PCNSA · topic practice

Palo Alto Networks Platforms and Architecture practice questions

Q: How should I use these Palo Alto Networks Platforms and Architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Palo Alto Networks Platforms and Architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Palo Alto Networks Platforms and Architecture domain.

Practise Palo Alto Networks Certified Network Security Administrator PCNSA Palo Alto Networks Platforms and Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Palo Alto Networks Platforms and Architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Palo Alto Networks Platforms and Architecture

Palo Alto Networks Platforms and Architecture questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Palo Alto Networks Platforms and Architecture exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Palo Alto Networks Platforms and Architecture questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Review the full subnetting walkthrough →

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

Trap 1: The rule is placed below an earlier rule that also matches the…

This could cause the earlier rule to be matched first, but the question states the traffic is not inspected at all, not that it matches a different rule.

Trap 2: The firewall's license for the threat prevention subscription has…

License expiry would affect inspection capabilities, but the firewall would still apply security rules; it would just not perform threat inspection.

Trap 3: The firewall is in an active/passive HA pair and the passive unit…

HA state does not affect rule evaluation; the active unit handles traffic and applies rules.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
The rule is placed below an earlier rule that also matches the traffic.
Why wrong: This could cause the earlier rule to be matched first, but the question states the traffic is not inspected at all, not that it matches a different rule.
B
The firewall's license for the threat prevention subscription has expired.
Why wrong: License expiry would affect inspection capabilities, but the firewall would still apply security rules; it would just not perform threat inspection.
C
The firewall is in an active/passive HA pair and the passive unit is handling traffic.
Why wrong: HA state does not affect rule evaluation; the active unit handles traffic and applies rules.
D
The rule is disabled in the rulebase.
A disabled rule is not evaluated, so traffic matching that rule will not be inspected.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

Trap 1: Create three zones: Web, App, DB

This does not restrict which specific services are allowed; it allows all traffic between the tiers, which may be too permissive.

Trap 2: Place web servers in an untrust zone and app/database in a trust…

This would allow database servers to initiate connections to the internet, which is not required.

Trap 3: Place all servers in the same zone and use rules to allow traffic…

This would not provide segmentation because intra-zone traffic is allowed by default unless explicitly blocked.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).
This follows least-privilege principles by allowing only required traffic between specific zones and ports.
B
Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.
Why wrong: This does not restrict which specific services are allowed; it allows all traffic between the tiers, which may be too permissive.
C
Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.
Why wrong: This would allow database servers to initiate connections to the internet, which is not required.
D
Place all servers in the same zone and use rules to allow traffic between them.
Why wrong: This would not provide segmentation because intra-zone traffic is allowed by default unless explicitly blocked.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full NAT/PAT explanation →

A network administrator is troubleshooting a connectivity issue where users in the 192.168.1.0/24 subnet cannot reach a server at 10.0.0.10. The firewall has a rule that allows traffic from source zone 'Trust' to destination zone 'DMZ' with source address 192.168.1.0/24 and destination address 10.0.0.10. The traffic is matching the rule, but the packets are being dropped. What is the most likely reason?

Trap 1: The security rule is not placed at the top of the rulebase.

The rule is matching, so its position is not the issue.

Trap 2: A zone protection profile is blocking the traffic.

Zone protection profiles block based on flood or reconnaissance attacks, not normal traffic.

Trap 3: The destination server does not have a route back to the…

The firewall handles asymmetric routing; return traffic is not the issue here.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
The firewall does not have a route to the 10.0.0.0/24 network.
Without a route, the firewall cannot forward the packet to the destination, even if the security rule allows it.
B
The security rule is not placed at the top of the rulebase.
Why wrong: The rule is matching, so its position is not the issue.
C
A zone protection profile is blocking the traffic.
Why wrong: Zone protection profiles block based on flood or reconnaissance attacks, not normal traffic.
D
The destination server does not have a route back to the 192.168.1.0/24 subnet.
Why wrong: The firewall handles asymmetric routing; return traffic is not the issue here.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

Trap 1: Destination NAT policy to translate the public IP to the internal…

NAT is needed for reachability but does not enable threat inspection.

Trap 2: SSL decryption policy to decrypt traffic to the web server.

Decryption is only needed if the traffic is encrypted, not for all traffic.

Trap 3: A QoS policy to prioritize web traffic.

