Core Concepts practice questions

A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?

Trap 1: A Zone Protection profile is dropping the traffic.

Zone Protection profiles apply at the zone level, and the admin checked only Security policy.

Trap 2: A decryption policy is blocking the traffic.

Decryption policies do not block traffic; they control decryption.

Trap 3: The Security policy rule has a source zone mismatch.

The rule allows any-to-any, so zone mismatch is unlikely.

A
A Zone Protection profile is dropping the traffic.
Why wrong: Zone Protection profiles apply at the zone level, and the admin checked only Security policy.
B
The Security policy rule has a DoS Protection profile applied that is dropping traffic.
DoS Protection profiles can drop traffic even if the rule permits it.
C
A decryption policy is blocking the traffic.
Why wrong: Decryption policies do not block traffic; they control decryption.
D
The Security policy rule has a source zone mismatch.
Why wrong: The rule allows any-to-any, so zone mismatch is unlikely.

Review the full routing breakdown →

Question 2hardmultiple choice

An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?

Trap 1: Install a virtual wire between the virtual routers.

Virtual wires are for transparent mode, not inter-VR routing.

Trap 2: Add static routes for the remote subnets in each virtual router.

Static routes enable routing but not inspection; policy is still needed.

Trap 3: Configure a default route in each virtual router pointing to the…

Only one default route per virtual router is allowed, and this does not enable inspection.

A
Install a virtual wire between the virtual routers.
Why wrong: Virtual wires are for transparent mode, not inter-VR routing.
B
Add static routes for the remote subnets in each virtual router.
Why wrong: Static routes enable routing but not inspection; policy is still needed.
C
Configure a default route in each virtual router pointing to the other.
Why wrong: Only one default route per virtual router is allowed, and this does not enable inspection.
D
Create a Security policy rule that allows traffic between the virtual routers.
Inter-virtual-router traffic must be permitted by Security policy to be inspected.

Question 3easymultiple choice

A security administrator wants to block users from accessing social media websites during business hours. The firewall is connected to the internet and has a Security policy that allows general web browsing. What is the most efficient way to block social media?

Trap 1: Create a new Security policy rule with an Application ID that…

Application ID blocks apps, not necessarily websites; URL Filtering is more appropriate.

Trap 2: Add a Custom Signature to the existing rule to block social media…

Custom Signatures are for detecting specific threats, not for URL filtering.

Trap 3: Modify the existing web browsing rule to deny social media…

This would require maintaining a list of social media IPs, which is inefficient.

A
Create a new Security policy rule with an Application ID that blocks social-media applications.
Why wrong: Application ID blocks apps, not necessarily websites; URL Filtering is more appropriate.
B
Create a new Security policy rule with a URL Filtering profile that blocks the social-media category.
URL Filtering directly blocks access by category.
C
Add a Custom Signature to the existing rule to block social media traffic.
Why wrong: Custom Signatures are for detecting specific threats, not for URL filtering.
D
Modify the existing web browsing rule to deny social media destinations.
Why wrong: This would require maintaining a list of social media IPs, which is inefficient.

Question 4mediummultiple choice

Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?

Exhibit

Refer to the exhibit.

admin@PA-500> show counter global | match tcp

tcp-conn-init           1500
tcp-conn-established    1200
tcp-conn-closed         1400
tcp-conn-failed         200
tcp-conn-reset          100
tcp-conn-half-open      50
tcp-conn-timeout        30

Trap 1: A DDoS attack is flooding the firewall with SYN packets.

SYN flood would show very high tcp-conn-init, not just half-open.

Trap 2: The firewall's TCP timeout setting is too short.

Short timeouts would reduce half-open count, not increase it.

Trap 3: The firewall's hardware is failing.

Hardware failure would show more generic errors, not specific half-open count.

A
A DDoS attack is flooding the firewall with SYN packets.
Why wrong: SYN flood would show very high tcp-conn-init, not just half-open.
B
An application on the internal network is not completing TCP handshakes.
Half-open connections indicate incomplete handshakes, likely due to application failure.
C
The firewall's TCP timeout setting is too short.
Why wrong: Short timeouts would reduce half-open count, not increase it.
D
The firewall's hardware is failing.
Why wrong: Hardware failure would show more generic errors, not specific half-open count.

