How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the PCNSA exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCNSA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Palo Alto Networks Certified Network Security Administrator PCNSA questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCNSA

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

A
Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.
This permits HTTP and HTTPS traffic.
B
Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.
Why wrong: Decryption is not required for threat inspection on standard ports; the firewall can inspect without decryption.
C
Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.
Why wrong: Allowing all traffic would permit non-HTTP/HTTPS protocols.
D
Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.
Why wrong: This would block the intended traffic as well.
E
Attach a Vulnerability Protection profile to the Security policy rule.
This inspects traffic for threats.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related PCNSA topic practice pages

Managing Objects practice questions

Policy Evaluation and Management practice questions

Securing Traffic practice questions

Core Concepts practice questions

Palo Alto Networks Platforms and Architecture practice questions

Device Management and Services practice questions

App-ID and Content-ID practice questions

Decryption and Monitoring practice questions

PCNSA fundamentals practice questions

PCNSA scenario practice questions

PCNSA troubleshooting practice questions

Practice scenarios

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Which two components are part of Content-ID? (Choose two.)

Which TWO of the following are true about App-ID? (Choose two.)

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Which TWO are capabilities of Content-ID? (Choose two.)

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Which THREE are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose three.)

Which THREE actions can a Security policy rule perform on traffic?