53 questions · Pcnsa Securing Traffic topic · All types, answers revealed
Decrypts SSH traffic for inspection.
Why this answer
SSH Proxy is a valid method for decrypting SSL/TLS traffic on a Palo Alto Networks firewall because it allows the firewall to act as a man-in-the-middle for SSH connections, decrypting the SSH tunnel to inspect the encapsulated traffic. This is distinct from SSL/TLS decryption but is grouped under the same decryption feature set for inspecting encrypted protocols.
When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?
These are the minimum required fields in a security policy rule.
Why this answer
Option D is correct because a security policy rule in Palo Alto Networks firewalls requires at minimum the source zone, destination zone, source address, destination address, application, and action to be defined. For HTTP traffic from internal to external zones, these components ensure the rule is specific enough to match the intended traffic while leveraging App-ID for application identification, not just port-based service definitions.
Exam trap
The trap here is that candidates often confuse Service with Application, assuming a port-based service (like TCP/80) is mandatory, but Palo Alto emphasizes App-ID as the primary identifier, making Service optional when Application is defined.
How to eliminate wrong answers
Option A is wrong because User is not a mandatory component; it is optional for user-based policy enforcement via User-ID, but not required for basic HTTP traffic. Option B is wrong because Service is not mandatory when Application is defined; App-ID identifies the application (e.g., HTTP) regardless of port, making Service redundant or optional. Option C is wrong because it omits Application and Source/Destination Address, which are mandatory; Service alone cannot replace Application for proper traffic identification, and Action is listed but the rule still lacks required address objects.
A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?
Rules are evaluated from top to bottom; a rule above that matches the traffic will apply, bypassing the blocking rule.
Why this answer
In Palo Alto Networks firewalls, rules are evaluated from top to bottom in the rulebase. If a rule with a broader match (e.g., allowing all traffic from a specific zone or application) is placed above the specific blocking rule, traffic matching the broader rule will be permitted before reaching the block rule. This is the most likely cause because the administrator confirmed the custom object is correct and committed, ruling out configuration errors.
Exam trap
The trap here is that candidates may assume a correctly configured object guarantees enforcement, overlooking the fundamental rulebase ordering principle where a higher-priority allow rule can override a lower-priority block rule.
How to eliminate wrong answers
Option A is wrong because security profile groups are applied after a rule is matched and do not block traffic before rule evaluation; they inspect allowed traffic. Option B is wrong because the administrator verified the custom object is correctly listed, implying it was committed; uncommitted objects would not be listed in the rule. Option D is wrong because an out-of-sync device clock affects time-based rules only if the rule has a schedule configured, and the question does not mention any time-based condition.
A firewall is configured with multiple virtual systems (vsys). An administrator wants to allow traffic from vsys1 to vsys2 while keeping other inter-vsys traffic blocked. How should this be accomplished?
Inter-vsys traffic is controlled by security policies using zones from different vsys.
Why this answer
Option C is correct because inter-vsys traffic is controlled by a security policy with source zone in vsys1 and destination zone in vsys2. Option A is wrong because inter-vsys rules exist, it's not automatic. Option B is wrong because there is no global setting.
Option D is wrong because intra-vsys is within same vsys.
A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?
Block the category, then allow the specific override.
Why this answer
Option C is correct because blocking the social-networking category and then creating a custom URL category with LinkedIn's URLs set to allow overrides the block. Option A is wrong because allowing social-networking would allow all social media. Option B is wrong because blocking LinkedIn specifically would also block it.
Option D is wrong because alert does not block.
Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)
DNS Security detects tunneling attempts.
Why this answer
Option A is correct because DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.
A company's security policy uses application-based rules. However, some traffic from a new cloud application is being blocked even though the application is allowed in the rule. What should the administrator check first?
Unknown or uncategorized applications may not match the rule.
Why this answer
Option D is correct because the application might not be identified by App-ID if the traffic is encrypted or unknown. The administrator should verify the application is recognized. Option A is wrong because rule order is less likely if the rule matches.
Option B is wrong because zones are configured. Option C is wrong because the rule already allows application; blocking is a different action.
An organization wants to segment internal traffic between the Engineering and Finance departments and apply threat prevention. Which TWO actions should be taken? (Choose two.)