Question 5hardmulti select

A security engineer is configuring a Palo Alto Networks firewall to protect a web server. The engineer wants to ensure that only HTTP and HTTPS traffic is allowed to the server, and that the traffic is inspected for threats. Which TWO actions should the engineer take?

Trap 1: Configure an SSL Forward Proxy decryption policy to decrypt HTTPS…

Decryption is not required for threat inspection on standard ports; the firewall can inspect without decryption.

Trap 2: Create a Security policy rule that allows all traffic to the web…

Allowing all traffic would permit non-HTTP/HTTPS protocols.

Trap 3: Create a Security policy rule that blocks all traffic not matching…

This would block the intended traffic as well.

A
Create a Security policy rule that allows traffic from any source to the web server on destination ports 80 and 443.
This permits HTTP and HTTPS traffic.
B
Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.
Why wrong: Decryption is not required for threat inspection on standard ports; the firewall can inspect without decryption.
C
Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.
Why wrong: Allowing all traffic would permit non-HTTP/HTTPS protocols.
D
Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.
Why wrong: This would block the intended traffic as well.
E
Attach a Vulnerability Protection profile to the Security policy rule.
This inspects traffic for threats.

Question 6easymulti select

A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?

Trap 1: Configure a DNS proxy to resolve domain names.

DNS proxy is optional; clients can use external DNS.

Trap 2: Enable User-ID to identify users on the network.

User-ID is not needed for basic internet access.

A
Configure a DNS proxy to resolve domain names.
Why wrong: DNS proxy is optional; clients can use external DNS.
B
Assign an IP address to the internal interface and set it as a Layer 3 interface.
Required for internal network connectivity.
C
Enable User-ID to identify users on the network.
Why wrong: User-ID is not needed for basic internet access.
D
Create a Security policy rule that allows traffic from internal zone to external zone.
Required to permit outbound traffic.
E
Configure a source NAT policy to translate internal private IP addresses to the external public IP.
Necessary for outbound internet access.

Review the full OSPF breakdown →

Question 7hardmultiple choice

Your organization has deployed a Palo Alto Networks PA-5250 firewall in a high-availability active/passive configuration. The firewall is connected to two ISPs for redundancy. The internal network uses OSPF with the firewall as an ASBR redistributing a default route. Recently, users reported intermittent connectivity to external resources. During troubleshooting, you notice that the active firewall's management interface has high CPU usage, and the show session all command displays many sessions in the 'active' state but with minimal data transfer. The passive firewall shows no such issues. The OSPF neighbor relationships are stable. What is the most likely cause of the intermittent connectivity?

Trap 1: OSPF is flapping and causing route instability.

OSPF neighbors are stable, so flapping is not present.

Trap 2: A DDoS attack is overwhelming the management plane.

DDoS would affect dataplane more, and management CPU would not be sole symptom.

Trap 3: The firewall's licenses have expired, causing feature degradation.

License expiry would not cause the described symptoms.

A
OSPF is flapping and causing route instability.
Why wrong: OSPF neighbors are stable, so flapping is not present.
B
Asymmetric routing is occurring due to a misconfiguration in the active/passive HA setup.
Asymmetric routing can cause sessions to be stuck and high management CPU as the firewall tries to process out-of-state packets.
C
A DDoS attack is overwhelming the management plane.
Why wrong: DDoS would affect dataplane more, and management CPU would not be sole symptom.
D
The firewall's licenses have expired, causing feature degradation.
Why wrong: License expiry would not cause the described symptoms.

Review the full routing breakdown →

Question 8mediummultiple choice

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Exhibit

Refer to the exhibit.

show routing route 10.0.1.0/24

vr: default
10.0.1.0/24
  via 10.0.0.2, interface ethernet1/3, metric 10, preference 10, route-type static
  via 10.0.0.3, interface ethernet1/4, metric 20, preference 10, route-type static
  via 10.0.0.4, interface ethernet1/5, metric 10, preference 30, route-type ospf

Trap 1: The route via 10.0.0.3 on ethernet1/4

Incorrect: Metric 20 is higher than metric 10.

