How should I use these Core Concepts and Architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Core Concepts and Architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Core Concepts and Architecture domain.

PCNSE · topic practice

Core Concepts and Architecture practice questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE Core Concepts and Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Core Concepts and Architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Core Concepts and Architecture

Core Concepts and Architecture questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Core Concepts and Architecture exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Core Concepts and Architecture questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full routing breakdown →

A security engineer needs to deploy a Palo Alto Networks firewall in a high-availability (HA) pair with active/passive mode. The firewall will inspect traffic for multiple tenants, each requiring separate routing and policy configuration. Which feature should be used to isolate tenant configurations while using a single pair of firewalls?

Trap 1: Deploy multiple VM-Series firewalls as separate instances on the…

This is an alternative but requires multiple licenses and management overhead; VSYS is more efficient on a single PA-5200 series.

Trap 2: Use active/active HA mode to assign each tenant to a different…

HA provides redundancy, not multi-tenancy isolation; both firewalls share the same configuration.

Trap 3: Configure multiple virtual routers (VRFs) within the same virtual…

VRFs only separate routing tables; policies and objects would still be shared across VRFs within the same VSYS.

Study all Core Concepts and Architecture common traps →

A
Create separate virtual systems (VSYS) for each tenant on the same firewall.
VSYS provides complete logical separation of configuration, routing, and policies per tenant.
B
Deploy multiple VM-Series firewalls as separate instances on the same hypervisor.
Why wrong: This is an alternative but requires multiple licenses and management overhead; VSYS is more efficient on a single PA-5200 series.
C
Use active/active HA mode to assign each tenant to a different firewall.
Why wrong: HA provides redundancy, not multi-tenancy isolation; both firewalls share the same configuration.
D
Configure multiple virtual routers (VRFs) within the same virtual system.
Why wrong: VRFs only separate routing tables; policies and objects would still be shared across VRFs within the same VSYS.

Full breakdown with real-world context →

Question 2hardmultiple choice

Review the full subnetting walkthrough →

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

Trap 1: The route lookup for the destination requires a larger MTU.

Route lookup does not alter packet size; the forwarding interface MTU is checked.

Trap 2: The firewall is not performing TCP MSS clamping on the traffic.

MSS clamping reduces segment size; the issue is after firewall processing, the packet becomes too large.

Trap 3: The firewall is using jumbo frames on the internal interface.

Jumbo frames allow larger packets, not cause drops due to MTU.

Study all Core Concepts and Architecture common traps →

A
The route lookup for the destination requires a larger MTU.
Why wrong: Route lookup does not alter packet size; the forwarding interface MTU is checked.
B
The firewall is not performing TCP MSS clamping on the traffic.
Why wrong: MSS clamping reduces segment size; the issue is after firewall processing, the packet becomes too large.
C
The firewall is using jumbo frames on the internal interface.
Why wrong: Jumbo frames allow larger packets, not cause drops due to MTU.
D
The packet is being encapsulated (e.g., IPsec) after routing, increasing its size beyond 1500 bytes.
Encapsulation adds headers; if the original packet is near MTU, the encapsulated packet exceeds it.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Core Concepts and Architecture explanation →

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

Trap 1: Security profiles

Profiles define threat inspection settings, not rule organization.

Trap 2: Security zones

Zones define a trust level for interfaces, not rule grouping.

Trap 3: Application groups

Application groups simplify application identification, not rule management.

Study all Core Concepts and Architecture common traps →

A
Security profiles
Why wrong: Profiles define threat inspection settings, not rule organization.
B
Security zones
Why wrong: Zones define a trust level for interfaces, not rule grouping.
C
Security policy rule groups
Rule groups allow logical grouping of rules and assignment to user/device groups.
D
Application groups
Why wrong: Application groups simplify application identification, not rule management.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Core Concepts and Architecture explanation →

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

Trap 1: Reduced new session setup rate.

