Courseiva

CCNA Paloalto Platforms Questions

69 questions · Paloalto Platforms topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQeasy

A company has a PA-5250 firewall with 10 Gbps threat prevention throughput. They are planning to enable SSL decryption for all traffic. What is the most likely impact on the firewall's throughput?

A.Throughput will decrease, typically by 30-50% depending on traffic.
B.Throughput will remain the same because the firewall uses dedicated hardware.
C.Throughput will increase due to offloading encryption to hardware.
D.Throughput will decrease only if decryption is applied to video traffic.
AnswerA

Decryption consumes CPU resources, reducing throughput.

Why this answer

SSL decryption requires the firewall to intercept, decrypt, inspect, and re-encrypt traffic. This process is computationally intensive, especially for high-throughput environments. Even with dedicated hardware, the PA-5250's threat prevention throughput is rated without decryption; enabling it typically reduces throughput by 30-50% due to the overhead of cryptographic operations and deep packet inspection on decrypted content.

Exam trap

The trap here is that candidates assume dedicated hardware offloads all encryption overhead, ignoring that SSL decryption requires additional processing for inspection and re-encryption, which reduces overall throughput even with hardware acceleration.

How to eliminate wrong answers

Option B is wrong because while the PA-5250 uses dedicated hardware (e.g., DP processors), SSL decryption still imposes significant CPU and memory overhead for key exchange, certificate validation, and encryption/decryption, so throughput does not remain the same. Option C is wrong because offloading encryption to hardware reduces the overhead of encryption/decryption but does not increase throughput; the firewall must still perform inspection on decrypted traffic, which consumes resources. Option D is wrong because throughput decrease is not limited to video traffic; all decrypted traffic (HTTP, SMTP, etc.) requires inspection, and the performance impact is proportional to the volume and complexity of decrypted sessions.

Practice this question →
2
MCQhard

Based on the exhibit, what will happen when a user in the trust zone attempts to access an HTTPS website (TCP 443)?

A.The traffic will be allowed if the user uses HTTP instead.
B.The traffic will be allowed because the rule has log-start enabled.
C.The traffic will be allowed because the source and destination zones match.
D.The traffic will be denied by the implicit deny rule because the application does not match.
AnswerD

No rule matches HTTPS; implicit deny applies.

Why this answer

Option D is correct because the security rule shown in the exhibit specifies the application as 'ssl' (HTTPS), but the user is attempting to access an HTTPS website using TCP 443. However, the rule's application match is likely set to a different application or the traffic is being classified as 'web-browsing' or another application that does not match the rule's application condition. Since no rule explicitly permits the traffic, the implicit deny rule at the end of the rulebase will block it.

Palo Alto Networks firewalls use App-ID to identify applications regardless of port, so even if TCP 443 is used, the application must match exactly for the rule to apply.

Exam trap

The trap here is that candidates assume that because the source and destination zones match and the port is standard (TCP 443), the rule will permit the traffic, but they overlook the critical requirement that the application must also match the rule's application condition.

How to eliminate wrong answers

Option A is wrong because the rule does not specify HTTP (TCP 80) as an allowed application, and changing the protocol does not automatically permit the traffic; the user would need a separate rule allowing HTTP. Option B is wrong because log-start enabled only logs the start of a session; it does not affect the allow/deny decision of the rule. Option C is wrong because matching source and destination zones alone is insufficient; the rule also requires matching the application, user, and other attributes for the traffic to be permitted.

Practice this question →
3
Multi-Selecteasy

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Select 2 answers
A.Microsoft Hyper-V
B.KVM
C.VMware ESXi
D.Docker
E.Oracle VirtualBox
AnswersB, C

KVM is a supported hypervisor for VM-Series firewalls.

Why this answer

KVM (Kernel-based Virtual Machine) is a supported hypervisor for Palo Alto Networks firewalls, allowing deployment as a virtual machine (VM) on Linux-based virtualization platforms. Palo Alto Networks provides specific VM images (e.g., KVM-compatible QCOW2 format) for KVM environments, making it a valid method for virtualized deployments.

Exam trap

The trap here is that candidates often assume any popular virtualization platform (like Hyper-V or VirtualBox) is supported, but Palo Alto Networks strictly validates only KVM and VMware ESXi for on-premises virtual firewalls, excluding others due to lack of driver optimization and testing.

Practice this question →
4
MCQmedium

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

A.The firewall's CPU and memory are insufficient for the new PAN-OS version.
B.The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.
C.The firewall is performing a backup of the configuration.
D.The rulebase has grown too large.
AnswerB

After an upgrade, the system often performs a full commit to apply structural changes, which is slower.

Why this answer

Option B is correct because after a PAN-OS upgrade, the firewall performs a full commit of the entire configuration, which processes all configuration objects, rules, and policies from scratch. This is inherently slower than a partial commit, which only processes changed objects. The full commit is a standard post-upgrade behavior to ensure configuration consistency with the new code base.

Exam trap

The trap here is that candidates may attribute the slower commit to hardware limitations (Option A) or rulebase size (Option D), overlooking the fundamental difference between a full and partial commit triggered by a PAN-OS upgrade.

How to eliminate wrong answers

Option A is wrong because insufficient CPU and memory would cause performance degradation during normal operations, not specifically a longer commit time immediately after an upgrade; the commit operation is CPU-intensive but the primary reason for the delay is the full configuration processing, not resource insufficiency. Option C is wrong because configuration backups are not triggered by a commit operation; backups are scheduled or manual tasks and do not affect commit duration. Option D is wrong because a large rulebase would cause slow commits regardless of the upgrade, but the question specifies that the commit time increased significantly after the upgrade, indicating a change in commit behavior (full vs. partial) rather than a pre-existing rulebase size issue.

Practice this question →
5
MCQmedium

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

A.Application override configured for HTTP
B.Asymmetric routing
C.DNS resolution failure
D.NAT policy mismatch
AnswerB

Asymmetric routing causes return traffic to take a different path, so the firewall does not see the return packets and cannot match them to the existing session.

Why this answer

The session is initiated correctly, but return traffic is not matching the existing session. This is a classic symptom of asymmetric routing, where the forward traffic traverses one firewall and the return traffic takes a different path, bypassing the firewall that holds the session state. Palo Alto Networks firewalls are stateful and require both directions of traffic to pass through the same firewall to maintain session consistency.

Exam trap

The trap here is that candidates may confuse a NAT policy mismatch (which affects address translation) with a session state issue, but the key clue is that the session is initiated correctly—pointing to a routing asymmetry rather than a translation or policy problem.

How to eliminate wrong answers

Option A is wrong because an application override for HTTP would not cause return traffic to fail matching an existing session; it would instead affect how the firewall identifies the application, not the session's stateful tracking. Option C is wrong because DNS resolution failure would prevent the initial connection attempt altogether (the user could not resolve the server's IP), but the engineer already sees the session initiated correctly, indicating DNS worked. Option D is wrong because a NAT policy mismatch would typically cause the initial session to fail or be misrouted, not specifically cause return traffic to not match an existing session that was already established.

Practice this question →
6
MCQmedium

An administrator is configuring Network Address Translation (NAT) on a Palo Alto Networks firewall. Which of the following statements about the order of NAT rule evaluation is correct?

A.NAT rules are evaluated after security rules
B.NAT rules are evaluated from top to bottom, and the first match is applied
C.NAT rules use longest prefix match on the destination address
D.NAT rules cannot combine source and destination NAT in a single rule
AnswerB

NAT rules are ordered; the first rule that matches the traffic is used.

Why this answer

Palo Alto Networks firewalls evaluate NAT rules from top to bottom in the rulebase, applying the first matching rule to the traffic. This is analogous to security rule evaluation order, ensuring deterministic behavior for source and destination translation. Once a NAT rule matches, no further NAT rules are considered for that session.

Exam trap

The trap here is that candidates familiar with Cisco ASA or router NAT (which often uses order-independent or longest-match logic) assume the same applies to Palo Alto, but Palo Alto strictly uses top-down first-match evaluation for NAT rules, and NAT is processed before security rules.

How to eliminate wrong answers

Option A is wrong because NAT rules are evaluated before security rules, not after; the firewall performs destination NAT first to determine the true destination, then evaluates security rules against the post-NAT packet. Option C is wrong because NAT rules do not use longest prefix match on the destination address; they use a top-down first-match order, and prefix matching applies only to route lookups, not NAT rule selection. Option D is wrong because a single NAT rule can combine both source and destination NAT (bidirectional NAT) using the 'Source Translation' and 'Destination Translation' tabs in the same rule.

Practice this question →
7
MCQhard

A security architect is planning a deployment for a multi-tenant data center where each tenant requires isolated security policies and separate administrators. Which Palo Alto Networks architecture best meets these requirements?

A.Deploy a single firewall with multiple virtual routers and separate zone definitions.
B.Use a single firewall with a single management profile and role-based access control.
C.Deploy multiple physical firewalls, one per tenant.
D.Deploy a single firewall with multiple virtual systems (vsys).
AnswerD

Virtual systems allow logical isolation, separate administrators, and independent policies on a single firewall.

Why this answer

Virtual systems (vsys) allow a single Palo Alto Networks firewall to be partitioned into multiple logical firewalls, each with its own independent security policies, administrators, and virtual routers. This provides complete tenant isolation and separate administrative domains without requiring additional physical hardware, making it the ideal architecture for a multi-tenant data center.

Exam trap

The trap here is that candidates often confuse network segmentation (virtual routers, zones) with full multi-tenancy isolation, not realizing that only virtual systems provide separate administrative domains and independent policy enforcement per tenant.

How to eliminate wrong answers

Option A is wrong because virtual routers and zone definitions provide network segmentation but do not isolate security policies or administrative access per tenant; all policies are still managed under a single firewall context. Option B is wrong because a single management profile with role-based access control (RBAC) can restrict administrator privileges but cannot create fully independent security policy domains; all policies still reside in a single shared configuration space. Option C is wrong because deploying multiple physical firewalls per tenant is cost-prohibitive, increases management complexity, and does not leverage the multi-tenant capabilities built into the PAN-OS architecture.

Practice this question →
8
Multi-Selecteasy

Which three components are part of the Palo Alto Networks Next-Generation Firewall architecture? (Choose three.)

Select 3 answers
A.Application ID engine
B.Single-pass software architecture
C.Policy optimizer
D.GlobalProtect VPN
E.Decoupled control and data plane
AnswersA, B, E

App-ID identifies applications regardless of port.

Why this answer

The Application ID engine is a core component of Palo Alto Networks Next-Generation Firewall architecture because it performs deep packet inspection to identify applications regardless of port, protocol, or encryption. This allows the firewall to apply security policies based on the application identity rather than traditional port-based rules, enabling granular control over traffic.

Exam trap

The trap here is that candidates often confuse features or management tools (like Policy Optimizer or GlobalProtect VPN) with the core architectural components that define the NGFW's processing model, such as the single-pass engine and decoupled planes.

Practice this question →
9
Multi-Selecteasy

A small business needs a firewall that supports at least 500 Mbps firewall throughput and includes integrated SD-WAN capabilities. Which TWO Palo Alto Networks platforms meet these requirements? (Choose two.)

Select 2 answers
A.PA-400 series
B.PA-800 series
C.PA-5250
D.PA-7080
E.PA-220
AnswersA, B

PA-400 series supports SD-WAN and provides up to 4 Gbps throughput, exceeding the 500 Mbps requirement.

Why this answer

The PA-400 series supports up to 1 Gbps firewall throughput and includes integrated SD-WAN capabilities, making it suitable for small businesses needing at least 500 Mbps throughput with SD-WAN features.

Exam trap

The trap here is that candidates often assume all Palo Alto firewalls support SD-WAN equally, but only the PA-400 and PA-800 series (and newer models like PA-400R) natively integrate SD-WAN without additional licensing or hardware, while higher-end models like the PA-5250 and PA-7080 focus on raw throughput and advanced threat prevention, not SD-WAN for small business use cases.

Practice this question →
10
MCQeasy

Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?