Separate zones allow fine-grained security policies between departments.
Why this answer
Option B is correct because security zones are the fundamental building blocks for segmenting traffic in Palo Alto Networks firewalls. By placing Engineering and Finance interfaces into separate zones, you create a trust boundary that allows you to enforce inter-zone security rules. Option E is correct because applying Threat Prevention profiles (e.g., antivirus, anti-spyware, vulnerability protection) to the inter-zone rule enables the firewall to inspect and block malicious traffic between the segmented departments.
Without tunnel detection, the firewall cannot identify SSH tunnels, so the Allow_SSH policy never applies, and tunnels are likely blocked by the default or other rules.
Why this answer
Option D is correct because tunnel detection set to 'none' on the Allow_SSH policy means the firewall does not detect SSH tunnels, so they are not allowed. The default behavior for application tunnels is to check tunnel detection attributes; without detection, the tunnel policy does not match. Option A is wrong because Block_Tor only blocks Tor.
Option B is not necessarily default. Option C is not relevant.
Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?
Allow permits traffic through the firewall.
Why this answer
Option B is correct because setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.
Exam trap
The trap here is that candidates often confuse 'Log at Session Start' with 'Log at Session End', thinking that logging at the start is sufficient for full traffic logging, but in reality, session-end logs provide the complete session metadata needed for security analysis.
A user at source IP 10.1.1.1 initiates an HTTPS connection to a web server on the internet. Which rule will the traffic match?
Since HTTPS is not HTTP, rule 1 fails; rule 2 matches any application and denies.
Why this answer
Option A is correct because rule 1 matches HTTP only; HTTPS is a different application (ssl). Rule 2 does not match because it is after rule 1? Actually the traffic hits rule 1 first, but since application is http and not ssl, rule 1 does not match. Then rule 2 matches because it applies to any application from 10.0.0.0/8, so it matches and denies the traffic.
Rule 3 is for DNS only. So traffic will be denied by rule 2.
Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Packet capture involves entering CLI, issuing tcpdump with filters, stopping the capture, and exporting the file.
An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?
Allows identification and enforcement based on application signatures.
Why this answer
Options A and C are correct. Application-ID identifies and controls applications, while Content-ID controls file transfers and data patterns. User-ID controls user access, URL filtering controls web categories, WildFire analyzes unknown files.
When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?
Scans for known viruses and malware.
Why this answer
Options A, B, and C are correct. Antivirus blocks known malware, Anti-Spyware blocks spyware and grayware, and Vulnerability Protection blocks exploit attempts. URL Filtering is for categories, File Blocking blocks specific files.
During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?
Updating App-ID and using enhancements like application override can correct misidentification.
Why this answer
Option C is correct because ensuring App-ID updates are current and using application identification enhancements (like application override when needed) improves accuracy. Option A may help but not directly address misidentification. Option B is possible but not first step.
Option D is regressive.
Based on the log entry, what is the most likely reason for the TCP reset from the client?
Client resets can occur due to SSL/TLS handshake failures.
Why this answer
Option C is correct because a client may send a reset if it receives an unexpected response, such as a certificate error. HTTPS traffic is encrypted; if the server's certificate is invalid or the firewall's decryption is misconfigured, the client may reject the connection and send a reset. Option A is wrong because a timeout would show tcp-timeout.
Option B is wrong because if the server reset, it would be tcp-rst-from-server. Option D is wrong because application is ssl; it's not blocked.
Which TWO security profile types are used to block known malware? (Choose two.)
File blocking can block malicious file types.
Why this answer
Options A and C are correct. Antivirus blocks malware based on signatures. File Blocking blocks specific file types, which can include malicious files.
Anti-spyware blocks spyware specifically. Vulnerability Protection blocks exploits, not malware files. URL Filtering controls URLs.
Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?
The 'internal-ip' category is predefined to match traffic to internal IP addresses and bypasses URL filtering.
Why this answer
Options A and C are correct. The 'internal-ip' URL category automatically bypasses URL filtering for internal IPs, and custom URL categories allow specifying sites to exempt. Option B is incorrect because URL filter override via user-id agent is not a standard feature.
Option D is incorrect because setting a profile to 'alert' does not bypass filtering, it only logs. Option E is incorrect because there is no IP exemption list in URL filtering profiles.