Session setup rate is CPU-bound, not buffer-bound.

Trap 2: Reduced committed information rate (CIR) on QoS policies.

QoS CIR is configured; buffer usage does not automatically reduce CIR.

Trap 3: Increased latency for management access.

Management access uses the control plane, which has low CPU.

Study all Core Concepts and Architecture common traps →

A
Reduced new session setup rate.
Why wrong: Session setup rate is CPU-bound, not buffer-bound.
B
Reduced committed information rate (CIR) on QoS policies.
Why wrong: QoS CIR is configured; buffer usage does not automatically reduce CIR.
C
Increased latency for management access.
Why wrong: Management access uses the control plane, which has low CPU.
D
Increased packet drops due to buffer exhaustion.
When packet buffers are full, new packets are dropped.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full routing breakdown →

A Palo Alto Networks firewall is configured with two virtual routers: VR-A (trust) and VR-B (untrust). An interface is placed in VR-A. A static route to 10.0.0.0/8 via next-hop 192.168.1.1 exists in VR-A. The firewall receives a packet from the trust zone destined to 10.1.1.1. The route lookup succeeds in VR-A. Which statement is true about the forwarding decision?

Trap 1: The firewall will automatically redistribute the route to VR-B if…

Redistribution must be configured explicitly; it is not automatic.

Trap 2: The packet will be dropped because the destination is not in the…

The destination is in VR-A, which matches the ingress interface's VR.

Trap 3: The firewall will use the zone of the egress interface to determine…

Policy lookup uses ingress and egress zones; the egress zone is based on the route, but the statement is true in general, however the question asks about the forwarding decision specifically.

Study all Core Concepts and Architecture common traps →

A
The firewall will automatically redistribute the route to VR-B if needed.
Why wrong: Redistribution must be configured explicitly; it is not automatic.
B
The firewall will perform a reverse path forwarding (RPF) check on the source IP.
RPF ensures the source IP is reachable via the incoming interface; if not, the packet may be dropped.
C
The packet will be dropped because the destination is not in the same VR as the ingress interface.
Why wrong: The destination is in VR-A, which matches the ingress interface's VR.
D
The firewall will use the zone of the egress interface to determine the security policy.
Why wrong: Policy lookup uses ingress and egress zones; the egress zone is based on the route, but the statement is true in general, however the question asks about the forwarding decision specifically.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Core Concepts and Architecture explanation →

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Trap 1: Create a security policy rule with an application override to match…

Application override skips App-ID and treats the traffic as the specified application; it does not help the firewall learn the custom app.

Trap 2: Enable SSL decryption on the traffic to inspect encrypted payloads.

Decryption is for SSL/TLS; the protocol is proprietary and may not be encrypted.

Trap 3: Add the port to the default application's 'port' field in the…

Default applications are predefined; custom apps require a new definition.

Study all Core Concepts and Architecture common traps →

A
Create a security policy rule with an application override to match the port.
Why wrong: Application override skips App-ID and treats the traffic as the specified application; it does not help the firewall learn the custom app.
B
Define a custom application with the appropriate protocol, port, and optionally a signature.
Custom application objects allow the firewall to identify the traffic based on port and/or signature.
C
Enable SSL decryption on the traffic to inspect encrypted payloads.
Why wrong: Decryption is for SSL/TLS; the protocol is proprietary and may not be encrypted.
D
Add the port to the default application's 'port' field in the application object.
Why wrong: Default applications are predefined; custom apps require a new definition.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Core Concepts and Architecture explanation →

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

Trap 1: Panorama with Dedicated Log Collectors

Dedicated log collectors are separate appliances that receive logs.

Trap 2: Panorama with Log Collectors

In this mode, firewalls send logs to Panorama's log collectors.

Trap 3: Panorama in High Availability mode

HA mode provides failover for Panorama, not log storage mode.