QoS only manages bandwidth, not inspection.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Destination NAT policy to translate the public IP to the internal server.
Why wrong: NAT is needed for reachability but does not enable threat inspection.
B
SSL decryption policy to decrypt traffic to the web server.
Why wrong: Decryption is only needed if the traffic is encrypted, not for all traffic.
C
A security policy rule that allows traffic from the internet zone to the DMZ zone and has a threat prevention profile attached.
The security rule with a threat profile enables inspection of allowed traffic.
D
A QoS policy to prioritize web traffic.
Why wrong: QoS only manages bandwidth, not inspection.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

Trap 1: The firewall's CPU and memory are insufficient for the new PAN-OS…

The upgrade does not change hardware; if resources were insufficient, the firewall would have performance issues in general.

Trap 2: The firewall is performing a backup of the configuration.

Backups are not part of the commit process.

Trap 3: The rulebase has grown too large.

That would have caused slow commits before the upgrade as well.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
The firewall's CPU and memory are insufficient for the new PAN-OS version.
Why wrong: The upgrade does not change hardware; if resources were insufficient, the firewall would have performance issues in general.
B
The upgrade triggered a full commit of the entire configuration, which takes longer than a partial commit.
After an upgrade, the system often performs a full commit to apply structural changes, which is slower.
C
The firewall is performing a backup of the configuration.
Why wrong: Backups are not part of the commit process.
D
The rulebase has grown too large.
Why wrong: That would have caused slow commits before the upgrade as well.

Full breakdown with real-world context →

Question 6hardmultiple choice

Review the full subnetting walkthrough →

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

Trap 1: Create a security rule that allows traffic from the source zone in…

Security rules cannot span vsys; they operate within a single vsys.

Trap 2: Ensure both virtual routers are in the same virtual system.

They are in different vsys; merging them defeats the purpose of segmentation.

Trap 3: Configure a NAT policy to translate the source IP to an IP in Vsys…

NAT does not enable routing between different virtual routers.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.
Inter-vsys routing requires a path between the virtual routers, such as a virtual wire or route leak.
B
Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.
Why wrong: Security rules cannot span vsys; they operate within a single vsys.
C
Ensure both virtual routers are in the same virtual system.
Why wrong: They are in different vsys; merging them defeats the purpose of segmentation.
D
Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.
Why wrong: NAT does not enable routing between different virtual routers.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

Trap 1: SSL Decryption policy to decrypt traffic to social media.

Decryption does not block; it only allows inspection.

Trap 2: QoS policy to limit bandwidth to social media sites.

QoS can limit but not block traffic.

Trap 3: File blocking profile to block executable files from social media.

This blocks files, not access to the sites.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
URL Filtering profile to block the Social Networking category.
URL Filtering can block entire categories of websites.
B
SSL Decryption policy to decrypt traffic to social media.
Why wrong: Decryption does not block; it only allows inspection.
C
QoS policy to limit bandwidth to social media sites.
Why wrong: QoS can limit but not block traffic.
D
File blocking profile to block executable files from social media.
Why wrong: This blocks files, not access to the sites.

Full breakdown with real-world context →

Question 8mediummultiple choice

Review the full subnetting walkthrough →

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

Trap 1: Create a VPC peering connection between the two subnets and attach…

VPC peering is for different VPCs, not subnets within the same VPC.

Trap 2: Attach the firewall to a single subnet and use it as a default…

A single ENI cannot handle traffic between two subnets; each subnet needs an ENI on the firewall.

Trap 3: Configure AWS security groups to route traffic through the firewall.

Security groups do not route traffic; they act as stateful firewalls.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
This allows the firewall to inspect traffic between the subnets.
B
Create a VPC peering connection between the two subnets and attach the firewall.
Why wrong: VPC peering is for different VPCs, not subnets within the same VPC.
C
Attach the firewall to a single subnet and use it as a default gateway for both subnets.
Why wrong: A single ENI cannot handle traffic between two subnets; each subnet needs an ENI on the firewall.
D
Configure AWS security groups to route traffic through the firewall.
Why wrong: Security groups do not route traffic; they act as stateful firewalls.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

An organization uses GlobalProtect for remote access. Users report that they cannot connect to the portal. The firewall's GlobalProtect portal configuration is correct, and the firewall has a valid certificate. What is the most likely cause of the issue?

Trap 1: The authentication profile is set to RADIUS but the RADIUS server…

Authentication occurs after the portal is reached, so this would not prevent initial connection.

Trap 2: The certificate is self-signed and not trusted by the client.

A self-signed certificate would cause a warning but not necessarily prevent connection; the user could accept it.