Trap 2: The route via 10.0.0.4 on ethernet1/5

Incorrect: OSPF has higher preference (30).

Trap 3: All three routes are used in ECMP

Incorrect: Preferences differ, so ECMP does not apply.

A
The route via 10.0.0.3 on ethernet1/4
Why wrong: Incorrect: Metric 20 is higher than metric 10.
B
The route via 10.0.0.2 on ethernet1/3
Correct: Lowest preference (10) and lowest metric (10).
C
The route via 10.0.0.4 on ethernet1/5
Why wrong: Incorrect: OSPF has higher preference (30).
D
All three routes are used in ECMP
Why wrong: Incorrect: Preferences differ, so ECMP does not apply.

Question 9hardmulti select

Which THREE actions can a Security policy rule perform on traffic?

Trap 1: Reset

Incorrect: Reset is not a standalone action; it is part of Deny.

Trap 2: Block

Incorrect: Block is not a valid action; the correct term is Deny.

A
Drop
Correct: Drop silently discards the packet.
B
Reset
Why wrong: Incorrect: Reset is not a standalone action; it is part of Deny.
C
Deny
Correct: Deny terminates the session with a reset.
D
Block
Why wrong: Incorrect: Block is not a valid action; the correct term is Deny.
E
Allow
Correct: Allow permits traffic matching the rule.

Read the full VPN explanation →

Question 10hardmultiple choice

A security administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The Phase 1 proposal includes AES-256, SHA-256, and DH Group 14 with a lifetime of 28800 seconds. The Phase 2 proposal includes AES-256, SHA-256, and PFS with DH Group 14. The tunnel is established and traffic is flowing, but intermittently the tunnel drops and re-establishes. The logs show the following error: 'Phase 2 negotiation failed because no suitable proposal found.' Both firewalls have identical IKE gateway and IPsec crypto profile configurations. Which option is the most likely cause of this issue?

Trap 1: The DH group used in Phase 2 is not supported by the firewall model.

Incorrect: DH Group 14 is widely supported.

Trap 2: The Phase 2 proposal uses a different DH group than Phase 1.

Incorrect: PFS uses DH group 14, but the error is not about DH group mismatch.

Trap 3: The Phase 1 lifetime is shorter than the Phase 2 lifetime.

Incorrect: Phase 1 lifetime is typically longer than Phase 2; the error is not lifetime-related.

A
The DH group used in Phase 2 is not supported by the firewall model.
Why wrong: Incorrect: DH Group 14 is widely supported.
B
The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.
Correct: If the IPsec SA lifetime is not explicitly set, the firewall uses a default value that may differ from the peer's configured value, leading to proposal mismatch.
C
The Phase 2 proposal uses a different DH group than Phase 1.
Why wrong: Incorrect: PFS uses DH group 14, but the error is not about DH group mismatch.
D
The Phase 1 lifetime is shorter than the Phase 2 lifetime.
Why wrong: Incorrect: Phase 1 lifetime is typically longer than Phase 2; the error is not lifetime-related.

Read the full NAT/PAT explanation →

Question 11mediumdrag order

Drag and drop the steps to configure a NAT policy on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Review the full subnetting walkthrough →

Match each log type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Records session information

Records blocked attacks

Records web browsing activity

Records files sent for analysis

Question 13mediummultiple choice

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

Trap 1: Zone Protection profile is set to 'Log at Session Start'

Zone Protection profiles handle flood protection and other zone-based settings, not rule logging.

Trap 2: The Log Forwarding profile is not applied

Log Forwarding profiles send logs to external destinations but the rule must first have logging enabled.

Trap 3: Disable Server Response Inspection on the rule

Disabling server response inspection does not affect traffic logging.

A
Zone Protection profile is set to 'Log at Session Start'
Why wrong: Zone Protection profiles handle flood protection and other zone-based settings, not rule logging.
B
The Log Forwarding profile is not applied
Why wrong: Log Forwarding profiles send logs to external destinations but the rule must first have logging enabled.
C
The rule has 'Log at Session End' disabled
If 'Log at Session End' is not checked, traffic matching the rule will not be logged.
D
Disable Server Response Inspection on the rule
Why wrong: Disabling server response inspection does not affect traffic logging.