Study all Core Concepts and Architecture common traps →

A
Panorama with Dedicated Log Collectors
Why wrong: Dedicated log collectors are separate appliances that receive logs.
B
Panorama with Log Collectors
Why wrong: In this mode, firewalls send logs to Panorama's log collectors.
C
Panorama without Log Collectors
Firewalls store logs locally; Panorama only manages configurations.
D
Panorama in High Availability mode
Why wrong: HA mode provides failover for Panorama, not log storage mode.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full NAT/PAT explanation →

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Exhibit

Refer to the exhibit.

```
admin@PA-5050> show routing route

IPv4 Virtual Router: default

destination nexthop interface metric flags
0.0.0.0/0 10.0.0.1 ethernet1/1 10 A S
10.0.0.0/8 10.0.0.1 ethernet1/1 10 A S
10.0.0.0/24 10.0.0.2 ethernet1/2 10 A S
10.0.1.0/24 10.0.0.3 ethernet1/3 10 A S
172.16.0.0/12 10.0.0.4 ethernet1/4 10 A S
192.168.0.0/16 10.0.0.5 ethernet1/5 10 A S
```

Trap 1: 10.0.1.0/24 via 10.0.0.3 ethernet1/3

Destination 10.0.0.100 is not in 10.0.1.0/24.

Trap 2: 10.0.0.0/8 via 10.0.0.1 ethernet1/1

The /8 route is less specific than the /24 route.

Trap 3: 0.0.0.0/0 via 10.0.0.1 ethernet1/1

Default route is least specific.

Study all Core Concepts and Architecture common traps →

A
10.0.0.0/24 via 10.0.0.2 ethernet1/2
Longest prefix match: /24 is more specific than /8.
B
10.0.1.0/24 via 10.0.0.3 ethernet1/3
Why wrong: Destination 10.0.0.100 is not in 10.0.1.0/24.
C
10.0.0.0/8 via 10.0.0.1 ethernet1/1
Why wrong: The /8 route is less specific than the /24 route.
D
0.0.0.0/0 via 10.0.0.1 ethernet1/1
Why wrong: Default route is least specific.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Core Concepts and Architecture explanation →

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

Exhibit

Refer to the exhibit.

```
admin@PA-3020> show session info

session id 12345, application: ssl, vsys vsys1, zone trust->untrust
source 10.1.1.10:443 -> destination 192.168.1.1:44321
state: active, type: dynamic
session age: 120 sec, timeout: 3600 sec

admin@PA-3020> show system info | match uptime
Uptime: 30 days, 4 hours, 12 minutes
```

Trap 1: Disable SSL inspection on the security policy for this traffic.

Disabling inspection may cause the firewall to not identify the application at all.

Trap 2: Create an application override policy for this traffic to mark it…

Application override forces the application but does not help the firewall learn the actual protocol; it bypasses App-ID.

Trap 3: Enable SSL decryption on the traffic to inspect the payload.

Decryption only works if the traffic is actually SSL; the custom app is misidentified as SSL.

Study all Core Concepts and Architecture common traps →

A
Disable SSL inspection on the security policy for this traffic.
Why wrong: Disabling inspection may cause the firewall to not identify the application at all.
B
Create an application override policy for this traffic to mark it as the custom application.
Why wrong: Application override forces the application but does not help the firewall learn the actual protocol; it bypasses App-ID.
C
Enable SSL decryption on the traffic to inspect the payload.
Why wrong: Decryption only works if the traffic is actually SSL; the custom app is misidentified as SSL.
D
Define a custom application object with the correct protocol signature and protocol type.
A custom application object allows the firewall to accurately identify the traffic based on its actual protocol characteristics.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Core Concepts and Architecture explanation →

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Trap 1: Management Plane

The management plane is separate from the dataplane.

Trap 2: Threat Prevention Engine

The threat prevention engine is a functional module but not a core dataplane component like buffers or session table.

Trap 3: Log Database

Logs are stored on the management plane or log collectors, not directly in the dataplane.