Trap 3: The GlobalProtect gateway is not configured with a matching tunnel…

The gateway is for the tunnel after portal connection; it does not affect portal access.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
The authentication profile is set to RADIUS but the RADIUS server is unreachable.
Why wrong: Authentication occurs after the portal is reached, so this would not prevent initial connection.
B
The certificate is self-signed and not trusted by the client.
Why wrong: A self-signed certificate would cause a warning but not necessarily prevent connection; the user could accept it.
C
The firewall's external interface does not have a security policy rule allowing HTTPS traffic to the portal IP.
Without a rule allowing inbound HTTPS, the portal is unreachable.
D
The GlobalProtect gateway is not configured with a matching tunnel interface.
Why wrong: The gateway is for the tunnel after portal connection; it does not affect portal access.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

Trap 1: Enable the default admin account with a strong password.

Best practice is to disable default accounts and create named accounts.

Trap 2: Allow HTTP access to the management interface for ease of use.

HTTP is unencrypted; HTTPS should be used.

Trap 3: Enable SNMP with read-write community strings for monitoring.

Read-write SNMP is a security risk; use read-only if needed.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Enable the default admin account with a strong password.
Why wrong: Best practice is to disable default accounts and create named accounts.
B
Allow HTTP access to the management interface for ease of use.
Why wrong: HTTP is unencrypted; HTTPS should be used.
C
Use a dedicated management interface and restrict access to trusted IP addresses.
This limits attack surface and is a best practice.
D
Enable SNMP with read-write community strings for monitoring.
Why wrong: Read-write SNMP is a security risk; use read-only if needed.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Trap 1: Configure a zone protection profile on the DMZ zone.

Zone protection profiles prevent attacks, not outbound connections.

Trap 2: Create a rule allowing traffic from Untrust to DMZ and another rule…

This would allow DMZ to initiate connections, which is not desired.

Trap 3: Create a rule allowing traffic from DMZ to Untrust with a deny…

This would create an explicit deny, but the default already blocks; this adds unnecessary complexity.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Configure a zone protection profile on the DMZ zone.
Why wrong: Zone protection profiles prevent attacks, not outbound connections.
B
Create a rule allowing traffic from Untrust to DMZ and another rule allowing DMZ to Untrust.
Why wrong: This would allow DMZ to initiate connections, which is not desired.
C
Create a rule allowing traffic from DMZ to Untrust with a deny action.
Why wrong: This would create an explicit deny, but the default already blocks; this adds unnecessary complexity.
D
Do nothing; by default, inter-zone traffic from DMZ to Untrust is blocked.
The default inter-zone rule blocks all traffic that is not explicitly allowed.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A security engineer is troubleshooting a connectivity issue where internal users cannot reach a public web server hosted on the internet. The firewall is configured with a security policy that allows traffic from the internal zone to the external zone on port 80. The engineer notices that traffic is being dropped. Upon checking the session table, the engineer sees that the session is initiated correctly but the return traffic is not matching the existing session. What is the most likely cause?

Trap 1: Application override configured for HTTP

Application override would not cause session mismatch; it would force the application identification regardless of port.

Trap 2: DNS resolution failure

DNS resolution failure would prevent the user from resolving the server's IP address, but would not cause session mismatch for return traffic.

Trap 3: NAT policy mismatch

NAT policy mismatch would affect address translation but not the session lookup for return traffic.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Application override configured for HTTP
Why wrong: Application override would not cause session mismatch; it would force the application identification regardless of port.
B
Asymmetric routing
Asymmetric routing causes return traffic to take a different path, so the firewall does not see the return packets and cannot match them to the existing session.
C
DNS resolution failure
Why wrong: DNS resolution failure would prevent the user from resolving the server's IP address, but would not cause session mismatch for return traffic.
D
NAT policy mismatch
Why wrong: NAT policy mismatch would affect address translation but not the session lookup for return traffic.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A network administrator is designing a Palo Alto Networks firewall deployment for a large enterprise with multiple branch offices. The requirement is to ensure that if the primary firewall at headquarters fails, the branch offices can still access the internet via a local breakout using a redundant firewall at the branch. Which architecture best meets this requirement with minimal complexity?

Trap 1: Use a hub-and-spoke VPN topology with headquarters as the hub

Hub-and-spoke forces all branch traffic through headquarters, which does not meet the local breakout requirement.

Trap 2: Use a full mesh VPN topology between all firewalls

Full mesh VPN adds complexity and does not inherently provide local internet breakout.