A.Use 'any' for source and destination zones to save time
B.Create rules with the most specific conditions first
C.Mix inbound and outbound rules in the same rulebase section
D.Place general rules above specific rules
AnswerB

Specific rules first ensures precise traffic handling.

Why this answer

Placing more specific rules above general rules ensures that specific traffic is matched first, preventing unintended matches. Option A is wrong because disabling logging on all rules reduces visibility. Option C is wrong because using any/any rules is discouraged.

Option D is wrong because security rules should ideally be grouped by zone, not mixed.

Practice this question →
11
Multi-Selectmedium

Which TWO of the following are valid methods to centrally manage multiple Palo Alto Networks firewalls?

Select 2 answers
A.Deploy a dedicated Log Collector to aggregate logs from multiple firewalls
B.Use the web interface of one firewall to manage others
C.Manually configure each firewall and synchronize via TFTP
D.Deploy a Panorama management server
E.Use CLI scripting to push configurations
AnswersA, D

Log Collectors are part of Panorama architecture and centralize logging.

Why this answer

Option A is correct because a dedicated Log Collector aggregates logs from multiple Palo Alto Networks firewalls, enabling centralized log storage and analysis without managing firewall configurations. This is a valid method for centralizing log data, though it does not manage firewall policies or settings directly. Option D is correct because Panorama is the primary centralized management server for Palo Alto Networks firewalls, allowing administrators to push policies, templates, and configurations to multiple firewalls from a single interface.

Exam trap

The trap here is that candidates may confuse centralized log aggregation (Log Collector) with centralized management (Panorama), or assume that CLI scripting or manual TFTP synchronization are valid enterprise-scale methods, when in fact only Panorama provides full policy and configuration management across multiple firewalls.

Practice this question →
12
Multi-Selecthard

A security architect is evaluating the VM-Series firewall for a private cloud deployment. Which three features are specific to the VM-Series that differentiate it from physical Palo Alto firewalls? (Choose three.)

Select 3 answers
A.Support for VMware NSX integration
B.Support for active/active HA using cloud load balancers
C.Hardware-based flow acceleration
D.Pay-as-you-grow licensing model
E.Dedicated SSL decryption ASIC
AnswersA, B, D

VM-Series can integrate with NSX for microsegmentation.

Why this answer

Option A is correct because VMware NSX integration is a VM-Series-specific capability that allows the virtual firewall to be managed as part of the NSX fabric, using NSX Service Insertion and distributed firewall rules. This integration is not available on physical Palo Alto Networks firewalls, which rely on hardware-based network interfaces and cannot be inserted into a software-defined network overlay.

Exam trap

The trap here is that candidates confuse hardware acceleration features (like ASICs) with software-defined capabilities, assuming that VM-Series inherits physical firewall hardware features when it actually relies on virtualized resources.

Practice this question →
13
MCQhard

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

A.Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.
B.Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.
C.Ensure both virtual routers are in the same virtual system.
D.Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.
AnswerA

Inter-vsys routing requires a path between the virtual routers, such as a virtual wire or route leak.

Why this answer

Virtual routers in different virtual systems (Vsys) are isolated by default. To enable inter-Vsys routing, you must configure either a virtual wire (which bridges the two Vsys at Layer 2) or route redistribution (which allows routes from one virtual router to be shared with the other). This provides the necessary Layer 3 connectivity between the Vsys A and Vsys B subnets.

Exam trap

The trap here is that candidates often assume security rules alone are sufficient for inter-Vsys traffic, overlooking the fundamental requirement for a Layer 3 path between the virtual routers.

How to eliminate wrong answers

Option B is wrong because security rules control traffic flow between zones but do not create a routing path; without a route between the virtual routers, the firewall will drop the packet at the routing stage. Option C is wrong because placing both virtual routers in the same virtual system would defeat the purpose of Vsys segmentation and is not required for inter-Vsys routing. Option D is wrong because NAT translates IP addresses but does not establish a route between the two virtual routers; the packet still needs a valid path to reach the destination subnet.

Practice this question →
14
MCQeasy

A junior administrator is investigating a network issue where traffic to a critical server is being blocked. To see the specific security rule that matched and the action taken, which log should the administrator review?

A.System log
B.Threat log
C.Config log
D.Traffic log
AnswerD

Traffic logs show the security rule that matched and the action taken.

Why this answer

The Traffic log records every session that traverses the firewall, including the specific security rule that matched and the action taken (allow, deny, drop, etc.). Since the administrator needs to identify which rule blocked the traffic to the critical server, the Traffic log is the correct source. System, Threat, and Config logs do not provide per-session rule matching details.

Exam trap

The trap here is that candidates often confuse the Threat log with the Traffic log, assuming blocked traffic always appears in the Threat log, but the Threat log only records sessions that matched a threat signature, not all denied sessions due to security rules.

How to eliminate wrong answers

Option A is wrong because the System log captures administrative events, system errors, and high-level operational messages, not per-session rule matches. Option B is wrong because the Threat log records only traffic that triggered a threat prevention signature (e.g., exploits, malware), not all blocked traffic or rule-based actions. Option C is wrong because the Config log tracks changes to the firewall configuration (e.g., policy modifications), not real-time traffic matching or actions.

Practice this question →
15
Matchingmedium

Match each Palo Alto Networks service to its typical use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Centralized management of multiple firewalls

Threat intelligence and analysis

SaaS security for cloud applications

Endpoint detection and response

Why these pairings

These are additional Palo Alto Networks services.

Practice this question →
16
MCQmedium

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

A.Enable the default admin account with a strong password.
B.Allow HTTP access to the management interface for ease of use.
C.Use a dedicated management interface and restrict access to trusted IP addresses.
D.Enable SNMP with read-write community strings for monitoring.
AnswerC

This limits attack surface and is a best practice.

Why this answer

Option C is correct because using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often think a strong password alone is sufficient for the default admin account, but Palo Alto Networks best practices explicitly recommend disabling or renaming the default admin to prevent credential-based attacks against a known username.

How to eliminate wrong answers

Option A is wrong because the default admin account should be disabled or renamed to prevent brute-force attacks against a well-known username, even with a strong password. Option B is wrong because HTTP transmits credentials and data in cleartext, exposing the management interface to interception; HTTPS (TLS) must be used instead. Option D is wrong because SNMP with read-write community strings is a security risk as community strings are sent in cleartext and can allow unauthorized modification of the firewall's configuration or monitoring data.

Practice this question →
17
Multi-Selecthard

Which THREE of the following are requirements for configuring High Availability (HA) on Palo Alto Networks firewalls?

Select 3 answers
A.Both firewalls must be from different hardware families
B.The firewalls must be connected via a dedicated HA link using the management port
C.Firewalls in an HA pair must be on the same network segment for failover
D.The firewalls must have layer 2 connectivity for heartbeats
E.Both firewalls must be running the same PAN-OS version
AnswersC, D, E

Both firewalls share the same IP addresses for virtual IPs; they need Layer 2 adjacency.

Why this answer

Option C is correct because for HA failover to function properly, both firewalls must reside on the same Layer 2 network segment. This ensures that when the active firewall fails, the passive firewall can assume the same IP addresses and MAC addresses without requiring ARP updates or routing changes, enabling seamless traffic failover.

Exam trap

The trap here is that candidates often confuse the dedicated HA link requirement with the management port, incorrectly assuming the MGT port can be used for HA heartbeats, when in fact only a dedicated data-plane interface or HA-specific port is supported.

Practice this question →
18
MCQhard

A large enterprise operates multiple data centers with a Palo Alto Networks firewall pair in each data center in active/passive HA. The firewalls are managed by Panorama. Recently, after a power outage in Data Center A, both firewalls in that data center came back online but are not passing traffic. The network team confirms that the switches and routers are operational. The Panorama administrator sees that both firewalls are connected and show green in the Managed Devices tab. However, the active firewall in Data Center A shows "HA state: passive" and the other firewall also shows "passive". The administrator suspects a configuration issue. What is the most likely cause and corrective action?

A.Both firewalls have the same priority and no preemptive is enabled; configure different priorities and enable preemptive.
B.The HA firewall link is down; check and reconnect the Layer 2 link between the firewalls.
C.The HA configuration is missing a heartbeat interface; add a dedicated heartbeat interface.
D.The preemptive settings are misconfigured; change the priority to make one firewall active.
AnswerA

Equal priority with no preemptive causes both to remain passive. Differing priorities with preemptive allow one to become active.

Why this answer

In an active/passive HA pair, if both firewalls show 'passive', it typically means they cannot determine which should be active. This occurs when both have the same priority and preemptive is disabled, so neither can claim the active role after a reboot. Configuring different priorities and enabling preemptive ensures one firewall becomes active based on its higher priority (lower numerical value).

Exam trap

The trap here is that candidates often assume a missing heartbeat interface or a link failure causes both firewalls to be passive, but in reality those scenarios cause split-brain (both active) or HA not forming, not both passive.

How to eliminate wrong answers

Option B is wrong because the HA firewall link being down would cause both firewalls to show as 'active' (split-brain), not both as 'passive'. Option C is wrong because a missing heartbeat interface would prevent HA formation entirely, but the firewalls are already connected and showing green in Panorama, indicating HA is established. Option D is wrong because simply changing the priority without enabling preemptive would not force an election after both firewalls reboot simultaneously; preemptive must be enabled to trigger a role change when priorities differ.

Practice this question →
19
MCQeasy

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

A.Destination NAT policy to translate the public IP to the internal server.
B.SSL decryption policy to decrypt traffic to the web server.
C.A security policy rule that allows traffic from the internet zone to the DMZ zone and has a threat prevention profile attached.
D.A QoS policy to prioritize web traffic.
AnswerC

The security rule with a threat profile enables inspection of allowed traffic.

Why this answer

Option C is correct because a security policy rule that allows traffic from the internet zone to the DMZ zone with a threat prevention profile attached is the essential component to inspect all traffic from the internet to the internal web server for threats. The threat prevention profile enables the firewall to perform intrusion prevention system (IPS) and antivirus inspection on the allowed traffic, ensuring malicious content is blocked. Without this profile, traffic would be permitted but not inspected for threats, failing the requirement.

Exam trap

The trap here is that candidates often confuse the necessity of NAT or SSL decryption as the primary component for threat inspection, overlooking that the security policy rule with a threat prevention profile is the actual enforcement point for inspecting traffic.

How to eliminate wrong answers

Option A is wrong because a Destination NAT policy translates the public IP to the internal server's private IP, which is necessary for routing but does not perform any threat inspection; it only changes the destination address. Option B is wrong because SSL decryption policy is only required if the web server uses HTTPS to decrypt encrypted traffic for inspection, but the question does not specify HTTPS, and even with decryption, a threat prevention profile must still be attached to the security rule to inspect the decrypted content. Option D is wrong because a QoS policy prioritizes web traffic for bandwidth management but does not inspect traffic for threats; it only affects traffic queuing and scheduling.

Practice this question →
20
MCQeasy

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

A.URL Filtering profile to block the Social Networking category.
B.SSL Decryption policy to decrypt traffic to social media.
C.QoS policy to limit bandwidth to social media sites.
D.File blocking profile to block executable files from social media.
AnswerA

URL Filtering can block entire categories of websites.

Why this answer

A URL Filtering profile allows the administrator to block access to specific categories of websites, such as Social Networking. By applying this profile to a security policy rule that governs internet access, the firewall can identify and block HTTP/HTTPS traffic to social media sites based on their URL category, without needing to decrypt or inspect the content.

Exam trap

The trap here is that candidates may confuse SSL Decryption (which enables visibility into encrypted traffic) with the actual blocking mechanism, not realizing that URL Filtering profiles are the correct tool for category-based blocking without requiring decryption.

How to eliminate wrong answers

Option B is wrong because SSL Decryption policy is used to decrypt encrypted traffic for inspection, not to block traffic based on category; blocking social media requires URL categorization, not decryption alone. Option C is wrong because a QoS policy only limits bandwidth to social media sites, not block them entirely, and does not identify or block the traffic based on category. Option D is wrong because a file blocking profile blocks specific file types (e.g., executables) within allowed traffic, not the traffic to social media sites themselves.