A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?
This is a common cause: uncategorized URLs are blocked by default if the action is not 'alert'.
Why this answer
Option A is correct because the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block'. However, if the 'uncategorized' category is set to 'block', any website not yet categorized in Palo Alto Networks' URL database (e.g., new or less common legitimate sites like online banking portals or cloud apps) will be blocked. This explains why legitimate sites are being blocked despite the profile being permissive for known categories.
Exam trap
The trap here is that candidates assume only the explicitly mentioned categories (e.g., 'malware') matter, overlooking the 'uncategorized' category which is often set to 'block' by default or inadvertently, causing legitimate traffic to be blocked.
How to eliminate wrong answers
Option B is wrong because the question states the security policy includes a single rule allowing outbound HTTP/HTTPS traffic, and there is no mention of a deny rule above it; incorrect rule order would cause all traffic to be blocked, not just specific legitimate sites. Option C is wrong because URL Filtering profiles are applied per security rule, not at the zone level; zone-level application is not a feature of Palo Alto Networks firewalls. Option D is wrong because insufficient memory would cause packet drops or performance degradation across all traffic, not selective blocking of legitimate websites, and the firewall's logs show sessions to malicious IPs are not being blocked, indicating memory is not the issue.
Destination NAT translates the public IP to the private IP, and the policy allows the traffic.
Why this answer
To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.
Exam trap
The trap here is that candidates often confuse Source NAT with Destination NAT, assuming any NAT rule will work, or they think a security policy alone is sufficient without understanding that NAT is required to route the traffic to the internal server.
How to eliminate wrong answers
Option A is wrong because Source NAT (SNAT) translates the source IP of outbound traffic, not the destination IP of inbound traffic; it would not help the mail server receive inbound SMTP. Option C is wrong because it incorrectly describes a security policy rule with source NAT, which is not a valid configuration for inbound traffic; source NAT is used for outbound traffic, and the translation described (public to private) is actually destination NAT. Option D is wrong because without a NAT rule, the firewall would not translate the destination IP from the public IP to the private IP of the mail server, so the traffic would not reach the server even if the security policy allows it.
Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)
Clients must trust the CA that signs the decrypted sessions.
Why this answer
Options A, B, and D are correct. The root CA certificate must be installed on clients so they trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt.
A decryption profile specifies the forward proxy certificate (the CA cert). Option C is wrong because the server certificate is not needed on clients. Option E is wrong because the private key is on the server, not required.
An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?
HIP checks device posture and enforces compliance.
Why this answer
Options A and C are correct. Host Information Profile (HIP) checks device compliance (OS, antivirus, etc.) and client certificates authenticate the device. Gateway configuration is basic, pre-logon is for always-on, App-IP mapping is not used.
If the user is not correctly identified, policies based on user (like group-based allow/deny) may not apply correctly.
Why this answer
Option B is correct because if other users can access the same server, the issue is likely user-specific, and checking user-ID mapping ensures the user is correctly identified and the proper security rules apply. Option A is less likely as other users have same source zone. Option C is external.
Option D is not relevant.
Clients need to trust the CA that signs the decrypted certificates.
Why this answer
Option A is correct because the firewall's CA certificate must be trusted by client browsers. Without it, the dynamically generated certificates for remote sites are not trusted. Option B is wrong because the server certificate is not needed on clients.
Option C is wrong because the decryption policy does not require a certificate on the firewall. Option D is wrong because CRL is for revocation, not trust.
A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?
Rule order evaluation stops on first match; allow rule above the deny will permit traffic.
Why this answer
Option D is correct because any deny rule placed after a matching allow rule will not be evaluated if the allow rule is hit first. Rule order is critical in PAN-OS. Option A is wrong because removing the rule is not the cause.
Option B is wrong because policy is not optional. Option C is wrong because implicit deny exists but only if no rule matches.
Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?
The traffic matches all criteria in rule 1 and is allowed.
Why this answer
Rule 1 (allow-web) matches because it permits HTTP traffic from source 10.10.10.10 to destination 192.0.2.50 on port 80. The user is browsing to http://192.0.2.50, which uses TCP port 80, and the rule's source and destination IPs align with the traffic flow. In Palo Alto Networks firewalls, rules are evaluated in order, and the first match is applied.