Trap 3: Deploy active/active HA at headquarters and use IPsec VPN tunnels…

Active/active HA does not provide local breakout; branch traffic would still go through headquarters via VPN.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Use a hub-and-spoke VPN topology with headquarters as the hub
Why wrong: Hub-and-spoke forces all branch traffic through headquarters, which does not meet the local breakout requirement.
B
Deploy active/passive HA at headquarters and active/passive HA at each branch with local internet breakout
This provides redundancy for both locations and allows branch offices to break out locally to the internet.
C
Use a full mesh VPN topology between all firewalls
Why wrong: Full mesh VPN adds complexity and does not inherently provide local internet breakout.
D
Deploy active/active HA at headquarters and use IPsec VPN tunnels to each branch
Why wrong: Active/active HA does not provide local breakout; branch traffic would still go through headquarters via VPN.

Full breakdown with real-world context →

Question 14easymulti select

Study the full virtualization explanation →

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Trap 1: Microsoft Hyper-V

Microsoft Hyper-V is not a supported hypervisor for Palo Alto Networks VM-Series.

Trap 2: Docker

Docker is not a supported platform for VM-Series; it uses containers, not VMs.

Trap 3: Oracle VirtualBox

Oracle VirtualBox is not a supported hypervisor for production VM-Series deployments.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Microsoft Hyper-V
Why wrong: Microsoft Hyper-V is not a supported hypervisor for Palo Alto Networks VM-Series.
B
KVM
KVM is a supported hypervisor for VM-Series firewalls.
C
VMware ESXi
VMware ESXi is a supported hypervisor for VM-Series firewalls.
D
Docker
Why wrong: Docker is not a supported platform for VM-Series; it uses containers, not VMs.
E
Oracle VirtualBox
Why wrong: Oracle VirtualBox is not a supported hypervisor for production VM-Series deployments.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?

Exhibit

Refer to the exhibit.

show system info | match model
vm-series

show running security-policy
set rulebase security rules "Allow-Web" from [ trust ] to [ untrust ] source [ 10.0.0.0/24 ] destination [ any ] application [ web-browsing ] service [ application-default ] action allow
set rulebase security rules "Block-All" from [ any ] to [ any ] source [ any ] destination [ any ] application [ any ] service [ any ] action deny

show running nat-policy
set rulebase nat rules "NAT-Internet" from [ trust ] to [ untrust ] source [ 10.0.0.0/24 ] destination [ any ] service [ any ] to-interface [ ethernet1/2 ] snat-interface

show session all filter source 10.0.0.5
session id 12345, application incomplete, source 10.0.0.5:50000, destination 203.0.113.1:80, nat source 10.0.0.5, nat destination 203.0.113.1, rule Allow-Web, nat rule NAT-Internet, state active, type flow

Trap 1: The NAT rule is missing

The session shows a NAT rule 'NAT-Internet' applied, so NAT is not missing.

Trap 2: The destination IP is not in the destination zone

The destination is 'any' in the rule, so zone matching is not an issue.

Trap 3: The security rule 'Allow-Web' is configured after 'Block-All'

The running config shows 'Allow-Web' first, so rule order is correct.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
The traffic is not matching the application 'web-browsing'
The session has application 'incomplete', indicating the firewall has not identified the application as 'web-browsing', so the traffic is denied by the implicit deny.
B
The NAT rule is missing
Why wrong: The session shows a NAT rule 'NAT-Internet' applied, so NAT is not missing.
C
The destination IP is not in the destination zone
Why wrong: The destination is 'any' in the rule, so zone matching is not an issue.
D
The security rule 'Allow-Web' is configured after 'Block-All'
Why wrong: The running config shows 'Allow-Web' first, so rule order is correct.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Palo Alto Networks Platforms and Architecture explanation →

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Read the full Palo Alto Networks Platforms and Architecture explanation →

Match each Palo Alto Networks service to its typical use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Centralized management of multiple firewalls

Threat intelligence and analysis

SaaS security for cloud applications

Endpoint detection and response

Question 18easymultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

Trap 1: PA-3250

PA-3250 is a mid-range model for larger environments, not for a small branch with 50 users.

Trap 2: VM-Series

VM-Series is virtual and could be used, but physical hardware is typically preferred for branch offices and the PA-220 is more cost-effective.

Trap 3: PA-5280

PA-5280 is a high-end data center firewall, overkill for a 50-user branch.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
PA-3250
Why wrong: PA-3250 is a mid-range model for larger environments, not for a small branch with 50 users.
B
PA-220
PA-220 is the entry-level hardware platform suitable for small branch offices with up to 50 users.
C
VM-Series
Why wrong: VM-Series is virtual and could be used, but physical hardware is typically preferred for branch offices and the PA-220 is more cost-effective.
D
PA-5280
Why wrong: PA-5280 is a high-end data center firewall, overkill for a 50-user branch.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

Trap 1: Disable logging for all security rules

Disabling logging removes visibility and is not recommended.