Practice this question →
21
MCQmedium

A small business uses a single PA-220 firewall for internet access and has three internal zones: Trust, DMZ, and Guest. Users in the Trust zone report intermittent connectivity to a public cloud application. The firewall administrator checks the traffic logs and sees that sessions to the cloud application show "Application: ssl" and "Action: allow". The administrator suspects the issue might be related to decryption. The firewall currently has a decryption policy that decrypts all outbound HTTPS traffic for threat inspection. The cloud application uses certificate pinning and breaks when decrypted. What is the best solution to allow this application to function while still decrypting other traffic?

A.Upgrade the firewall to a model that supports certificate key protection.
B.Create a decryption exclusion rule for the specific cloud application by source or URL category.
C.Disable SSL decryption entirely.
D.Change the decryption policy to decrypt only inbound traffic.
AnswerB

Exclusion rules allow bypassing decryption for specific traffic.

Why this answer

Option B is correct because creating a decryption exclusion rule for the specific cloud application (by source IP, URL category, or destination) allows the firewall to bypass decryption for that traffic while continuing to decrypt all other outbound HTTPS traffic. This resolves the certificate pinning issue without compromising security for other traffic. Decryption exclusion rules are a standard feature in PAN-OS for handling applications that break under decryption.

Exam trap

The trap here is that candidates may think disabling decryption entirely is the simplest fix, but they overlook the need to maintain security for other traffic, or they mistakenly believe hardware upgrades can solve application-layer compatibility issues like certificate pinning.

How to eliminate wrong answers

Option A is wrong because upgrading the firewall model does not address certificate pinning; certificate key protection is unrelated to decryption policy and would not prevent the application from breaking. Option C is wrong because disabling SSL decryption entirely would remove threat inspection for all HTTPS traffic, which is an overly broad and insecure solution. Option D is wrong because changing the decryption policy to decrypt only inbound traffic would not affect outbound traffic to the cloud application, leaving the issue unresolved and also failing to inspect outbound threats.

Practice this question →
22
MCQhard

A network administrator is designing a Palo Alto Networks firewall deployment for a large enterprise with multiple branch offices. The requirement is to ensure that if the primary firewall at headquarters fails, the branch offices can still access the internet via a local breakout using a redundant firewall at the branch. Which architecture best meets this requirement with minimal complexity?

A.Use a hub-and-spoke VPN topology with headquarters as the hub
B.Deploy active/passive HA at headquarters and active/passive HA at each branch with local internet breakout
C.Use a full mesh VPN topology between all firewalls
D.Deploy active/active HA at headquarters and use IPsec VPN tunnels to each branch
AnswerB

This provides redundancy for both locations and allows branch offices to break out locally to the internet.

Why this answer

Option B is correct because deploying active/passive HA at each branch with local internet breakout ensures that if the primary firewall at headquarters fails, branch offices can still access the internet directly through their redundant firewall without relying on the hub. This design minimizes complexity by using simple HA pairs and local breakout policies, avoiding the need for complex routing or full mesh VPNs.

Exam trap

The trap here is that candidates often assume hub-and-spoke (Option A) is sufficient for redundancy, overlooking that it fails to provide local internet breakout when the hub fails, which is the core requirement for branch internet access continuity.

How to eliminate wrong answers

Option A is wrong because a hub-and-spoke VPN topology with headquarters as the hub creates a single point of failure; if the headquarters firewall fails, all branch internet traffic is disrupted unless a backup path is configured, which adds complexity. Option C is wrong because a full mesh VPN topology between all firewalls introduces significant configuration and management overhead (O(n^2) tunnels) and does not inherently provide local internet breakout or redundancy for branch internet access. Option D is wrong because active/active HA at headquarters does not address branch-level redundancy; it only protects the hub, and using IPsec VPN tunnels to each branch still forces branch internet traffic through the hub, failing the requirement for local breakout on primary firewall failure.

Practice this question →
23
MCQmedium

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

A.Disable logging for all security rules
B.Configure the firewall to send logs to a separate log collector
C.Upgrade to a higher-end firewall model
D.Reduce the number of security policies
AnswerB

Offloading logs reduces CPU load on the firewall while retaining logs.

Why this answer

Option B is correct because offloading logs to a separate log collector reduces the firewall's dataplane CPU overhead associated with local log processing and storage. The firewall can then focus on core packet inspection and forwarding tasks, maintaining security posture while alleviating CPU pressure.

Exam trap

The trap here is that candidates may assume disabling logging (Option A) is a quick fix to reduce CPU load, but they overlook that logging is essential for security monitoring and compliance, and that offloading logs (Option B) achieves the same CPU reduction without sacrificing visibility.

How to eliminate wrong answers

Option A is wrong because disabling logging for all security rules would eliminate critical audit trails and forensic data, directly impacting security visibility and compliance requirements. Option C is wrong because upgrading hardware is a costly, non-optimizing solution that does not address the root cause of high CPU usage; it may also introduce unnecessary downtime and expense. Option D is wrong because reducing the number of security policies could weaken the security posture by removing necessary controls, and it does not guarantee a significant reduction in dataplane CPU load since the CPU is often consumed by packet processing and logging, not policy count alone.

Practice this question →
24
MCQhard

A PA-5250 firewall is experiencing high CPU usage on the dataplane. Analysis shows that a large amount of traffic is being processed by the application identification engine. What can be done to reduce the CPU load?

A.Disable application identification globally.
B.Increase logging to debug which applications are being processed.
C.Change the default rule to allow all traffic based on port only.
D.Create security rules that use application-based policies to allow trusted applications without additional inspection.
AnswerD

Explicit application allow rules bypass further App-ID processing.

Why this answer

Creating security rules that use application-based policies to allow trusted applications without additional inspection reduces CPU load because the firewall can skip deep packet inspection for those applications once identified. This offloads processing from the application identification engine by allowing traffic based on application signatures rather than performing full identification on every packet. In contrast, disabling application identification globally would break security policy enforcement, and increasing logging or changing the default rule would not reduce the CPU burden from application identification.

Exam trap

The trap here is that candidates may think disabling application identification or increasing logging will help, but Palo Alto Networks tests the understanding that application-based allow rules reduce CPU by leveraging the identification result rather than disabling the engine or adding overhead.

How to eliminate wrong answers

Option A is wrong because disabling application identification globally would remove the firewall's ability to enforce application-based policies, severely weakening security and potentially allowing unwanted applications, while not addressing the root cause of high CPU usage from the identification engine itself. Option B is wrong because increasing logging to debug which applications are being processed would add additional I/O and CPU overhead, worsening the high CPU issue rather than reducing it. Option C is wrong because changing the default rule to allow all traffic based on port only would bypass application identification for that rule, but it would also create a massive security gap by permitting any traffic on allowed ports, and it does not optimize the processing of traffic that still requires application identification in other rules.

Practice this question →
25
MCQmedium

A company deploys a Palo Alto Networks firewall in a cloud environment using the VM-Series. The firewall must scale to handle traffic spikes. Which architectural approach provides the best elasticity and management simplicity?

A.Deploy multiple VM-Series firewalls in active/active HA with a virtual load balancer.
B.Use a single large VM-Series instance.
C.Combine physical and virtual firewalls with a shared configuration.
D.Use a VM-Series firewall with auto-scaling group and integration with Panorama.
AnswerD

Auto-scaling with Panorama allows dynamic addition/removal of instances based on load, offering elasticity and centralized management.

Why this answer

Option D is correct because using a VM-Series firewall with an auto-scaling group and integration with Panorama provides the best elasticity and management simplicity. Auto-scaling dynamically adjusts the number of firewall instances based on traffic load, while Panorama centralizes configuration, policy management, and monitoring, eliminating the need for manual per-instance management. This approach aligns with cloud-native principles for scaling and operational efficiency.

Exam trap

The trap here is that candidates may assume active/active HA with a load balancer is the most scalable option, but they overlook that auto-scaling with Panorama provides true elasticity and centralized management, which is the cloud-native approach tested in the PCNSA exam.

How to eliminate wrong answers

Option A is wrong because active/active HA with a virtual load balancer introduces complexity in state synchronization and traffic distribution, and does not inherently provide elastic scaling—it requires manual intervention to add or remove instances. Option B is wrong because a single large VM-Series instance cannot scale elastically; it has fixed resource limits and represents a single point of failure, lacking the ability to handle traffic spikes beyond its capacity. Option C is wrong because combining physical and virtual firewalls with a shared configuration adds operational overhead and does not offer cloud-native elasticity; it mixes on-premises and cloud architectures, complicating scaling and management.

Practice this question →
26
MCQmedium

An administrator needs to decrypt HTTPS traffic from external users to the company's web servers. Which decryption policy should the administrator configure?

A.Configure a security policy to block HTTPS
B.SSL Forward Proxy
C.No decryption is needed because the firewall can inspect HTTPS without decryption
D.SSL Inbound Inspection
AnswerD

SSL Inbound Inspection decrypts traffic destined to the organization's servers, using the server's private key.

Why this answer

D is correct because SSL Inbound Inspection is specifically designed to decrypt inbound HTTPS traffic destined for company-owned web servers. The firewall acts as a destination proxy, terminating the client's TLS connection and re-encrypting traffic to the server, allowing inspection of the decrypted payload for threats.

Exam trap

The trap here is confusing SSL Forward Proxy (for outbound traffic) with SSL Inbound Inspection (for inbound traffic), as both involve decryption but serve opposite traffic directions.

How to eliminate wrong answers

Option A is wrong because blocking HTTPS would deny all HTTPS traffic, not decrypt it, and is not a decryption policy. Option B is wrong because SSL Forward Proxy is used for outbound traffic from internal users to external websites, not for inbound traffic to company servers. Option C is wrong because the firewall cannot inspect encrypted HTTPS payloads without decryption; it can only see metadata like IP addresses and ports, not application-layer content.

Practice this question →
27
MCQhard

An organization is experiencing performance degradation on their PA-5250 firewall after enabling SSL decryption for all traffic. The firewall's CPU usage is consistently above 80%. The decision is made to offload SSL decryption to a dedicated appliance. Which deployment architecture allows the Palo Alto firewall to inspect decrypted traffic while the decryption occurs elsewhere?

A.Enable SSL proxy with certificate chaining to reduce CPU.
B.Configure the firewall to receive decrypted traffic from an external SSL decryptor on a specific zone.
C.Use a decryption broker that sends decrypted traffic to the firewall via a virtual wire.
D.Deploy a forward proxy where the firewall decrypts and then re-encrypts.
AnswerB

Receiving decrypted traffic from an external device allows inspection without performing decryption, offloading CPU.

Why this answer

Option B is correct because it describes a deployment where an external SSL decryptor handles the decryption, and the Palo Alto firewall receives the already-decrypted traffic on a dedicated zone. This offloads the CPU-intensive decryption process from the firewall, allowing it to inspect the decrypted payload using its security policies without performing SSL/TLS termination itself.

Exam trap

The trap here is that candidates may confuse a decryption broker (option C) with an external SSL decryptor, but a decryption broker is used for service chaining and does not offload decryption from the firewall—it simply redirects traffic to multiple inline services.

How to eliminate wrong answers

Option A is wrong because enabling SSL proxy with certificate chaining still requires the firewall to perform the decryption, which would not reduce CPU usage—it would actually increase it. Option C is wrong because a decryption broker sends decrypted traffic to the firewall via a virtual wire, but this architecture is designed for service chaining with multiple inline security devices, not for offloading decryption to a dedicated appliance; the firewall would still need to perform decryption if it is the one terminating SSL. Option D is wrong because deploying a forward proxy where the firewall decrypts and then re-encrypts places the decryption burden directly on the firewall, defeating the purpose of offloading to a dedicated appliance.

Practice this question →
28
MCQmedium

Refer to the exhibit. A network administrator sees this output from a Palo Alto Networks firewall. What does the 'System mode: virtual' indicate about this firewall?