Exam trap
Palo Alto Networks often tests the concept that rule order matters and that a more specific rule (like allow-web) will match before a generic block rule, leading candidates to incorrectly assume a later block rule would apply if they overlook the explicit allow rule earlier in the list.
How to eliminate wrong answers
Option A is wrong because Rule 3 (allow-dns) is designed for DNS traffic (UDP/TCP port 53), not HTTP (TCP port 80), and the destination IP 192.0.2.50 is not a DNS server in this context. Option B is wrong because Rule 2 (block-malware) would block traffic based on threat signatures or malicious IPs, but the traffic is a legitimate HTTP request to 192.0.2.50, and no malware indicators are present. Option D is wrong because Rule 1 matches the traffic, so the default deny action is not triggered; the firewall applies the first matching rule.
An organization wants to hide internal IP addresses when accessing the Internet. Which type of NAT should be configured?
Why this answer
Option B is correct because source NAT (translation of source IP) is used to hide internal addresses. Option A is wrong because destination NAT translates incoming traffic. Option C is wrong because static NAT maps one-to-one and does not hide.
Option D is wrong because this is not a standard PAN NAT type.
Excluding high-value but sensitive categories reduces decryption load and complies with regulatory standards, thus improving performance.
Why this answer
Option B is correct because excluding certain sensitive or unnecessary categories (e.g., banking) reduces decryption load and related performance issues. Option A is incorrect because hardware offloading may not be available or may not address the root cause. Option C is incorrect because increasing session timeouts does not reduce decryption processing.
Option D is incorrect because using high-strength ciphers increases processing overhead.
A company configures GlobalProtect for remote access. Remote users can successfully connect to the firewall and obtain an IP address, but they cannot access internal resources (e.g., file servers) located in the internal network. The firewall has a security rule that allows traffic from the GlobalProtect zone to the internal zone with appropriate applications. Logs show that traffic from remote users is being matched to a different rule that denies inter-zone traffic from the GlobalProtect zone to the internal zone. The administrator checks the GlobalProtect gateway configuration and sees that the gateway assigns IP addresses from a pool, but no internal routes are defined. What is the most likely issue? The GlobalProtect gateway configuration is missing internal resource routes or split-tunneling settings. The User-ID agent is not mapping remote usernames correctly. The source zone in the security rule is set to 'Trust' instead of 'GlobalProtect'. The internal resources require a specific security profile that is not applied to the rule.
If the rule expects source zone 'Trust', traffic from GlobalProtect zone won't match, and a subsequent deny rule blocks it.
Why this answer
Option C is correct because if the security rule's source zone is 'Trust' instead of 'GlobalProtect', traffic from the GlobalProtect zone will not match the intended rule and will fall through to a default deny rule. Option A is incorrect because internal resource routes are for routing, not policy matching. Options B and D are less likely given the log behavior.
An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?
DNS Security is designed to detect and block DNS tunneling.
Why this answer
DNS Security profile is specifically designed to detect and block DNS tunneling, which is a technique used to exfiltrate data by encoding it within DNS queries and responses. By inspecting DNS traffic for anomalies such as high query rates, unusual domain names, or non-standard record types, the DNS Security profile can identify and prevent data exfiltration attempts. Other security profiles do not have the specialized DNS-layer inspection capabilities required to counter this threat.
Exam trap
The trap here is that candidates often confuse DNS Security with Anti-Spyware, assuming that spyware signatures will catch tunneling, but DNS tunneling is a protocol-level evasion technique that requires dedicated DNS inspection, not just signature-based malware detection.
How to eliminate wrong answers
Option B is wrong because Vulnerability Protection profile is designed to detect and block exploit attempts targeting known vulnerabilities in applications and operating systems, not to analyze DNS traffic for tunneling or exfiltration patterns. Option C is wrong because URL Filtering profile controls access to web categories and URLs based on policy, but it does not inspect the content or structure of DNS queries to identify tunneling behavior. Option D is wrong because Anti-Spyware profile focuses on blocking malware command-and-control (C2) traffic and spyware signatures, but it lacks the deep DNS protocol analysis needed to detect data exfiltration via DNS tunneling.