Study all Core Concepts and Architecture common traps →

A
Management Plane
Why wrong: The management plane is separate from the dataplane.
B
Session Table
The session table is maintained by the dataplane for stateful inspection.
C
Threat Prevention Engine
Why wrong: The threat prevention engine is a functional module but not a core dataplane component like buffers or session table.
D
Log Database
Why wrong: Logs are stored on the management plane or log collectors, not directly in the dataplane.
E
Packet Buffer
Packet buffers are used by the dataplane to store packets during processing.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Core Concepts and Architecture explanation →

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

Trap 1: Destination IP address of the packet

Destination IP is not used for App-ID.

Trap 2: Source IP address of the packet

Source IP is not a factor for application identification.

Study all Core Concepts and Architecture common traps →

A
Application signatures and decrypted content
Signatures and content inspection are key to accurate identification.
B
Protocol (TCP/UDP)
Protocol type is considered in the identification process.
C
Source and destination port numbers
Port numbers are part of the initial identification heuristics.
D
Destination IP address of the packet
Why wrong: Destination IP is not used for App-ID.
E
Source IP address of the packet
Why wrong: Source IP is not a factor for application identification.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Core Concepts and Architecture explanation →

A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?

Trap 1: Upgrade Panorama to the latest version to add QUIC support.

The firewall already supports QUIC; Panorama version is not the issue.

Trap 2: Enable SSL decryption on the policy to inspect QUIC traffic.

QUIC is not SSL; decryption is for SSL/TLS only.

Trap 3: Disable App-ID for the QUIC traffic and use a port-based rule.

Disabling App-ID removes security visibility and control.

Study all Core Concepts and Architecture common traps →

A
Add a security policy rule to allow the 'quic' application.
Allowing the quic application directly ensures proper identification and handling.
B
Upgrade Panorama to the latest version to add QUIC support.
Why wrong: The firewall already supports QUIC; Panorama version is not the issue.
C
Enable SSL decryption on the policy to inspect QUIC traffic.
Why wrong: QUIC is not SSL; decryption is for SSL/TLS only.
D
Disable App-ID for the QUIC traffic and use a port-based rule.
Why wrong: Disabling App-ID removes security visibility and control.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full NAT/PAT explanation →

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Trap 1: User-ID

User-ID maps users to IPs and does not drop traffic.

Trap 2: SSL Decryption

SSL Decryption does not drop traffic; it decrypts or bypasses.

Trap 3: URL Filtering

URL Filtering blocks based on URL category but does not terminate existing sessions.

Study all Core Concepts and Architecture common traps →

A
DoS Protection
DoS Protection can actively terminate sessions exceeding thresholds.
B
User-ID
Why wrong: User-ID maps users to IPs and does not drop traffic.
C
SSL Decryption
Why wrong: SSL Decryption does not drop traffic; it decrypts or bypasses.
D
URL Filtering
Why wrong: URL Filtering blocks based on URL category but does not terminate existing sessions.
E
Zone Protection Profile
Zone Protection can drop traffic based on flood protection or packet-based attacks.

Full breakdown with real-world context →

Question 14hardmulti select

Read the full Core Concepts and Architecture explanation →

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Trap 1: Enable aggregate Ethernet on all interfaces

Aggregate Ethernet is not required for basic HA operation.

Trap 2: Set up a management profile for each interface

Management profile is optional and not required for HA.

Study all Core Concepts and Architecture common traps →

A
Configure a virtual router and assign interfaces
Virtual router is required for Layer 3 routing.
B
Configure the HA1 link and HA1 backup link
HA1 is required for control communication; backup is recommended.
C
Enable aggregate Ethernet on all interfaces
Why wrong: Aggregate Ethernet is not required for basic HA operation.
D
Set up a management profile for each interface
Why wrong: Management profile is optional and not required for HA.
E
Configure a floating IP for the active firewall
Floating IP ensures seamless failover.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Exhibit

Refer to the exhibit.

admin@PA-5050> show system info | match uptime
Uptime: 45 days 3 hours 22 mins

admin@PA-5050> show session all filter source 10.1.1.100 destination 192.168.1.50
Session filter returned 0 sessions

admin@PA-5050> show counter global | match flow_tcp_non_syn
flow_tcp_non_syn: 15

admin@PA-5050> show counter global | match flow_tcp_handshake_fail
flow_tcp_handshake_fail: 8

Trap 1: Incorrect NAT rule configuration

NAT issues would not cause TCP non-SYN counters.