A.It is a VM series firewall running on a hypervisor.
B.It is a physical firewall configured in high availability active-active mode.
C.It is a Panorama management server.
D.It is a cloud-based firewall instance (e.g., AWS, Azure).
AnswerA

System mode virtual denotes a virtual machine firewall.

Why this answer

The 'System mode: virtual' output indicates the firewall is a VM-Series instance running on a hypervisor such as VMware ESXi, KVM, or Hyper-V. This mode is distinct from physical appliances and cloud-native instances, as it leverages virtualized hardware resources while maintaining full PAN-OS functionality.

Exam trap

The trap here is that candidates confuse 'virtual' mode with cloud-based instances (AWS/Azure), but Palo Alto Networks distinguishes between 'virtual' (hypervisor-based VM-Series) and 'cloud' (native cloud marketplace images) in the system mode output.

How to eliminate wrong answers

Option B is wrong because high availability active-active mode is indicated by 'HA mode: active-active' in the show system info output, not by 'System mode: virtual'. Option C is wrong because a Panorama management server shows 'System mode: panorama' and is a centralized management platform, not a firewall. Option D is wrong because cloud-based firewall instances (e.g., AWS, Azure) display 'System mode: cloud' or 'System mode: virtual' with specific cloud platform identifiers, but the generic 'virtual' mode specifically refers to VM-Series on a hypervisor, not a cloud-native instance.

Practice this question →
29
MCQhard

A large financial institution runs a PA-5250 firewall in a virtual wire mode between two core switches. The firewall is configured with multiple virtual wire sub-interfaces to segregate traffic for different VLANs. Recently, the security team noticed that multicast traffic from a critical trading application is not being forwarded across the virtual wire link. The firewall has multicast policies enabled, and the trading application uses IGMPv3. The administrator has verified that the firewall's multicast policy allows the traffic and that the IGMP snooping is enabled on the adjacent switches. However, the multicast stream does not reach the receivers on the other side. Which step should the administrator take to resolve this issue?

A.Increase the multicast traffic bandwidth limit in the QoS policy.
B.Change the virtual wire mode to layer 3 mode and configure PIM.
C.Configure a static multicast MAC address mapping on the firewall.
D.Enable IGMP snooping on the virtual wire sub-interfaces of the firewall.
AnswerD

IGMP snooping allows the firewall to listen to IGMP reports and build a multicast forwarding table, enabling it to forward multicast traffic to the correct ports.

Why this answer

In a virtual wire deployment, the firewall does not participate in Layer 2 protocols like IGMP snooping by default. Even if multicast policies are enabled, the firewall must explicitly perform IGMP snooping on its virtual wire sub-interfaces to track multicast group memberships and forward the traffic correctly. Enabling IGMP snooping on the sub-interfaces allows the firewall to intercept IGMPv3 membership reports and build the necessary forwarding state for the multicast stream.

Exam trap

The trap here is that candidates assume enabling multicast policies alone is sufficient for forwarding, overlooking that virtual wire mode requires explicit IGMP snooping configuration on the firewall's sub-interfaces to bridge multicast traffic between VLANs.

How to eliminate wrong answers

Option A is wrong because QoS bandwidth limits affect traffic prioritization and shaping, not multicast forwarding decisions; multicast traffic is dropped due to missing Layer 2 forwarding state, not bandwidth constraints. Option B is wrong because changing to Layer 3 mode and configuring PIM would fundamentally alter the network topology and is unnecessary; virtual wire mode can forward multicast traffic without routing protocols if IGMP snooping is enabled. Option C is wrong because static multicast MAC address mapping is used in bridging environments to map IP multicast groups to MAC addresses, but the issue here is the firewall's lack of IGMP snooping to learn group memberships, not a MAC address resolution problem.

Practice this question →
30
MCQhard

A company has deployed PA-220 firewalls at 50 branch offices, each connected to the corporate headquarters via IPSec VPN tunnels. Recently, users have reported slow file transfers across the VPN, especially for large files. The network team has checked link utilization and found that the VPN tunnel bandwidth is under 20% utilized, and CPU on the firewalls is around 40%. The security policies are basic, with no threat prevention profiles applied to the VPN traffic. The team suspects the issue is related to VPN performance. After reviewing the configuration, they notice that the VPN tunnels are configured with default settings. Which of the following actions would most likely improve VPN throughput without requiring hardware upgrades or changing the security level?

A.Enable hardware acceleration for the VPN tunnel on the branch firewalls.
B.Upgrade the branch office firewalls to PA-800 series appliances.
C.Change the VPN IPSec cipher suite to use AES-256-GCM for stronger encryption.
D.Increase the MTU on the VPN tunnel interface to 1500 bytes to reduce fragmentation.
AnswerA

Hardware acceleration offloads encryption to dedicated chips, boosting throughput significantly.

Why this answer

The PA-220 firewall includes hardware acceleration for IPsec VPN processing, but this feature is not enabled by default. Enabling hardware acceleration offloads cryptographic operations to dedicated hardware, significantly improving throughput for large file transfers without requiring hardware upgrades or reducing security. Since the VPN tunnel bandwidth is underutilized and CPU is moderate, the bottleneck is likely software-based encryption, which hardware acceleration directly addresses.

Exam trap

The trap here is that candidates often assume stronger encryption (like AES-256-GCM) improves performance or that increasing MTU always helps, when in fact the default settings disable hardware acceleration, which is the primary lever for boosting VPN throughput without hardware changes.

How to eliminate wrong answers

Option B is wrong because upgrading to PA-800 series appliances is a hardware upgrade, which contradicts the constraint of not requiring hardware upgrades. Option C is wrong because changing to AES-256-GCM provides stronger encryption but does not improve throughput; in fact, stronger ciphers can increase CPU load and reduce performance unless hardware acceleration is already enabled. Option D is wrong because increasing the MTU to 1500 bytes (the standard Ethernet MTU) does not reduce fragmentation; VPN tunnels typically have an MTU lower than 1500 due to IPsec overhead, and increasing it without adjusting for encapsulation can cause fragmentation and performance degradation.

Practice this question →
31
Multi-Selecteasy

A network administrator is configuring a Palo Alto Networks firewall in a datacenter. Which TWO traffic types can be inspected by the firewall's Threat Prevention subscription? (Choose two.)

Select 2 answers
A.FTP traffic (File Transfer Protocol)
B.Web traffic (HTTP/HTTPS)
C.VoIP traffic (SIP, H.323)
D.Email traffic (SMTP, POP3, IMAP)
E.Database traffic (SQL, Oracle)
AnswersB, D

Web traffic is a primary target for Threat Prevention, which includes antivirus, anti-spyware, and vulnerability protection.

Why this answer

B is correct because the Threat Prevention subscription includes the WildFire and antivirus/anti-spyware engines that inspect web traffic (HTTP/HTTPS) for malware, exploits, and command-and-control callbacks. D is correct because the subscription also inspects email protocols (SMTP, POP3, IMAP) for malicious attachments, phishing links, and spam, using decryption and content-ID signatures.

Exam trap

The trap here is that candidates often assume all application-layer traffic (like FTP, VoIP, or database) is equally inspected by Threat Prevention, but Palo Alto Networks separates inspection responsibilities: Threat Prevention is specifically designed for web and email traffic, while other traffic types are handled by separate profiles like Application Security or Data Filtering.

Practice this question →
32
MCQeasy

Which Palo Alto Networks subscription service provides real-time threat intelligence about unknown files and links?

A.WildFire
B.URL Filtering
C.DNS Security
D.Threat Prevention
AnswerA

WildFire analyzes unknown files and links to determine if they are malicious.

Why this answer

WildFire is the correct answer because it is Palo Alto Networks' cloud-based threat analysis service specifically designed to detect and block unknown malware, zero-day exploits, and advanced persistent threats. It analyzes files and links in a sandboxed environment, correlating behavioral indicators with real-time threat intelligence to generate signatures that protect the entire network.

Exam trap

The trap here is that candidates often confuse Threat Prevention (which handles known threats via signatures) with WildFire (which handles unknown threats via sandbox analysis), leading them to select Threat Prevention because they think 'threat intelligence' is synonymous with signature updates.

How to eliminate wrong answers

Option B (URL Filtering) is wrong because it focuses on categorizing and controlling access to known URLs based on predefined categories, not on analyzing unknown files or links for real-time threat intelligence. Option C (DNS Security) is wrong because it detects and blocks malicious DNS queries by correlating them with known threat indicators, but it does not perform sandbox analysis of unknown files or links. Option D (Threat Prevention) is wrong because it provides signature-based detection and blocking of known threats (e.g., exploits, viruses) using regular updates, but it lacks the dynamic, real-time sandbox analysis of unknown content that WildFire offers.

Practice this question →
33
MCQhard

A firewall is configured to send logs to an external syslog server. Some logs are missing, but other logs are arriving. Which step should be taken to troubleshoot this issue?

A.Restart the syslog server to clear any buffer issues.
B.Enable packet capture on the firewall to verify the logs are sent.
C.Verify the log forwarding profile to ensure the missing log types are included.
D.Disable logging on the firewall to reset the log queue.
AnswerC

The log forwarding profile specifies which log types are forwarded.

Why this answer

Option C is correct because the most common reason for missing logs when others arrive is that the log forwarding profile on the firewall does not include the specific log types (e.g., traffic, threat, system) that are missing. The firewall sends logs based on the configured forwarding profile, and if a log type is not selected in the profile, it will not be forwarded to the external syslog server. Verifying the profile ensures that the missing log types are enabled for forwarding.

Exam trap

The trap here is that candidates assume missing logs are always due to network or server issues (like buffer overflow or packet loss) rather than a configuration omission in the firewall's log forwarding profile.

How to eliminate wrong answers

Option A is wrong because restarting the syslog server would not resolve a configuration issue on the firewall where certain log types are not being forwarded; buffer issues on the server would affect all logs, not just specific types. Option B is wrong because enabling packet capture on the firewall is unnecessary and resource-intensive; the firewall's internal log forwarding mechanism does not rely on packet-level inspection, and the issue is likely a configuration omission, not a transmission failure. Option D is wrong because disabling logging on the firewall would stop all log generation and forwarding, which would not help identify why specific log types are missing and would disrupt operations.

Practice this question →
34
MCQeasy

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

A.The rule is placed below an earlier rule that also matches the traffic.
B.The firewall's license for the threat prevention subscription has expired.
C.The firewall is in an active/passive HA pair and the passive unit is handling traffic.
D.The rule is disabled in the rulebase.
AnswerD

A disabled rule is not evaluated, so traffic matching that rule will not be inspected.

Why this answer

Option D is correct because if a security policy rule is disabled in the rulebase, it will not be evaluated or enforced, even if it matches the traffic. The firewall will skip the rule entirely, meaning no logging or inspection occurs for traffic that would have matched it. This directly explains why the traffic is not being inspected or logged despite the rule appearing to be configured.

Exam trap

The trap here is that candidates may assume a rule is automatically enforced once created, overlooking the explicit 'enabled' checkbox in the rule configuration, which is a common misconfiguration in real-world deployments.

How to eliminate wrong answers

Option A is wrong because if a rule is placed below an earlier rule that also matches the traffic, the earlier rule would be evaluated first; if it allows the traffic, the traffic would still be inspected and logged according to that earlier rule, not silently dropped or uninspected. Option B is wrong because an expired threat prevention subscription would affect threat detection and prevention, but the firewall would still log and inspect traffic based on the security policy rule; the traffic would not be completely uninspected. Option C is wrong because in an active/passive HA pair, only the active unit processes traffic; the passive unit does not handle traffic unless a failover occurs, so this would not cause traffic to be uninspected by the active firewall.

Practice this question →
35
MCQmedium

Refer to the exhibit. A network engineer executes the "show system info" command and sees the above output. Based on the model and PAN-OS version, which of the following is true about this firewall?

A.It has redundant power supplies.
B.It supports a maximum of 10 virtual systems.
C.It can be upgraded to PAN-OS 11.0 directly without an intermediate version.
D.It supports maximum sessions of 5 million.
AnswerD

The PA-5250-5G model supports up to 5 million concurrent sessions.

