule with a threat profile can be configured to skip inspection for certain applications, but Palo Alto firewalls require separate rules or profile exceptions to achieve selective bypass.

How to eliminate wrong answers

Option B is wrong because creating a single rule with no security profiles would allow all traffic without any threat inspection, failing to meet the requirement to inspect general traffic for malware. Option C is wrong because firewalls do not automatically skip threat inspection for video traffic based on traffic type alone; a specific rule or profile exception must be configured. Option D is wrong because policy-based forwarding (PBF) is used to route traffic based on policies, not to selectively apply or bypass security profiles; it would add unnecessary complexity and does not directly control threat inspection on the same interface.

Full explanation →
446
MCQhard

An administrator wants to protect the firewall management interface from unauthorized access. The management interface is on a separate management network. Which of the following is the best security practice to restrict access?

A.Configure 'Permitted IP Addresses' under Device > Setup > Management.
B.Create a security policy rule that blocks traffic to the management interface.
C.Apply an interface management profile to the management interface.
D.Enable 'Trusted Management Stations' under firewall settings.
AnswerA

This setting restricts management access to a predefined list of IP addresses.

Why this answer

Option B is correct. Creating an ACL on the management interface using the 'permitted IP addresses' setting is the standard method to restrict management access. Option A is wrong because interface management profiles are for dataplane interfaces, not the management interface itself.

Option C is wrong because security policies do not apply to management traffic. Option D is wrong because the 'trusted management stations' option is not a configuration on the firewall.

Full explanation →
447
MCQeasy

A security administrator wants to block traffic from a specific country using the firewall. How can this be achieved with minimal administrative overhead?

A.Configure an External Dynamic List (EDL) and reference it in a rule.
B.Create a security rule with a source region of the specified country.
C.Manually add all IP subnets from that country to a block rule.
D.Disable routing to that country through the firewall.
AnswerB

The firewall can match by geographic region using the geo-location feature.

Why this answer

Option B is correct because Palo Alto Networks firewalls include a built-in Geolocation database that maps IP addresses to countries. By creating a security rule with the source region set to the specific country, the firewall automatically applies the block without requiring manual IP management or external feeds, minimizing administrative overhead.

Exam trap

The trap here is that candidates may think an EDL (Option A) is required for country-based blocking, overlooking the built-in Geolocation feature that directly supports region-based rules with zero external configuration.

How to eliminate wrong answers

Option A is wrong because an External Dynamic List (EDL) requires maintaining an external list of IP addresses or URLs, which adds administrative overhead and is unnecessary when the built-in Geolocation feature can directly block by country. Option C is wrong because manually adding all IP subnets from a country is impractical, error-prone, and creates high administrative overhead due to the large number of constantly changing subnets. Option D is wrong because disabling routing to a country through the firewall does not block traffic; it only prevents the firewall from forwarding traffic to that destination, but the firewall can still receive and process traffic from that country, and this approach does not use a security rule to enforce the block.

Full explanation →
448
MCQmedium

A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?

A.A Zone Protection profile is dropping the traffic.
B.The Security policy rule has a DoS Protection profile applied that is dropping traffic.
C.A decryption policy is blocking the traffic.
D.The Security policy rule has a source zone mismatch.
AnswerB

DoS Protection profiles can drop traffic even if the rule permits it.

Why this answer

When a Security policy rule permits traffic but it is still blocked, the most likely cause is that a DoS Protection profile is applied to the rule. DoS Protection profiles can drop traffic based on session rate thresholds or other attack signatures, even when the base Security rule allows the session. This is a common misconfiguration because the profile operates as an additional enforcement layer above the permit action.

Exam trap

The trap here is that candidates often confuse Zone Protection profiles (applied to zones) with DoS Protection profiles (applied to Security rules), leading them to incorrectly select Zone Protection as the cause of a per-rule traffic block.