A company recently deployed a Palo Alto Networks PA-220 firewall to secure outbound web access. The security policies include a rule named 'Allow-Web' with the following configuration: source zone 'Inside', destination zone 'Outside', application 'web-browsing', service 'application-default', action 'allow'. All other traffic is denied by a default deny rule. Users report that they can access most public websites, but they cannot access a partner's website hosted at 203.0.113.50 on TCP port 8080. Connections to this site time out. DNS resolution for the hostname works correctly. The firewall logs show that traffic from internal users to 203.0.113.50:8080 is not matching any rule and is being denied by the default deny rule. Which action should the administrator take to resolve the issue while adhering to security best practices?
This allows App-ID to recognize the traffic on the non-standard port while maintaining granular control.
Why this answer
Option C is correct because the traffic to 203.0.113.50 on TCP port 8080 is not matching the 'web-browsing' application, which by default only recognizes HTTP (TCP 80) and HTTPS (TCP 443). Creating a custom application that matches TCP port 8080 and adding it to the 'Allow-Web' rule allows the firewall to identify and permit this traffic while still enforcing application-based control, adhering to the security best practice of least privilege.
Exam trap
The trap here is that candidates assume 'web-browsing' will match any HTTP-like traffic regardless of port, but Palo Alto Networks App-ID requires explicit application definition for non-standard ports, and simply changing the service or application to 'any' undermines the security model.
How to eliminate wrong answers
Option A is wrong because permitting traffic to 203.0.113.50 on any port and any application bypasses all application and port restrictions, violating the principle of least privilege and potentially allowing malicious traffic. Option B is wrong because changing the service to 'any' would allow web-browsing on any port, but the traffic on TCP 8080 still does not match the 'web-browsing' application definition, so the rule would not permit it. Option D is wrong because modifying the rule to use application 'any' would allow all applications through the rule, completely defeating the purpose of application-based security and exposing the network to unnecessary risks.
Based on the exhibit, what is the role of the rule "Allow_Outbound"?
The session matched rule Allow_Outbound, which is a security rule that permitted the session.
A large enterprise with thousands of security rules wants to reduce rule count without compromising security visibility. The current rules use many specific applications and services. Which strategy should be implemented to consolidate rules effectively?
SPGs allow multiple rules to reference the same security profiles, reducing rule count while maintaining security posture.
Why this answer
Option D is correct because using Security Profile Groups (SPGs) allows multiple rules to share the same profiles, reducing duplication. Option A is incorrect as using default ports bypasses App-ID. Option B is incorrect because placing specific rules at top does not reduce count.
Option C is incorrect because converting to service objects removes application visibility.
An administrator wants to block traffic from a specific user using User-ID. What is required to identify users in security policies?
User-ID maps IP addresses to usernames.
Why this answer
Option A is correct because User-ID requires user mapping from AD, captive portal, or other methods. Option B is wrong because URL filtering is separate. Option C is wrong because decryption is not needed for user identification.
Option D is wrong because application identification is different.
DIPP translates internal IPs to public IPs with port multiplexing, suitable for outbound internet access.
Why this answer
Option A is correct because Dynamic IP and Port (DIPP) allows many internal IPs to share a pool of public IPs using port address translation. Option B is for static 1-to-1 mapping. Option C is for inbound traffic.
Option D is for two-way NAT.
An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?
This is straightforward and effective; the rule denies traffic from that IP immediately.
Why this answer
Option D is correct because creating a security rule with source zone, source IP, and action deny placed at the top of the rulebase is the direct and simplest method. Option A lacks source zone. Options B and C are more complex and intended for different purposes.
A custom application allows App-ID to correctly identify HTTP traffic on non-standard ports, and adding it to the rule allows the traffic.
Why this answer
The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.
Exam trap
The trap here is that candidates assume changing the service to 'any' or removing the service restriction will allow the traffic, but they overlook that the application 'web-browsing' still has a default port binding of 80, so the traffic on port 8080 will not be matched by the rule.
How to eliminate wrong answers
Option A is wrong because adding a new rule before rule1 with application 'web-browsing' and service 'tcp-8080' would still not match the traffic, as 'web-browsing' application is typically defined for port 80, not 8080. Option B is wrong because removing the service restriction from rule1 would allow any service, but the application 'web-browsing' still only matches port 80, so the traffic would not be identified as matching the rule. Option D is wrong because changing the application to 'any' would bypass application identification, which is not a best practice and does not address the need to match the specific port 8080 traffic; the firewall would still need a service or application definition for port 8080.