Why this answer

The output shows a PA-5250 firewall running PAN-OS 9.1.3. The PA-5250 is a high-end chassis-based platform that supports up to 5 million concurrent sessions, making option D correct. This session limit is a hardware specification of the PA-5200 series, not determined by the PAN-OS version alone.

Exam trap

The trap here is that candidates often confuse the virtual system limit (which varies by model) with session limits, or assume that any PAN-OS version can be upgraded directly to the latest major release without considering the required upgrade path.

How to eliminate wrong answers

Option A is wrong because the PA-5250 does not have redundant power supplies as a standard feature; it uses a single power supply module, though optional redundancy may be available in some chassis configurations but is not guaranteed by the model. Option B is wrong because the PA-5250 supports a maximum of 100 virtual systems, not 10; the 10 virtual system limit applies to lower-end models like the PA-220 or PA-800 series. Option C is wrong because PAN-OS 9.1.3 cannot be upgraded directly to PAN-OS 11.0; the upgrade path requires first upgrading to PAN-OS 10.0 or 10.1 (depending on the exact version) before reaching 11.0, as per Palo Alto Networks' upgrade guidelines.

Practice this question →
36
MCQhard

Two PA-3220 firewalls are configured in an active/passive HA pair. The passive firewall's configuration becomes out of sync with the active firewall after a software upgrade. What is the most efficient way to resynchronize the configuration?

A.Restart both firewalls to automatically trigger a configuration sync.
B.Perform a factory reset on the passive firewall and re-join it to the HA pair.
C.Suspend the passive firewall, then re-suspend it to trigger a full configuration synchronization.
D.Suspend the active firewall to make the passive take over, then restore the config.
AnswerC

This is the standard procedure to force a full config sync.

Why this answer

Option C is correct because suspending and then re-suspending the passive firewall forces a full configuration synchronization from the active to the passive node. This is the most efficient method to resync after a software upgrade, as it triggers a complete config push without requiring a reboot or factory reset, preserving the HA state and minimizing disruption.

Exam trap

The trap here is that candidates may think a reboot or factory reset is necessary to fix sync issues, but Palo Alto's HA design allows a simple suspend/resuspend to trigger a full config sync without data loss or downtime.

How to eliminate wrong answers

Option A is wrong because restarting both firewalls does not automatically trigger a configuration sync; HA sync occurs only when the passive node is in a functional state and the active node detects a config mismatch, and a reboot may cause unnecessary downtime without resolving the sync issue. Option B is wrong because performing a factory reset on the passive firewall is overly destructive and inefficient; it erases all configurations and requires re-joining the HA pair, which is unnecessary when a simple suspend/resuspend can trigger a full sync. Option D is wrong because suspending the active firewall would force a failover, making the passive become active, but this does not directly resync the configuration; it could lead to a split-brain scenario or config drift if the original passive has an outdated config, and restoring the config afterward is more complex and disruptive.

Practice this question →
37
MCQmedium

Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?

A.The traffic is not matching the application 'web-browsing'
B.The NAT rule is missing
C.The destination IP is not in the destination zone
D.The security rule 'Allow-Web' is configured after 'Block-All'
AnswerA

The session has application 'incomplete', indicating the firewall has not identified the application as 'web-browsing', so the traffic is denied by the implicit deny.

Why this answer

The session shows application 'incomplete' because the firewall has not yet identified the application due to insufficient data or because the traffic does not match the expected application signature. In this case, the traffic is likely not matching the 'web-browsing' application, which is the application defined in the security rule 'Allow-Web'. The firewall requires the first few packets to complete application identification; if the traffic is not recognized as 'web-browsing' (e.g., due to non-standard HTTP headers or encrypted payloads), the session remains 'incomplete' and may be dropped or not allowed by the rule.

Exam trap

The trap here is that candidates often confuse 'incomplete' application state with a missing security rule or NAT issue, but the 'incomplete' state specifically indicates that the firewall has not yet identified the application, not that the traffic is blocked or unroutable.

How to eliminate wrong answers

Option B is wrong because a missing NAT rule would typically cause a different symptom, such as the session showing as 'drop' or 'deny' due to no route or no translation, not an 'incomplete' application state. Option C is wrong because the destination IP being in the destination zone is a routing/zone membership issue; if the IP were not in the correct zone, the traffic would likely be dropped with a 'no-route' or 'zone mismatch' error, not an 'incomplete' application. Option D is wrong because the order of security rules (Allow-Web before Block-All) would only affect whether the traffic is allowed or blocked; if the rule order were reversed, the traffic would be blocked entirely, not show an 'incomplete' application state.

Practice this question →
38
MCQmedium

Refer to the exhibit. The firewall is currently running PAN-OS 9.1.4. The administrator wants to upgrade to the latest available version shown. What should the administrator do first?

A.Reset the firewall to factory defaults to ensure a clean upgrade
B.Reboot the firewall to apply pending updates
C.Download the PAN-OS 9.1.7 package from the support site
D.Directly install the PAN-OS 9.1.7 package
AnswerC

The package must be downloaded before installation.

Why this answer

The firewall is running PAN-OS 9.1.4, and the latest available version shown is 9.1.7. Before any upgrade can be performed, the administrator must first download the PAN-OS 9.1.7 image from the Palo Alto Networks support site. This is a prerequisite step because the upgrade process requires the image file to be present on the firewall or accessible via a valid download path; the firewall cannot install a version it has not yet obtained.

Exam trap

The trap here is that candidates may assume the 'Install' option can directly fetch the image from the support site, but in reality, the download must be performed as a separate step before installation can proceed.

How to eliminate wrong answers

Option A is wrong because resetting the firewall to factory defaults is unnecessary and would erase all configuration, which is not a standard prerequisite for a version upgrade; the upgrade process preserves configuration unless explicitly stated otherwise. Option B is wrong because rebooting the firewall does not download or prepare the upgrade image; it only applies pending updates (e.g., dynamic updates or content packs) and does not initiate a PAN-OS version upgrade. Option D is wrong because directly installing the PAN-OS 9.1.7 package is impossible without first downloading it; the 'install' action requires the image to already be in the firewall's local repository or accessible via a valid URL, which is not the case here.

Practice this question →
39
MCQeasy

A company has a single Palo Alto Networks firewall protecting its internet connection. The IT team wants to allow remote employees to access internal resources using GlobalProtect. They have already configured the portal and gateway on the firewall, and users can successfully connect and obtain an IP address from the IP pool assigned to the gateway. However, remote users report that they cannot access any internal servers after connecting. The firewall has security policies that allow traffic from the GlobalProtect gateway's IP pool to the internal servers. Which additional configuration step is most likely required?

A.Increase the GlobalProtect gateway's session timeout value.
B.Enable NAT on the GlobalProtect gateway to translate the remote user IP to the firewall's internal interface IP.
C.Configure a static route on the internal router pointing the GlobalProtect IP pool subnet back to the firewall's internal interface.
D.Install a client certificate on each remote user's device for authentication.
AnswerC

Without this route, the internal servers send response packets to their default gateway, which does not know how to reach the GlobalProtect pool, causing asymmetric routing and dropped traffic.

Why this answer

Option C is correct because the remote users can connect and obtain an IP address from the GlobalProtect gateway's IP pool, but the internal servers do not have a route back to that IP pool subnet. Without a static route on the internal router pointing the GlobalProtect IP pool subnet to the firewall's internal interface, return traffic from the internal servers is sent to the default gateway (the firewall's internal interface) only if the firewall is the default gateway for those servers; if not, the traffic is dropped or misrouted. This is the most common missing step when remote users can authenticate and get an IP but cannot reach internal resources.

Exam trap

The trap here is that candidates often assume that because the firewall has security policies allowing traffic from the IP pool, the traffic will automatically flow, forgetting that routing is bidirectional and the internal network must know how to reach the virtual IP addresses assigned to remote users.

How to eliminate wrong answers

Option A is wrong because increasing the session timeout value only affects how long an idle session remains active; it does not address the routing issue preventing return traffic from reaching remote users. Option B is wrong because enabling NAT on the GlobalProtect gateway to translate remote user IPs to the firewall's internal interface IP would break the security policies that are already configured to allow traffic from the IP pool to internal servers, and NAT is not required for GlobalProtect split-tunneling or full-tunnel access when routing is correctly configured. Option D is wrong because client certificates are used for authentication and device identification, but the users are already successfully connecting and obtaining an IP address, indicating authentication is working; the issue is with network-layer reachability, not authentication.

Practice this question →
40
Multi-Selectmedium

A company is designing a high availability deployment and wants to minimize downtime. Which two configurations are required for session failover? (Choose two.)

Select 2 answers
A.Set the HA mode to active/active.
B.Ensure both firewalls have identical security policies.
C.Enable session synchronization on both firewalls.
D.Configure the same HA firewall link IP address on both firewalls.
E.Enable gratuitous ARP on the passive firewall.
AnswersB, C

Matching policies are required so that after failover, traffic is handled consistently.

Why this answer

Session failover requires that the passive firewall can take over active sessions without interruption. Identical security policies (Option B) ensure that the same rules apply to traffic after failover, preventing asymmetric policy drops. Session synchronization (Option C) copies session state from the active to the passive firewall, so the passive unit has the exact session table needed to continue forwarding traffic seamlessly.

Exam trap

The trap here is that candidates often confuse high availability modes (active/active vs. active/passive) with the specific requirement for session failover, or they assume that identical IP addresses on the HA link are needed for redundancy, when in fact they must be unique to avoid layer-2 conflicts.

Practice this question →
41
Multi-Selecteasy

Which TWO of the following are stages in the packet processing flow on a Palo Alto Networks firewall?

Select 2 answers
A.Encryption of the packet
B.Security policy lookup
C.Log generation
D.Routing table lookup
E.Decoding for application identification
AnswersB, E

After decoding, the firewall checks security rules.

Why this answer

Security policy lookup is a core stage in the Palo Alto Networks firewall packet processing flow. After the packet is decoded and identified, the firewall performs a security policy lookup to determine whether to allow or deny the traffic based on the configured rules. This is a mandatory step for all traffic traversing the firewall.

Exam trap

The trap here is that candidates often confuse the order of operations, thinking that routing table lookup happens before security policy lookup, but in Palo Alto firewalls, security policy lookup is performed first to determine if traffic is allowed, and then routing is done for forwarding decisions.

Practice this question →
42
MCQhard

An organization uses GlobalProtect for remote access. Users report that they cannot connect to the portal. The firewall's GlobalProtect portal configuration is correct, and the firewall has a valid certificate. What is the most likely cause of the issue?

A.The authentication profile is set to RADIUS but the RADIUS server is unreachable.
B.The certificate is self-signed and not trusted by the client.
C.The firewall's external interface does not have a security policy rule allowing HTTPS traffic to the portal IP.
D.The GlobalProtect gateway is not configured with a matching tunnel interface.
AnswerC

Without a rule allowing inbound HTTPS, the portal is unreachable.

Why this answer

The most likely cause is that the firewall's external interface lacks a security policy rule permitting HTTPS (TCP/443) traffic to the GlobalProtect portal IP. Even with correct portal configuration and a valid certificate, the firewall will drop the client's connection attempt if no rule explicitly allows inbound HTTPS traffic to the portal's IP address. This is a common oversight when deploying GlobalProtect remote access.

Exam trap

The trap here is that candidates often focus on authentication or certificate issues, but the most fundamental requirement for any inbound service is a security policy rule allowing the traffic; without it, no connection can be established regardless of other configurations.

How to eliminate wrong answers

Option A is wrong because an unreachable RADIUS server would cause authentication failures after the client connects to the portal, not prevent the initial portal connection itself. Option B is wrong because the question states the firewall has a valid certificate, and a self-signed certificate can still be trusted by clients if imported or if the client is configured to accept it; the issue is connectivity, not certificate trust. Option D is wrong because the gateway tunnel interface configuration is only relevant after the client successfully connects to the portal and attempts to establish a tunnel; it does not affect portal connectivity.

Practice this question →
43
MCQeasy

A network engineer needs to apply the same security policy to multiple firewalls. Which tool should be used to centralize policy management?