Question 14easymultiple choice

A company wants to ensure that all internet-bound HTTP traffic is decrypted for inspection before being forwarded to the next-generation firewall for policy enforcement. Which deployment method should be used?

Trap 1: Virtual wire mode with SSL Forward Proxy

Virtual wire mode is transparent and does not support SSL decryption.

Trap 2: Transparent proxy with a forward trust certificate

Transparent proxy intercepts traffic without explicit configuration but SSL decryption still requires an explicit proxy configuration.

Trap 3: Layer 3 mode with a policy-based forwarding rule

Policy-Based Forwarding can redirect traffic but does not enable SSL decryption automatically.

A
Virtual wire mode with SSL Forward Proxy
Why wrong: Virtual wire mode is transparent and does not support SSL decryption.
B
Explicit proxy with SSL Forward Proxy decryption
Explicit proxy mode lets the firewall act as a forward proxy and perform SSL decryption for inspection.
C
Transparent proxy with a forward trust certificate
Why wrong: Transparent proxy intercepts traffic without explicit configuration but SSL decryption still requires an explicit proxy configuration.
D
Layer 3 mode with a policy-based forwarding rule
Why wrong: Policy-Based Forwarding can redirect traffic but does not enable SSL decryption automatically.

Question 15hardmultiple choice

An organization is experiencing high CPU utilization on the firewall dataplane, causing latency in packet processing. The administrator notices that a large number of small packets are being processed by a specific security rule that allows any service. What is the best first step to reduce CPU load without impacting legitimate traffic?

Trap 1: Remove the rule and create a more specific rule with a narrower…

Removing the rule would block all traffic matching the original rule, impacting operations.

Trap 2: Apply a DoS protection profile with a session rate threshold

DoS protection can help but may drop legitimate bursts; QoS is a more direct approach to manage bandwidth.

Trap 3: Increase the session timeout to avoid creating new sessions

Increasing session timeout does not reduce the number of packets being inspected; it only keeps sessions open longer.

A
Remove the rule and create a more specific rule with a narrower service
Why wrong: Removing the rule would block all traffic matching the original rule, impacting operations.
B
Apply a DoS protection profile with a session rate threshold
Why wrong: DoS protection can help but may drop legitimate bursts; QoS is a more direct approach to manage bandwidth.
C
Create a QoS policy to limit bandwidth for that traffic class
QoS can throttle the amount of traffic processed, reducing CPU utilization while still allowing legitimate traffic.
D
Increase the session timeout to avoid creating new sessions
Why wrong: Increasing session timeout does not reduce the number of packets being inspected; it only keeps sessions open longer.

Question 16easymultiple choice

A network administrator wants to allow FTP traffic from the internal network (zone: trust) to an external server (zone: untrust) while ensuring that the firewall can inspect the FTP control and data channels. Which security rule configuration is required?

Trap 1: Create a rule with service 'tcp-21' and application 'any'

This only allows control channel; data channel on random ports may be blocked.

Trap 2: Create a rule with application 'ftp' and disable Application…

Without Application Override, the firewall may not properly associate data channels.

Trap 3: Create a rule with application 'ftp' and service…

Application 'ftp' does not inherently handle dynamic data channel inspection without ALG support.

A
Create a rule with service 'tcp-21' and application 'any'
Why wrong: This only allows control channel; data channel on random ports may be blocked.
B
Create a rule with application 'ftp' and disable Application Override
Why wrong: Without Application Override, the firewall may not properly associate data channels.
C
Create a rule with application 'ftp' and enable 'FTP Alg' in the Application Override settings
FTP ALG ensures the firewall can inspect FTP control and negotiate data channel inspection.
D
Create a rule with application 'ftp' and service 'application-default'
Why wrong: Application 'ftp' does not inherently handle dynamic data channel inspection without ALG support.

Question 17mediummultiple choice

An administrator configures a security policy rule to block traffic from IP address 10.1.1.1 to 10.2.2.2 on any service. However, traffic from 10.1.1.1 to 10.2.2.2 is still passing through the firewall. After checking all rules, what is the most likely cause?