Trap 2: Security policy denying the traffic

Denied traffic would show in deny counters, not TCP handshake failures.

Trap 3: Zone Protection Profile dropping SYN packets

Zone protection would block SYN packets, not cause non-SYN packets.

Study all Core Concepts and Architecture common traps →

A
Incorrect NAT rule configuration
Why wrong: NAT issues would not cause TCP non-SYN counters.
B
Security policy denying the traffic
Why wrong: Denied traffic would show in deny counters, not TCP handshake failures.
C
Asymmetric routing causing out-of-state packets
Non-SYN packets without a session indicate asymmetric routing.
D
Zone Protection Profile dropping SYN packets
Why wrong: Zone protection would block SYN packets, not cause non-SYN packets.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full MPLS explanation →

A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?

Trap 1: Configure a security policy rule to allow DNS traffic from the…

DNS traffic is already allowed if the firewall can send queries and receive responses.

Trap 2: Change the security policy to use the IP address instead of the FQDN

The FQDN is resolved, but the DAG is not updating; using IP is a workaround but not the root cause.

Trap 3: Configure a static route for the FQDN's IP address pointing to the…

Routing is separate from DAG update; the firewall already has connectivity.

Study all Core Concepts and Architecture common traps →

A
Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server
Why wrong: DNS traffic is already allowed if the firewall can send queries and receive responses.
B
Change the security policy to use the IP address instead of the FQDN
Why wrong: The FQDN is resolved, but the DAG is not updating; using IP is a workaround but not the root cause.
C
Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object
This option must be enabled for the firewall to update DAGs based on DNS responses.
D
Configure a static route for the FQDN's IP address pointing to the MPLS interface
Why wrong: Routing is separate from DAG update; the firewall already has connectivity.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full NAT/PAT explanation →

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Trap 1: The security policy has a deny action for the traffic.

A deny policy would show a 'deny' reason, not 'tcp-fin'.

Trap 2: The traffic is being asymmetrically routed.

Asymmetric routing would show 'tcp-rst-from-server' or 'tcp-rst-from-client'.

Trap 3: The zone protection profile is dropping the session.

Zone protection drops would show 'zone-protect' reason.

Study all Core Concepts and Architecture common traps →

A
The security policy has a deny action for the traffic.
Why wrong: A deny policy would show a 'deny' reason, not 'tcp-fin'.
B
The application override is incorrectly configured for the traffic.
Application override can cause the firewall to terminate the session if the traffic does not match the expected application.
C
The traffic is being asymmetrically routed.
Why wrong: Asymmetric routing would show 'tcp-rst-from-server' or 'tcp-rst-from-client'.
D
The zone protection profile is dropping the session.
Why wrong: Zone protection drops would show 'zone-protect' reason.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Core Concepts and Architecture explanation →

An organization is deploying a pair of PA-5250 firewalls in active/passive high availability. The network team notices that the passive firewall is not receiving synchronization updates. Both devices have the same software version and licenses. The HA1 control link is connected and shows 'up' in 'show high-availability state'. What is the most likely reason for the synchronization failure?

Trap 1: The HA1 link is using a crossover cable instead of a…

HA1 link is up, so cabling is fine.

Trap 2: The link speeds on the active and passive firewalls do not match.

Link speed mismatch does not prevent sync; both links can be different speeds.

Trap 3: The passive firewall is not in a 'passive' state.

'show high-availability state' would show the state.