A network administrator is troubleshooting a connectivity issue. The firewall has a security rule that allows traffic from the Trust zone to the Untrust zone for the subnet 192.168.1.0/24 with application 'web-browsing'. However, users in that subnet cannot access any external websites. The administrator checks the logs and sees that the traffic is being blocked by a rule named 'Deny All' that is listed before the allow rule in the policy order. What is the most likely cause of the problem? The rule order is incorrect; the allow rule is below the 'Deny All' rule. The source address object for the allow rule is misconfigured with a wrong subnet mask. The application 'web-browsing' is not being properly identified by App-ID. The User-ID agent is overriding the allow rule and triggering a block action.
Since the logs show the traffic matches the deny rule, the allow rule must be positioned lower in the rulebase.
Why this answer
Option A is correct because in Palo Alto Networks firewalls, rules are evaluated in top-down order. If the 'Deny All' rule is above the allow rule, it will match first and block traffic. Options B, C, and D are plausible but less likely given the log evidence.
A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?
Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.
Why this answer
When a firewall sees a non-SYN TCP packet without having seen the initial SYN, it cannot validate the TCP three-way handshake state. This typically occurs with asymmetric routing, where the SYN traverses one firewall and subsequent packets arrive at a different firewall that lacks the session state. The firewall drops these packets with the 'tcp-non-syn' reason because it has no corresponding session entry to associate them with.
How to eliminate wrong answers
Option A is wrong because out-of-order sequence numbers cause 'tcp-out-of-window' drops, not 'tcp-non-syn'; the firewall tracks sequence numbers within the established session window. Option B is wrong because a misconfigured NAT policy would typically cause translation failures or session timeouts, not a 'tcp-non-syn' drop; the firewall would still see the SYN and create a session. Option C is wrong because an incorrect service object would cause a policy match failure or application misidentification, but the firewall would still process the SYN and create a session if the traffic is allowed; the 'tcp-non-syn' drop specifically indicates no prior SYN was seen.
Which TWO of the following are methods to identify users for User-ID? (Choose two.)
Captive Portal authenticates users directly and maps IPs.
Why this answer
Options A and D are correct. User-ID agent collects user mappings from AD; Captive Portal authenticates users directly. LDAP sync is not a method for User-ID; it's a protocol.
XML API can be used but not standard method. Kerberos is not directly used.
An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?
This correctly uses user-ID and places the deny before the allow to block HR users' social media traffic.
Why this answer
Option D is correct because rules are evaluated top-down; the deny rule must come before the allow rule to block the targeted users. Option A lacks user-ID. Option B order is wrong.
Option C places deny after allow, so it will never be hit.
An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.
The default profile uses only local signatures; without WildFire analysis, new or customized malware can bypass.
Why this answer
Option B is correct because the default malware profile may rely on known signatures and may not detect unknown malware; a profile with WildFire analysis is needed. Option A is incorrect because the domain is not in the excluded category. Option C is plausible but less likely given that the malware uses a custom packer; WildFire would help if enabled.
Option D is incorrect because 'ssl' is the application for decrypted SSL traffic, and 'web-browsing' would also apply if HTTP is used, but the actual application is detected correctly.
Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?
Why this answer
Option C is correct. The rule Allow_Web has application ssl which matches HTTPS, and service tcp/443 matches. So the traffic is allowed.
Option A is partially correct but best answer is C because service is explicitly matched. Option B is not hit as the traffic matches Allow_Web first. Option D is incorrect because source is any.
A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?
Decryption exclusion rules allow you to bypass decryption for sensitive destinations.
Why this answer
Option A is correct because decryption exclusion rules can be created for specific URLs or URL categories to bypass decryption. Option B is not practical as it disables decryption globally. Option C is wrong because it decrypts HTTP only, not HTTPS.
Option D is not reliable.
A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?
Without a route, the firewall cannot forward packets to the destination.
Why this answer
The most likely cause is that the virtual router lacks a default route to the external network. Even though the security policy permits the traffic, the firewall must have a route in the virtual router's routing table to forward packets toward the destination. Without a default route, the firewall drops the traffic because it cannot determine the next hop for the external server's IP address.