A.PanOS Central
B.Panorama
C.Web interface of each firewall
D.Command Line Interface (CLI)
AnswerB

Panorama provides centralized policy management across multiple firewalls.

Why this answer

Panorama is the centralized management solution for Palo Alto Networks firewalls, enabling administrators to define, push, and enforce consistent security policies across multiple firewalls from a single interface. It aggregates logs and provides visibility into all managed firewalls, eliminating the need to configure each device individually.

Exam trap

The trap here is that candidates may confuse 'Panorama' with a generic-sounding name like 'PanOS Central' or assume that any management interface (web or CLI) is sufficient for centralized control, overlooking the specific product designed for multi-firewall policy management.

How to eliminate wrong answers

Option A is wrong because 'PanOS Central' is not a real Palo Alto Networks product; the correct centralized management tool is Panorama. Option C is wrong because using the web interface of each firewall requires logging into each device separately, which is inefficient and error-prone for managing multiple firewalls. Option D is wrong because the Command Line Interface (CLI) also requires individual access to each firewall and does not provide centralized policy management or bulk configuration capabilities.

Practice this question →
44
MCQhard

A network administrator is troubleshooting a connectivity issue where users in the 192.168.1.0/24 subnet cannot reach a server at 10.0.0.10. The firewall has a rule that allows traffic from source zone 'Trust' to destination zone 'DMZ' with source address 192.168.1.0/24 and destination address 10.0.0.10. The traffic is matching the rule, but the packets are being dropped. What is the most likely reason?

A.The firewall does not have a route to the 10.0.0.0/24 network.
B.The security rule is not placed at the top of the rulebase.
C.A zone protection profile is blocking the traffic.
D.The destination server does not have a route back to the 192.168.1.0/24 subnet.
AnswerA

Without a route, the firewall cannot forward the packet to the destination, even if the security rule allows it.

Why this answer

The traffic matches the security rule, but the firewall drops the packet because it cannot find a route to the destination network 10.0.0.0/24. In Palo Alto Networks firewalls, even if a security rule permits traffic, the firewall must have a valid route in its routing table to forward the packet to the next hop. Without a route, the firewall has no way to deliver the packet to the server at 10.0.0.10, resulting in a drop.

Exam trap

The trap here is that candidates confuse security policy matching with successful packet forwarding, forgetting that a firewall must also have a route to the destination to complete the delivery.

How to eliminate wrong answers

Option B is wrong because the rule order does not matter if the traffic is already matching the rule; the issue is that the packet is dropped after matching, not that it fails to match. Option C is wrong because a zone protection profile would block traffic based on flood protection or reconnaissance settings, but the question states the traffic matches the rule and is dropped, not that it is blocked by a security profile. Option D is wrong because the destination server's return route is irrelevant to the firewall's forward path; the firewall drops the packet before it ever reaches the server, so the server's routing table does not come into play.

Practice this question →
45
MCQmedium

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

A.Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).
B.Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.
C.Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.
D.Place all servers in the same zone and use rules to allow traffic between them.
AnswerA

This follows least-privilege principles by allowing only required traffic between specific zones and ports.

Why this answer

Option A is correct because it implements a least-privilege security model using Palo Alto Networks zones and granular application- and port-based rules. By creating separate zones (Web, App, DB) and explicitly allowing only the necessary protocols (e.g., HTTP/HTTPS from the internet to Web, specific ports from Web to App, and specific ports from App to DB), the firewall enforces strict segmentation and minimizes the attack surface. This design leverages the zone-based security paradigm of PAN-OS to control inter-zone traffic precisely, aligning with the principle of zero trust.

Exam trap

The trap here is that candidates may assume that allowing 'all traffic' between tiers is sufficient for segmentation, overlooking the critical security requirement of least privilege and the need to restrict traffic to only necessary protocols and ports.

How to eliminate wrong answers

Option B is wrong because allowing all traffic from Web to App and App to DB violates the principle of least privilege; it permits unnecessary protocols and ports, increasing the risk of lateral movement if a server is compromised. Option C is wrong because placing web servers in an untrust zone and app/database in a trust zone, then allowing all traffic from trust to untrust, would permit unrestricted outbound traffic from the database to the internet, breaking the required segmentation and exposing sensitive data. Option D is wrong because placing all servers in the same zone eliminates zone-based segmentation, making it impossible to enforce the required inter-tier restrictions; intra-zone traffic is implicitly allowed by default in PAN-OS unless explicitly blocked, which contradicts the need for strict access control.

Practice this question →
46
Multi-Selecthard

Which THREE of the following are valid features of Palo Alto Networks active/passive HA?

Select 3 answers
A.Session synchronization from active to passive.
B.Prevention of link monitoring on passive device.
C.Stateful failover of sessions.
D.Automatic synchronization of configuration changes.
E.Load sharing of traffic between both devices.
AnswersA, C, D

Sessions are synced so failover is seamless.

Why this answer

Option A is correct because in Palo Alto Networks active/passive HA, session state information is synchronized from the active firewall to the passive firewall. This ensures that when a failover occurs, the passive device can take over with minimal disruption, maintaining existing sessions without requiring clients to re-establish connections.

Exam trap

The trap here is that candidates often confuse active/passive with active/active HA, assuming that both devices share traffic or that the passive device does not participate in monitoring, when in fact active/passive strictly uses one device for forwarding and the other for standby with full monitoring capabilities.

Practice this question →
47
MCQmedium

An organization has multiple virtual routers on a single firewall. Traffic between two virtual routers must be inspected by security policies. How should this be configured?

A.Place each virtual router's interfaces into different zones, then create inter-zone security rules.
B.Configure static routes between the virtual routers.
C.Enable inter-virtual router routing under the global settings.
D.Apply security policies that match the virtual router as a source or destination.
AnswerA

This ensures traffic is inspected by the security policy.

Why this answer

Option A is correct because inter-zone security rules are required to enforce security policies on traffic between different virtual routers. Each virtual router's interfaces must be assigned to distinct zones, and inter-zone rules inspect traffic crossing from one zone to another, ensuring the firewall applies security controls (e.g., App-ID, User-ID) to the traffic between the virtual routers.

Exam trap

The trap here is that candidates often assume static routes or a global setting can enable inter-VR traffic with security inspection, but they overlook that PAN-OS requires explicit zone-based security rules to inspect traffic between virtual routers.

How to eliminate wrong answers

Option B is wrong because static routes between virtual routers only provide Layer 3 reachability; they do not invoke security policy inspection. Traffic would be forwarded without any firewall enforcement. Option C is wrong because there is no 'inter-virtual router routing' global setting in PAN-OS; virtual routers are isolated by default, and inter-VR traffic must be explicitly routed via a shared interface or zone, with security policies applied.

Option D is wrong because security policies cannot match on the virtual router as a source or destination attribute; policies are based on zones, IP addresses, users, applications, and other criteria, not the virtual router object itself.

Practice this question →
48
MCQmedium

A company is expanding its network and needs to add a new data center. The two data centers will be connected via a WAN link. To protect the traffic between data centers, the security team wants to use site-to-site VPNs. Which Palo Alto Networks feature is used to route traffic between VPN tunnels and security zones?

A.Virtual routers
B.Virtual wires
C.Security policies
D.Interface management profiles
AnswerA

Virtual routers handle routing and can direct traffic into and out of VPN tunnels.

Why this answer

Virtual routers are the correct feature because they function as Layer 3 routing instances within Palo Alto Networks firewalls, enabling the routing of traffic between VPN tunnels (which terminate on tunnel interfaces) and security zones. When a site-to-site VPN is configured, the tunnel interface is assigned to a virtual router, which then uses static or dynamic routing protocols (e.g., BGP, OSPF) to forward traffic between the tunnel and the zone's egress interface. This allows the firewall to make forwarding decisions between the encrypted VPN path and the protected internal network segments.

Exam trap

The trap here is that candidates often confuse security policies with routing decisions, mistakenly thinking that policies control traffic flow between zones, when in fact virtual routers handle the actual Layer 3 forwarding and path selection between VPN tunnels and security zones.

How to eliminate wrong answers

Option B (Virtual wires) is wrong because virtual wires operate at Layer 2, acting as a transparent bridge between two interfaces without performing any routing or Layer 3 forwarding, making them unsuitable for routing traffic between VPN tunnels and security zones. Option C (Security policies) is wrong because security policies control access by permitting or denying traffic based on source/destination zones, users, and applications, but they do not perform routing functions or determine the path traffic takes between VPN tunnels and zones. Option D (Interface management profiles) is wrong because these profiles define management access permissions (e.g., ping, SSH, HTTPS) on an interface and have no role in routing or forwarding traffic between VPN tunnels and security zones.

Practice this question →
49
MCQeasy

Based on the exhibit, what action did the firewall take on this traffic?

A.Reset the connection.
B.Blocked the URL.
C.Allowed the traffic.
D.Denied the traffic.
AnswerC

The log entry shows 'allow' as the action.

Why this answer

The exhibit shows a traffic log entry with the action 'allow' (or a green checkmark indicating a permit), meaning the firewall evaluated the traffic against security policies and determined it matched a rule set to allow. The session was established and forwarded without being blocked or reset, confirming the correct answer is C.

Exam trap

The trap here is that candidates may confuse the firewall's action with the result of a security profile (e.g., URL filtering or threat prevention), but the question specifically asks for the action taken on the traffic, which is determined solely by the security policy rule's action field.

How to eliminate wrong answers

Option A is wrong because a reset action would appear as 'reset-server' or 'reset-client' in the log, not 'allow', and would terminate the TCP connection with a RST flag. Option B is wrong because URL blocking is a specific action under URL filtering profiles, which would log a 'block-url' action, not a general 'allow'. Option D is wrong because 'denied' traffic would show an action of 'deny' or 'drop' in the log, and the session would not be established.

Practice this question →
50
MCQhard

Two Palo Alto Networks firewalls are configured in an active/passive high-availability pair. During a failover event, the passive firewall becomes active but the session table is empty. What is the most likely cause?

A.Session synchronization is not configured
B.The preemptive mode is disabled
C.Heartbeat failure caused the failover to be incomplete
D.The sessions timed out during the failover
AnswerA

Session sync must be enabled in the HA configuration to maintain sessions during failover.

Why this answer

In an active/passive high-availability pair, session synchronization must be explicitly configured to replicate session state from the active firewall to the passive firewall. Without this configuration, the passive firewall has no session table when it becomes active, causing all existing connections to be dropped. This is the most direct cause of an empty session table after failover.

Exam trap

The trap here is that candidates may assume session state is automatically synchronized in an HA pair, but Palo Alto Networks requires explicit configuration of session synchronization via the HA setup, and failing to enable it leaves the passive firewall without session data.

How to eliminate wrong answers

Option B is wrong because disabling preemptive mode only prevents the original active firewall from automatically reclaiming its role after recovery; it does not affect session synchronization or cause an empty session table. Option C is wrong because a heartbeat failure would trigger the failover itself, but if the failover completes and the passive becomes active, the session table would still be empty only if session sync is missing; an incomplete failover would not result in an active firewall with an empty table. Option D is wrong because sessions do not time out during the brief failover event; session timeout values (e.g., TCP default 3600 seconds) are far longer than the failover duration, and the empty table is due to lack of synchronization, not timeout.

Practice this question →
51
MCQmedium

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

A.Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
B.Create a VPC peering connection between the two subnets and attach the firewall.
C.Attach the firewall to a single subnet and use it as a default gateway for both subnets.
D.Configure AWS security groups to route traffic through the firewall.
AnswerA

This allows the firewall to inspect traffic between the subnets.

Why this answer

Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.

Exam trap

The trap here is that candidates often assume a single firewall interface can act as a default gateway for multiple subnets, failing to understand that AWS route tables require explicit next-hop entries for inter-subnet traffic and that the local VPC route cannot be removed.