Trap 1: The rule is placed after an allow rule that matches the traffic

If the block rule is below an allow rule, the allow rule will match first, but the administrator said the rule is placed correctly; this is a possible cause but less likely if ordering is verified.

Trap 2: The source and destination zones are set to 'any'

Setting zones to 'any' would not prevent the rule from matching; it would broaden the match.

Trap 3: There is an implicit allow rule that overrides the block rule

The implicit rule at the end is deny, not allow. Only explicit allow rules can override.

A
The rule is placed after an allow rule that matches the traffic
Why wrong: If the block rule is below an allow rule, the allow rule will match first, but the administrator said the rule is placed correctly; this is a possible cause but less likely if ordering is verified.
B
The source and destination zones are set to 'any'
Why wrong: Setting zones to 'any' would not prevent the rule from matching; it would broaden the match.
C
There is an implicit allow rule that overrides the block rule
Why wrong: The implicit rule at the end is deny, not allow. Only explicit allow rules can override.
D
The rule is configured in the PBF rulebase instead of the Security rulebase
Policy-Based Forwarding rules do not enforce security; they only redirect traffic. If the rule was accidentally placed in PBF, it would not block.

Read the full NAT/PAT explanation →

Question 18hardmultiple choice

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Trap 1: Change the service to TCP/443 and allow all applications

This would bypass application control but still be subject to URL filtering based on the profile.

Trap 2: Remove the URL Filtering profile from the security rule

This would disable URL filtering for all traffic matching the rule, not just the specific site.

Trap 3: Change the URL Filtering action for 'hacking' category to 'allow'

This would allow all hacking sites, which is too permissive.

A
Change the service to TCP/443 and allow all applications
Why wrong: This would bypass application control but still be subject to URL filtering based on the profile.
B
Remove the URL Filtering profile from the security rule
Why wrong: This would disable URL filtering for all traffic matching the rule, not just the specific site.
C
Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block
URL Filtering profiles support override rules to allow or block specific URLs with higher priority.
D
Change the URL Filtering action for 'hacking' category to 'allow'
Why wrong: This would allow all hacking sites, which is too permissive.

Question 19easymultiple choice

Which of the following is a best practice when configuring an HA (High Availability) pair of Palo Alto Networks firewalls?

Trap 1: Set both firewall's HA election delay to '0' for fast failover

Setting delay to 0 can cause unnecessary failovers; a small delay is recommended to avoid flapping.

Trap 2: Enable preemptive mode to ensure the primary firewall always…

Preemptive mode can cause flapping if the primary firewall goes down and comes back; often disabled in stable environments.

Trap 3: Configure both firewalls in active/active mode to maximize…

Active/active mode adds complexity and is not generally recommended without specific requirements.

A
Set both firewall's HA election delay to '0' for fast failover
Why wrong: Setting delay to 0 can cause unnecessary failovers; a small delay is recommended to avoid flapping.
B
Use a dedicated physical interface or VLAN for HA heartbeat communication
A dedicated interface ensures HA heartbeat packets are not impacted by traffic loads or routing changes.
C
Enable preemptive mode to ensure the primary firewall always resumes control
Why wrong: Preemptive mode can cause flapping if the primary firewall goes down and comes back; often disabled in stable environments.
D
Configure both firewalls in active/active mode to maximize throughput
Why wrong: Active/active mode adds complexity and is not generally recommended without specific requirements.

Question 20mediummultiple choice

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

Trap 1: Source zone: DMZ, Destination zone: trust, Application:…

This would allow traffic from DMZ to trust, which is opposite direction.

Trap 2: Source zone: trust, Destination zone: DMZ, Service: any,…

Using service 'any' and application 'any' is overly permissive and not best practice.

Trap 3: Source zone: trust, Destination zone: trust, Application:…

Both zones should not be the same for this scenario; DMZ is the destination.

A
Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow
Why wrong: This would allow traffic from DMZ to trust, which is opposite direction.
B
Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow
Why wrong: Using service 'any' and application 'any' is overly permissive and not best practice.
C
Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow
This correctly permits internal users to access the DMZ web server using web-browsing application.
D
Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow
Why wrong: Both zones should not be the same for this scenario; DMZ is the destination.