How to eliminate wrong answers
Option A is wrong because a zone protection profile blocks ICMP at the zone level, but the user can already ping the management IP, indicating ICMP is not blocked globally; the issue is routing, not ICMP filtering. Option C is wrong because decryption policies apply to SSL/TLS traffic, not to ICMP ping traffic, and the question states the user is pinging, so decryption is irrelevant. Option D is wrong because a missing NAT policy would affect source address translation but not prevent the firewall from routing the packet; the firewall can still forward traffic without NAT if the destination is reachable, but the core problem here is the lack of a route.
A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?
This uses App-ID to precisely allow only web and SSL traffic, blocking everything else by default.
Why this answer
Option A is correct because using application-based rules is more secure and efficient than service-based. Option B is less secure as it relies on ports. Option C allows all default applications, too broad.
Option D allows all traffic.
Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?
The allow rule will be evaluated first and permit the traffic before reaching the deny rule.
Why this answer
Option B is correct because a deny rule with an exception can be implemented by placing a specific allow rule before a general deny rule. Option A is wrong because modifying the deny rule to allow would permit all. Option C is wrong because a single rule with allow and deny is not possible.
Option D is wrong because creating a separate zone is unnecessary.
A security administrator configures log forwarding to send threat logs to a central SIEM. The administrator creates a log forwarding profile that includes 'threat' and 'traffic' log types, and applies the profile to several security rules. After verifying, the SIEM receives logs for allowed traffic, but does not receive any logs for denied traffic. The administrator confirms that the deny rules also have the same log forwarding profile applied. What is the most likely cause of the missing denied traffic logs? The log forwarding profile is not configured to forward logs for denied sessions. The SIEM is not configured to receive syslog messages for deny actions. The firewall is logging only at session end and the deny sessions are not completing. The log forwarding profile only includes 'traffic' logs and not 'threat' logs.
Log forwarding profiles can filter by action (e.g., allow, deny). If deny is not included, denied traffic logs won't be forwarded.
Why this answer
Option A is correct because log forwarding profiles can be set to forward different log types, and if the profile does not include 'deny' or 'drop' actions, those logs won't be forwarded. Option B is incorrect because the SIEM receives allowed logs, so syslog is working. Option C is incorrect because denied sessions are still logged at session end.
Option D is incorrect because threat logs are not the same as denied traffic logs; denied traffic logs fall under traffic logs with a deny action.
Match each PAN-OS component to its role.
Drag a concept onto its matching description — or click a concept then click the description.
Handles configuration and logging
Processes traffic and enforces policies
Manages routing and session setup
Aggregates logs from multiple firewalls
Why these pairings
These are the architectural planes of PAN-OS.
A workstation at 10.0.0.5 sends traffic to destination 8.8.8.8. Which NAT rule will be applied?
Rule 1 matches the source and destination, and since rule 2's destination does not match, rule 1 is applied.
Why this answer
Option A is correct because the traffic matches source range 10.0.0.0/8 and destination does not match the exception rule (8.8.8.8 is not 192.168.1.0/24), so rule 1 is applied and translates the source IP to the interface IP. Option B is wrong because the destination does not match rule 2. Option C is wrong because multiple matches not possible; first match wins.
Option D is wrong because a rule matches.
A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?
A security profile group provides layered protection and is optimized for performance.
Why this answer
Option B is correct because a security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.
A company is using Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) in their security policies. Malware is still getting through. What is a common misconfiguration that could cause this?
Alert only logs, does not block.
Why this answer
Option D is correct because if the profile is applied but set to alert-only, it will not block. Option A is wrong because profiles are applied per rule. Option B is wrong because updating AV does not prevent all.
Option C is wrong because profile order doesn't matter for blocking.
A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?
A decryption broker offloads SSL/TLS decryption to a dedicated appliance, reducing firewall load while maintaining visibility.
Why this answer
Option C is correct because the decryption broker offloads decryption to a dedicated appliance. Option A is decryption mirroring, not offloading. Option B is just a protocol version.
Option D is port mirroring, not decryption offloading.
Ready to test yourself?
Try a timed practice session using only Pcnsa Securing Traffic questions.