How to eliminate wrong answers

Option B is wrong because VPC peering connects entire VPCs, not subnets within the same VPC, and it does not inherently route traffic through a firewall; it simply enables direct connectivity. Option C is wrong because attaching the firewall to a single subnet and using it as a default gateway for both subnets would not force inter-subnet traffic through the firewall; default gateways handle traffic destined outside the VPC, not between subnets within the same VPC. Option D is wrong because AWS security groups are stateful virtual firewalls that control inbound/outbound traffic at the instance level, but they cannot be configured to route traffic through a separate firewall appliance; they lack routing capabilities.

Practice this question →
52
MCQeasy

A network administrator wants to ensure that if the primary firewall fails, a secondary firewall takes over without any manual intervention. Which high availability feature is essential for this automatic failover?

A.Heartbeat monitoring
B.Session synchronization
C.Floating IP addresses
D.Preemptive mode
AnswerA

Heartbeat (keepalive) is required for detecting failure and triggering automatic failover.

Why this answer

Heartbeat monitoring is the essential feature for automatic failover because it allows the secondary firewall to detect the primary firewall's failure through continuous health checks. When the heartbeat is lost, the secondary firewall automatically assumes the active role without manual intervention, ensuring high availability.

Exam trap

The trap here is that candidates often confuse session synchronization (which maintains session state) with the actual failover trigger, but without heartbeat monitoring, the secondary firewall would never know when to take over.

How to eliminate wrong answers

Option B is wrong because session synchronization ensures that active sessions are preserved during failover, but it does not trigger the failover itself. Option C is wrong because floating IP addresses provide a consistent virtual IP for client traffic, but they are a mechanism for traffic redirection, not the trigger for automatic failover. Option D is wrong because preemptive mode controls whether the primary firewall automatically resumes the active role after recovery, but it does not enable the initial automatic failover detection.

Practice this question →
53
MCQhard

A security engineer must ensure that all traffic from a specific branch office to the internet is inspected by the company's Palo Alto firewall before reaching the internet. However, the branch office has a local router that routes directly to the ISP. What architectural change is required to enforce this?

A.Route all traffic from the branch to the hub site through a VPN tunnel where the firewall is located.
B.Use global VPN to backhaul all traffic to the data center.
C.Install a Palo Alto firewall at the branch office and configure policy-based forwarding.
D.Configure NAT on the branch router to force traffic through the firewall.
AnswerA

By routing traffic through a VPN to the hub where the firewall is located, all traffic can be inspected. This is a common hub-and-spoke architecture.

Why this answer

Option A is correct because it describes a hub-and-spoke VPN topology where all branch office traffic is tunneled to a central hub site that hosts the Palo Alto firewall. This ensures the firewall can inspect all outbound traffic before it reaches the internet, bypassing the branch's direct ISP route. The VPN tunnel (e.g., IPsec) forces traffic through the firewall at the hub, providing centralized security enforcement without requiring a local firewall at the branch.

Exam trap

The trap here is that candidates may confuse GlobalProtect (a remote access VPN) with site-to-site VPN backhaul, or assume that NAT or local PBF can redirect traffic to a remote firewall without a tunnel.

How to eliminate wrong answers

Option B is wrong because GlobalProtect VPN is a remote access VPN solution for individual users, not a site-to-site backhaul mechanism; it does not automatically route all branch traffic to a data center firewall. Option C is wrong because installing a Palo Alto firewall at the branch and using policy-based forwarding (PBF) would enforce inspection locally, but the question requires traffic to be inspected by the company's existing firewall (presumably at a central location), not a new branch firewall. Option D is wrong because configuring NAT on the branch router does not force traffic through a remote firewall; NAT only translates addresses and cannot redirect traffic to a different path without additional routing or tunneling mechanisms.

Practice this question →
54
Multi-Selecteasy

Which TWO of the following are valid log types on a Palo Alto Networks firewall?

Select 2 answers
A.Authentication logs
B.System logs
C.Traffic logs
D.DHCP logs
E.Threat logs
AnswersC, E

Traffic logs record every session allowed or denied.

Why this answer

Traffic logs are a core log type on Palo Alto Networks firewalls, recording every session that traverses the firewall, including source/destination IPs, ports, and application IDs. Threat logs are also valid, capturing security events such as intrusions, malware, and spyware detected by the firewall's threat prevention engine.

Exam trap

The trap here is that candidates may confuse 'DHCP logs' as a valid log type because DHCP is a common network service, but Palo Alto does not have a dedicated DHCP log category; instead, DHCP events appear in system logs or traffic logs if explicitly configured.

Practice this question →
55
MCQhard

Refer to the exhibit. The firewall cannot reach the Internet. Based on the routing table, what is the most likely cause?

A.The default route is not active because the interface ethernet1/1 is down
B.The next hop 10.1.1.1 is not reachable
C.There is no default route configured
D.The route table is empty because the virtual-router is misconfigured
AnswerA

The route flags show 'A' (active), but the table indicates 0 routes, so the route might be inactive; interface down is a common cause.

Why this answer

The routing table shows a default route (0.0.0.0/0) configured with a next hop of 10.1.1.1 via interface ethernet1/1, but the route is not active (no 'C' flag for candidate). In Palo Alto Networks firewalls, a static route is only installed into the forwarding table if the specified egress interface is administratively up and operationally active. Since ethernet1/1 is down, the route cannot be used, and the firewall has no path to the Internet.

Exam trap

The trap here is that candidates see a default route in the routing table and assume it is active, overlooking the critical detail that the interface is down, which prevents the route from being used for forwarding.

How to eliminate wrong answers

Option B is wrong because the next hop 10.1.1.1 is not reachable only as a consequence of the interface being down; the route itself would still be active if the interface were up and the next hop were unreachable (e.g., via ARP failure), but here the route is not even installed. Option C is wrong because the routing table clearly shows a default route configured (0.0.0.0/0 via 10.1.1.1), so the issue is not a missing default route. Option D is wrong because the routing table is not empty; it contains a default route entry, and the virtual-router is correctly configured to hold that route—the problem is the interface state, not the virtual-router configuration.

Practice this question →
56
MCQeasy

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

A.Configure a zone protection profile on the DMZ zone.
B.Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.
C.Create a rule allowing traffic from DMZ to Untrust with a deny action.
D.Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.
AnswerD

The default inter-zone rule blocks all traffic that is not explicitly allowed.

Why this answer

Option D is correct because, by default, Palo Alto Networks firewalls use an implicit deny rule for all inter-zone traffic that is not explicitly allowed. Since the administrator has only created a rule permitting traffic from Untrust to DMZ for web services, no rule exists to permit traffic from DMZ to Untrust, so the implicit deny blocks any DMZ-initiated connections to the Untrust zone without any additional configuration.

Exam trap

The trap here is that candidates often assume they must create an explicit deny rule to block traffic from DMZ to Untrust, not realizing that Palo Alto Networks firewalls already block all inter-zone traffic by default unless a permit rule is explicitly configured.

How to eliminate wrong answers

Option A is wrong because a zone protection profile is used to protect a zone from flood attacks, reconnaissance, or packet-based attacks; it does not control inter-zone traffic flow or block outbound connections from DMZ to Untrust. Option B is wrong because creating a rule allowing traffic from DMZ to Untrust would explicitly permit the very connections the administrator wants to block, violating the security requirement. Option C is wrong because creating a rule with a deny action for DMZ to Untrust is unnecessary and redundant; the default implicit deny already blocks this traffic, and adding an explicit deny rule only adds administrative overhead without changing the behavior.

Practice this question →
57
MCQmedium

A company uses Palo Alto Networks firewalls and wants to decrypt inbound traffic to their web server. Which decryption type should be configured?

A.SSL Inbound Inspection
B.SSH Proxy
C.SSL Inbound Decryption
D.SSL Forward Proxy
AnswerC

This decrypts incoming traffic to servers using the server's private key.

Why this answer

SSL Inbound Decryption is the correct decryption type for decrypting inbound traffic to a web server. It allows the firewall to decrypt traffic destined for a server by presenting a certificate that the client trusts, enabling inspection of the payload for threats. This is distinct from forward proxy decryption, which is used for outbound traffic from internal clients.

Exam trap

The trap here is confusing 'SSL Inbound Decryption' with 'SSL Forward Proxy', as candidates often mistakenly think forward proxy handles all decryption, but it is specifically for outbound traffic, not inbound traffic to a server.

How to eliminate wrong answers

Option A is wrong because 'SSL Inbound Inspection' is not a standard Palo Alto Networks decryption type; the correct term is 'SSL Inbound Decryption'. Option B is wrong because SSH Proxy is used to decrypt SSH traffic for policy control, not for decrypting inbound HTTPS traffic to a web server. Option D is wrong because SSL Forward Proxy is designed to decrypt outbound traffic from internal clients to external servers, not inbound traffic to a company's web server.

Practice this question →
58
MCQhard

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

A.Configure each VM-Series firewall independently
B.Rely on cloud-native security groups instead of VM-Series
C.Use a single security policy applied to all firewalls via an API script
D.Deploy Panorama and manage all VM-Series firewalls from a single console
AnswerD

Panorama centralizes policy management, ensuring consistency.

Why this answer

Option D is correct because Panorama provides centralized management for multiple VM-Series firewalls, enabling consistent security policy deployment across cloud accounts. Panorama uses Device Groups and Template Stacks to push policies and configurations to all managed firewalls, ensuring uniformity without manual intervention.

Exam trap

The trap here is that candidates may think a simple API script (Option C) is sufficient for centralized management, overlooking Panorama's built-in features for policy versioning, commit workflows, and multi-device configuration synchronization that are essential for enterprise-scale consistency.

How to eliminate wrong answers

Option A is wrong because configuring each VM-Series firewall independently introduces configuration drift and operational overhead, making consistent policy management across multiple cloud accounts impractical. Option B is wrong because cloud-native security groups lack the advanced threat prevention, application visibility, and granular policy controls that VM-Series firewalls provide, and they cannot be centrally managed via Panorama. Option C is wrong because using a single security policy via an API script is brittle, lacks version control, rollback capabilities, and the structured multi-tenancy features of Panorama, and does not handle device-specific configurations like interfaces or zones.

Practice this question →
59
Drag & Dropmedium

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

User-ID setup involves enabling on interface, configuring agent, mapping users, creating policies, and verification.

Practice this question →
60
Multi-Selectmedium

Which TWO of the following are valid dataplane components in a Palo Alto Networks firewall?

Select 2 answers
A.Management Plane
B.Routing table
C.Panorama
D.Session table
E.Flow accelerator (FPGA)
AnswersD, E

The session table is part of the dataplane for tracking connections.

Why this answer

The session table is a core dataplane component because it stores the state of active sessions, enabling the firewall to perform stateful inspection and apply security policies at wire speed. The flow accelerator (FPGA) is a hardware-based dataplane component that offloads packet processing from the CPU, accelerating throughput for established sessions.

Exam trap

The trap here is confusing architectural planes (management, control, data) with specific components, leading candidates to mistakenly select the routing table (control plane) or Panorama (management plane) as dataplane components.

Practice this question →
61
MCQeasy

A security administrator wants to block traffic from a specific country using the firewall. How can this be achieved with minimal administrative overhead?

A.Configure an External Dynamic List (EDL) and reference it in a rule.
B.Create a security rule with a source region of the specified country.
C.Manually add all IP subnets from that country to a block rule.
D.Disable routing to that country through the firewall.
AnswerB

The firewall can match by geographic region using the geo-location feature.

Why this answer

Option B is correct because Palo Alto Networks firewalls include a built-in Geolocation database that maps IP addresses to countries. By creating a security rule with the source region set to the specific country, the firewall automatically applies the block without requiring manual IP management or external feeds, minimizing administrative overhead.

Exam trap

The trap here is that candidates may think an EDL (Option A) is required for country-based blocking, overlooking the built-in Geolocation feature that directly supports region-based rules with zero external configuration.

How to eliminate wrong answers

Option A is wrong because an External Dynamic List (EDL) requires maintaining an external list of IP addresses or URLs, which adds administrative overhead and is unnecessary when the built-in Geolocation feature can directly block by country. Option C is wrong because manually adding all IP subnets from a country is impractical, error-prone, and creates high administrative overhead due to the large number of constantly changing subnets. Option D is wrong because disabling routing to a country through the firewall does not block traffic; it only prevents the firewall from forwarding traffic to that destination, but the firewall can still receive and process traffic from that country, and this approach does not use a security rule to enforce the block.