Study all Core Concepts and Architecture common traps →

A
The HA2 link is not configured or is down.
Session synchronization requires HA2 link to be configured and operational.
B
The HA1 link is using a crossover cable instead of a straight-through cable.
Why wrong: HA1 link is up, so cabling is fine.
C
The link speeds on the active and passive firewalls do not match.
Why wrong: Link speed mismatch does not prevent sync; both links can be different speeds.
D
The passive firewall is not in a 'passive' state.
Why wrong: 'show high-availability state' would show the state.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Core Concepts and Architecture explanation →

A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?

Trap 1: There is no NAT policy to translate the source IP.

Without NAT, the packet would still be forwarded.

Trap 2: The firewall is not configured to inspect HTTP traffic.

Inspection occurs after the session is established.

Trap 3: The security policy does not have an allow rule for HTTP.

If no allow rule, the SYN would be dropped with a deny reason.

Study all Core Concepts and Architecture common traps →

A
There is no NAT policy to translate the source IP.
Why wrong: Without NAT, the packet would still be forwarded.
B
The destination IP is not reachable from the firewall.
If the firewall cannot route to the destination, it will drop the SYN.
C
The firewall is not configured to inspect HTTP traffic.
Why wrong: Inspection occurs after the session is established.
D
The security policy does not have an allow rule for HTTP.
Why wrong: If no allow rule, the SYN would be dropped with a deny reason.

Full breakdown with real-world context →

Question 20mediumdrag order

Read the full Core Concepts and Architecture explanation →

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Core Concepts and Architecture sessions

Start a Core Concepts and Architecture only practice session

Every question in these sessions is drawn from the Core Concepts and Architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Core Concepts and Architecture questions →Mixed PCNSE session

Frequently asked questions

What does the PCNSE exam test about Core Concepts and Architecture?: Core Concepts and Architecture questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Core Concepts and Architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Core Concepts and Architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSE topics?: Use the topic links above to move to related areas, or go back to the PCNSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSE exam covers. They are not copied from any real exam or dump site.

Core Concepts and Architecture only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSE questions Core Concepts and Architecture domain overview PCNSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Core Concepts and Architecture practice questions

What to know about Core Concepts and Architecture

Common Core Concepts and Architecture exam traps

Core Concepts and Architecture questions

A firewall administrator notices that traffic from a specific subnet is being unexpectedly dropped. The firewall log shows a 'flow_drop' reason of 'packet too long for interface MTU'. The interface MTU is set to 1500, and the packets are 1500 bytes. What is the most likely cause?

An organization wants to simplify firewall rule management by grouping related rules into logical units and applying them to specific sets of users or devices. Which Palo Alto Networks feature supports this requirement?

During a traffic spike, the firewall CPU utilization remains below 30% but the dataplane packet buffer usage is consistently above 90%. What is the most likely impact on firewall performance?

A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?

Which Panorama deployment mode allows centralized management of firewalls while storing logs locally on each firewall instead of sending them to the Panorama log collector?

A firewall has the routing table shown. A packet arrives on ethernet1/2 with source IP 10.0.0.50 and destination IP 10.0.0.100. Which route will be used for forwarding?

Exhibit

Exhibit

Which TWO are valid dataplane components in a Palo Alto Networks firewall? (Choose two.)

Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

A network administrator is configuring a new Palo Alto Networks firewall in a high-availability active/passive setup. The firewall will be placed in Layer 3 mode. Which THREE steps are required to ensure proper operation? (Choose three.)

Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?

Exhibit

A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?

Arrange the steps to perform a factory reset on a Palo Alto Networks firewall.

Track your progress over time

Start a Core Concepts and Architecture only practice session

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions

Securing Traffic and App-ID practice questions

Securing Users and Applications with Authentication practice questions

Decryption and SSL Inspection practice questions

Managing Troubleshooting and High Availability practice questions

Deploy and Configure Firewalls practice questions