Trap 2: Upgrade to a higher-end firewall model

Upgrading hardware is costly and may not be necessary if logging is offloaded.

Trap 3: Reduce the number of security policies

Reducing policies may weaken security posture.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Disable logging for all security rules
Why wrong: Disabling logging removes visibility and is not recommended.
B
Configure the firewall to send logs to a separate log collector
Offloading logs reduces CPU load on the firewall while retaining logs.
C
Upgrade to a higher-end firewall model
Why wrong: Upgrading hardware is costly and may not be necessary if logging is offloaded.
D
Reduce the number of security policies
Why wrong: Reducing policies may weaken security posture.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full Palo Alto Networks Platforms and Architecture explanation →

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Trap 1: Configure each VM-Series firewall independently

Individual management is error-prone and not scalable across multiple accounts.

Trap 2: Rely on cloud-native security groups instead of VM-Series

Cloud-native security groups do not provide the same level of threat prevention as VM-Series.

Trap 3: Use a single security policy applied to all firewalls via an API…

API scripts may lead to drifts and are not as robust as Panorama's commit and template management.

Study all Palo Alto Networks Platforms and Architecture common traps →

A
Configure each VM-Series firewall independently
Why wrong: Individual management is error-prone and not scalable across multiple accounts.
B
Rely on cloud-native security groups instead of VM-Series
Why wrong: Cloud-native security groups do not provide the same level of threat prevention as VM-Series.
C
Use a single security policy applied to all firewalls via an API script
Why wrong: API scripts may lead to drifts and are not as robust as Panorama's commit and template management.
D
Deploy Panorama and manage all VM-Series firewalls from a single console
Panorama centralizes policy management, ensuring consistency.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Palo Alto Networks Platforms and Architecture sessions

Start a Palo Alto Networks Platforms and Architecture only practice session

Every question in these sessions is drawn from the Palo Alto Networks Platforms and Architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Palo Alto Networks Platforms and Architecture questions →Mixed PCNSA session

Frequently asked questions

What does the PCNSA exam test about Palo Alto Networks Platforms and Architecture?: Palo Alto Networks Platforms and Architecture questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Palo Alto Networks Platforms and Architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Palo Alto Networks Platforms and Architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSA topics?: Use the topic links above to move to related areas, or go back to the PCNSA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSA exam covers. They are not copied from any real exam or dump site.

Palo Alto Networks Platforms and Architecture only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSA questions Palo Alto Networks Platforms and Architecture domain overview PCNSA exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Palo Alto Networks Platforms and Architecture practice questions

What to know about Palo Alto Networks Platforms and Architecture

Common Palo Alto Networks Platforms and Architecture exam traps

Palo Alto Networks Platforms and Architecture questions

A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?

A company wants to ensure that all traffic from the internet to their internal web server is inspected for threats. Which configuration component is essential to achieve this?

After upgrading the PAN-OS version on a firewall, the administrator notices that the commit operation takes significantly longer than before. What is the most likely cause?

A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?

An administrator needs to provide internet access to employees while blocking access to social media sites. Which feature should be used to identify and block social media traffic?

A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?

An organization uses GlobalProtect for remote access. Users report that they cannot connect to the portal. The firewall's GlobalProtect portal configuration is correct, and the firewall has a valid certificate. What is the most likely cause of the issue?

An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?

A firewall is configured with multiple security zones. Traffic from the 'Untrust' zone to the 'DMZ' zone is allowed for web services. The administrator wants to ensure that the DMZ servers cannot initiate connections to the Untrust zone. What is the correct approach?

Which TWO of the following are valid methods to deploy a Palo Alto Networks firewall in a virtualized environment? (Choose two.)

Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?

Exhibit

Drag and drop the steps to configure a User-ID agent on a Palo Alto Networks firewall into the correct order.

Match each Palo Alto Networks service to its typical use.

A company needs to deploy a firewall for a branch office with 50 users. Which Palo Alto Networks platform is most appropriate for this requirement?

A network administrator notices that the firewall's dataplane CPU is consistently above 80% during peak hours. The administrator wants to reduce CPU load without impacting security. Which action should the administrator take?

An organization deploys VM-Series firewalls in a public cloud. They need to ensure consistent security policy management across multiple cloud accounts. Which architecture best addresses this requirement?

Track your progress over time

Start a Palo Alto Networks Platforms and Architecture only practice session

Related PCNSA topic practice pages

Managing Objects practice questions

Policy Evaluation and Management practice questions

Securing Traffic practice questions

Core Concepts practice questions