Practice this question →
62
MCQmedium

A network engineer is configuring a new PA-220 firewall in a small branch office. The firewall must be managed centrally from Panorama. What is the first step after physically installing the firewall?

A.Register the firewall with Panorama using the serial number.
B.Create a device group in Panorama and add the firewall.
C.Push the initial configuration from Panorama to the firewall.
D.Configure the management IP address and authenticate to Panorama.
AnswerD

The firewall must have a reachable management IP and correct Panorama settings before it can be managed.

Why this answer

The correct first step after physically installing a Palo Alto Networks firewall is to configure the management IP address and authenticate to Panorama. Without a reachable management IP, the firewall cannot communicate with Panorama for registration, device group assignment, or configuration pushes. This foundational step establishes the initial network connectivity required for all subsequent centralized management operations.

Exam trap

The trap here is that candidates often assume Panorama can push configurations to a firewall before basic IP connectivity is established, confusing the centralized management workflow with the prerequisite of local network configuration.

How to eliminate wrong answers

Option A is wrong because registering the firewall with Panorama using its serial number requires the firewall to already have network connectivity and a configured management IP; registration is a later step after basic IP configuration. Option B is wrong because creating a device group in Panorama and adding the firewall assumes the firewall is already reachable and authenticated, which cannot happen without a management IP. Option C is wrong because pushing the initial configuration from Panorama to the firewall requires the firewall to be authenticated and connected to Panorama, which depends on a configured management IP.

Practice this question →
63
MCQeasy

An administrator needs to deploy a Palo Alto Networks firewall in a location where the network infrastructure does not support routing. The firewall must be transparent to the existing network. Which deployment mode should be used?

A.HA mode
B.Virtual wire
C.Layer 3
D.Tap mode
AnswerB

Virtual wire mode (Layer 2) requires no IP configuration and operates transparently.

Why this answer

Virtual wire mode allows the firewall to be deployed transparently without requiring any routing configuration, as it operates at Layer 2 by binding two interfaces together and forwarding traffic based on MAC addresses. This mode is ideal when the existing network infrastructure does not support routing and the firewall must be invisible to the network, as it does not participate in routing protocols or require IP addresses on the connected interfaces.

Exam trap

The trap here is that candidates often confuse Tap mode with transparent deployment, but Tap mode is passive and cannot enforce security policies inline, whereas virtual wire mode provides full inline inspection while remaining transparent to the network.

How to eliminate wrong answers

Option A is wrong because HA mode (High Availability) is a redundancy feature that pairs two firewalls for failover, not a deployment mode that makes the firewall transparent or bypasses routing. Option C is wrong because Layer 3 mode requires the firewall to have IP addresses on its interfaces and participate in routing, which contradicts the requirement of a transparent deployment without routing support. Option D is wrong because Tap mode is used for monitoring traffic passively (like a network tap) without inline blocking, whereas the question implies the firewall must be inline and transparent, not just monitoring.

Practice this question →
64
MCQmedium

A network administrator is configuring a new PA-220 firewall. The management interface (MGT) must be accessible from the internal network for GUI access. Which IP address should be assigned to the MGT interface?

A.A static IP from a dedicated management subnet (e.g., 10.0.1.0/24).
B.An IP from the external (untrusted) subnet.
C.DHCP-assigned address from the internal network.
D.An IP from the same subnet as the end-user workstations.
AnswerA

Best practice is to have a separate management network.

Why this answer

The PA-220 management interface (MGT) is a dedicated out-of-band management port that should be isolated from production traffic for security and stability. Assigning a static IP from a dedicated management subnet (e.g., 10.0.1.0/24) ensures GUI access is always available and not dependent on DHCP or production network changes, while keeping management traffic separate from data-plane traffic.

Exam trap

The trap here is that candidates often confuse the MGT interface with a standard data-plane interface and assume it can share a subnet with internal users or use DHCP, but Palo Alto Networks explicitly requires a static IP on a dedicated management subnet for reliability and security.

How to eliminate wrong answers

Option B is wrong because assigning an IP from the external (untrusted) subnet would expose the management interface directly to the internet, creating a severe security risk and violating best practices for out-of-band management. Option C is wrong because using a DHCP-assigned address from the internal network introduces dependency on a DHCP server and potential IP changes, which can break persistent GUI access and is not recommended for a management interface that must remain reachable. Option D is wrong because using an IP from the same subnet as end-user workstations mixes management traffic with user data traffic, increasing attack surface and complicating troubleshooting; the MGT interface should be on a separate management subnet.

Practice this question →
65
MCQmedium

A medium-sized enterprise recently deployed a pair of PA-5250 firewalls in an active/passive high-availability configuration. The network team notices that after a failover event, the new active firewall does not pass any traffic for about 30 seconds, even though the session table is synchronized. Users report that existing connections break and need to be re-established. The firewall is configured to use session state synchronization and failover triggers based on link state and ping to the next-hop gateway. Which action should the administrator take to minimize traffic disruption during failover?

A.Configure asymmetric path bypass on the high-availability settings.
B.Increase the packet buffer size on the firewall to handle burst traffic.
C.Reduce the hold timer for path monitoring to the next-hop gateway.
D.Enable preemptive mode for the active/passive HA pair.
AnswerA

Asymmetric path bypass allows the new active firewall to forward packets even if the return path is not synchronized immediately, reducing the window of traffic loss.

Why this answer

Option A is correct because asymmetric path bypass allows the new active firewall to accept and forward packets for existing sessions even before the session table is fully synchronized or the routing converges. In an active/passive HA pair, after failover, the new active firewall may receive packets for flows that were originally processed by the previous active unit; without asymmetric path bypass, these packets are dropped because the firewall does not recognize them as part of an existing session. Enabling this feature ensures that the firewall temporarily bypasses session lookup for such packets, reducing the 30-second traffic blackout.

Exam trap

The trap here is that candidates often confuse the cause of traffic disruption after failover with detection speed (path monitoring timers) or resource exhaustion (buffer size), rather than recognizing it as a session lookup issue that asymmetric path bypass directly addresses.

How to eliminate wrong answers

Option B is wrong because increasing the packet buffer size addresses packet loss due to bursts but does not resolve the fundamental issue of session lookup failure during the failover window. Option C is wrong because reducing the hold timer for path monitoring would cause faster detection of gateway failure, but the problem occurs after failover (the new active firewall is already active) and is related to session state handling, not detection speed. Option D is wrong because preemptive mode forces the original active firewall to resume control when it recovers, which can cause additional failover events and traffic disruption, not minimize it.

Practice this question →
66
MCQmedium

Based on the exhibit, what is the most likely cause if the firewall is dropping new connections but existing sessions continue to work?

A.The firewall has reached its session limit.
B.The management interface IP (192.168.1.1) is conflicting with another device.
C.The firewall is low on CPU memory.
D.The software version 10.1.3 is buggy.
AnswerA

25k sessions may be near the limit for PA-5250, causing denial of new connections.

Why this answer

When a Palo Alto Networks firewall reaches its maximum session capacity (defined by the platform model and license), it will drop new connection attempts while maintaining existing sessions that are already in the session table. This behavior is by design to preserve established traffic. The session limit is a hard resource constraint, not a performance degradation, so existing flows continue uninterrupted until they age out or are terminated.

Exam trap

The trap here is that candidates often confuse session limit exhaustion with general resource starvation (like CPU or memory), but the key differentiator is that only new connections are affected while existing sessions remain fully functional, which is a hallmark of hitting the session table cap.

How to eliminate wrong answers

Option B is wrong because a management interface IP conflict would cause connectivity issues to the management plane (e.g., inability to access the web UI or SSH), not selectively drop new data-plane sessions while keeping existing ones alive. Option C is wrong because low CPU memory typically leads to overall performance degradation, packet drops across all traffic, or even session table corruption, not a clean separation of new vs. existing sessions. Option D is wrong because while software bugs can cause unexpected behavior, a specific bug that drops only new connections while preserving existing sessions is highly unlikely; the documented behavior for session limit exhaustion is exactly this pattern, making it the most probable cause.

Practice this question →
67
MCQeasy

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

A.PA-3250
B.PA-220
C.VM-Series
D.PA-5280
AnswerB

PA-220 is the entry-level hardware platform suitable for small branch offices with up to 50 users.

Why this answer

The PA-220 is the most appropriate platform for a branch office with 50 users because it is a low-end, entry-level next-generation firewall designed for small to medium-sized businesses and remote/branch offices. It supports up to 100 Mbps of threat prevention throughput and includes all core NGFW features (App-ID, User-ID, SSL decryption) at a cost-effective price point, making it ideal for this user count.

Exam trap

The trap here is that candidates often choose the PA-3250 (Option A) because they assume a 'branch office' needs a mid-range model for reliability, but the PA-220 is specifically designed for small branches and is the correct answer based on user count and throughput requirements.

How to eliminate wrong answers

Option A is wrong because the PA-3250 is a mid-range enterprise firewall designed for larger deployments (typically 500-1000 users) and provides significantly higher throughput (up to 2 Gbps threat prevention), which is overkill and unnecessarily expensive for a 50-user branch. Option C is wrong because the VM-Series is a virtualized firewall intended for cloud or virtualized environments (e.g., AWS, Azure, VMware), not for a physical branch office deployment with a fixed number of on-premises users. Option D is wrong because the PA-5280 is a high-end chassis-based firewall designed for data centers or large enterprise core deployments (supporting thousands of users and up to 40 Gbps throughput), far exceeding the requirements of a 50-user branch and representing a massive cost and complexity mismatch.

Practice this question →
68
MCQeasy

Refer to the exhibit. Which profile group is applied to this security rule?

A.No profile group is applied
B.strict-profile-group
C.log-profile-group
D.default-profile-group
AnswerB

The profile group explicitly set to 'strict-profile-group'.

Why this answer

Option B is correct because the exhibit shows the security rule's 'Profile Group' field set to 'strict-profile-group', which applies a predefined set of security profiles (antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking) to the rule. This is visible in the rule configuration where the profile group is explicitly selected, not set to 'none' or a custom group.

Exam trap

The trap here is that candidates may confuse the 'Profile Group' field with the 'Log Setting' field, or assume that 'no profile group' is applied when the field shows a group name, but the exhibit explicitly shows 'strict-profile-group' selected.

How to eliminate wrong answers

Option A is wrong because the exhibit clearly shows a profile group selected, not 'none', so no profile group is not applied. Option C is wrong because 'log-profile-group' is not a valid profile group name in Palo Alto Networks; profile groups are for security profiles, not logging. Option D is wrong because 'default-profile-group' is not a standard predefined group; the correct predefined group is 'strict-profile-group' (or 'balanced-profile-group' or 'best-practice-profile-group').

Practice this question →
69
MCQhard

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

A.The traffic is intra-zone, not inter-zone
B.The firewall is using hardware offload for fast-path processing
C.The traffic is being dropped due to a security policy rule that denies the traffic
D.The packet is part of an existing session that has not timed out
AnswerC

If no matching rule allows the traffic, the packet is dropped and no session is created.

Why this answer

Option C is correct because if a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Exam trap

The trap here is that candidates may assume a security policy allowing HTTP/HTTPS guarantees session creation, but they overlook that a more specific deny rule higher in the policy order could match and drop the traffic before the allow rule is evaluated.

How to eliminate wrong answers

Option A is wrong because intra-zone traffic (same zone) would still create a session if allowed by an intra-zone security policy rule; the question states the policy allows Trust-to-Untrust, so intra-zone is irrelevant. Option B is wrong because hardware offload (fast-path) is used for existing sessions, not the first packet of a new connection; the first packet always goes through the slow path for policy evaluation. Option D is wrong because if the packet were part of an existing session, it would match an existing session entry and not be processed as a 'first packet of a new connection'.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Paloalto Platforms questions.

Start 20-question session