How to eliminate wrong answers

Option A is wrong because Zone Protection profiles are applied to zones, not to individual Security policy rules, and they typically protect against flood attacks at the zone level, not per-rule traffic drops. Option C is wrong because a decryption policy controls whether traffic is decrypted or not, not whether it is blocked; decryption policies do not drop traffic by themselves. Option D is wrong because a source zone mismatch would cause the Security rule to not match at all, resulting in a default deny, but the question states the rule permits the traffic, implying the rule is matched correctly.

Full explanation →
449
MCQhard

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

A.OSPF is flapping and causing route instability.
B.Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.
C.A DDoS attack is overwhelming the management plane.
D.The firewall's licenses have expired, causing feature degradation.
AnswerB

Asymmetric routing can cause sessions to be stuck and high management CPU as the firewall tries to process out-of-state packets.

Why this answer

In an active/passive HA configuration, only the active firewall processes traffic. If asymmetric routing occurs—where traffic from the internal network to the internet uses one ISP link on the active firewall, but return traffic arrives via the other ISP link—the active firewall may see the return traffic as a new session or a non-symmetric flow. This causes the firewall to create sessions that remain in 'active' state with minimal data transfer, as the firewall attempts to match return packets to existing sessions but fails due to path asymmetry.

The high CPU on the management interface results from the control plane processing these mismatched sessions, while the passive firewall is unaffected because it does not handle traffic.

Exam trap

The trap here is that candidates often attribute high CPU on the management interface to a DDoS attack or license issues, but the key clue is the 'active' sessions with minimal data transfer, which points to asymmetric routing in an HA environment rather than a control-plane attack or feature degradation.

How to eliminate wrong answers

Option A is wrong because OSPF neighbor relationships are stable, as stated in the scenario, and there is no evidence of route flapping; OSPF flapping would cause route instability and neighbor state changes, not high CPU on the management interface with many active sessions. Option C is wrong because a DDoS attack overwhelming the management plane would typically cause high CPU on the management interface but would also likely show a flood of sessions in various states (e.g., SYN_SENT or TIME_WAIT), not specifically 'active' sessions with minimal data transfer; additionally, the passive firewall would not be immune if the attack targeted the management IP. Option D is wrong because expired licenses cause feature degradation (e.g., no threat prevention or URL filtering), but they do not cause high CPU on the management interface or create many active sessions with minimal data transfer; the firewall would still forward traffic normally for basic connectivity.

Full explanation →
450
MCQmedium

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

A.Subscribe to the WildFire cloud and rely on updates.
B.Set the content update schedule to check every minute.
C.Manually download the latest content from the support portal and upload via CLI.
D.Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.
AnswerD

Correct: This triggers an immediate download of the latest content.

Why this answer

Option D is correct because enabling 'automatic download' for threat prevention content and setting the schedule to 'check now' forces the firewall to immediately contact the update server (typically Palo Alto Networks' update portal) and download the latest signature package. This method leverages the built-in content update mechanism, which is designed to retrieve and install updates as soon as they are released, without waiting for a scheduled interval or manual intervention.

Exam trap

The trap here is that candidates often confuse WildFire cloud subscription (option A) with automatic content delivery, not realizing that WildFire generates signatures but the firewall must still be configured to download them via the content update mechanism.

How to eliminate wrong answers

Option A is wrong because subscribing to the WildFire cloud provides cloud-based analysis and signature generation, but it does not automatically push signatures to the firewall; the firewall must still be configured to download the content updates. Option B is wrong because setting the content update schedule to check every minute is not supported; the minimum check interval is typically 15 minutes, and even then, it only checks at that interval, not immediately upon release. Option C is wrong because manually downloading from the support portal and uploading via CLI is a reactive, time-consuming process that introduces delay and requires human intervention, making it unsuitable for immediate updates.

Full explanation →
Page 5

Page 6 of 7

Page 7

All pages

1234567

Practice PCNSA by domain

Target a specific domain to shore up weak areas.

Managing ObjectsPolicy Evaluation and ManagementSecuring TrafficCore ConceptsPalo Alto Networks Platforms and ArchitectureDevice Management and ServicesApp-ID and Content-IDDecryption and Monitoring
See all domains with question counts →