Scenario practice questions

A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?

Trap 1: There is no NAT policy to translate the source IP.

Without NAT, the packet would still be forwarded.

Trap 2: The firewall is not configured to inspect HTTP traffic.

Inspection occurs after the session is established.

Trap 3: The security policy does not have an allow rule for HTTP.

If no allow rule, the SYN would be dropped with a deny reason.

A
There is no NAT policy to translate the source IP.
Why wrong: Without NAT, the packet would still be forwarded.
B
The destination IP is not reachable from the firewall.
If the firewall cannot route to the destination, it will drop the SYN.
C
The firewall is not configured to inspect HTTP traffic.
Why wrong: Inspection occurs after the session is established.
D
The security policy does not have an allow rule for HTTP.
Why wrong: If no allow rule, the SYN would be dropped with a deny reason.

Question 2easymultiple choice

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Trap 1: The App-ID signature database is outdated.

Outdated signatures cause misidentification, not 'incomplete' classification.

Trap 2: The security policy does not have an allow rule for web-browsing.

Lack of allow rule would drop traffic, not classify as incomplete.

Trap 3: The firewall is experiencing asymmetric routing.

Asymmetric routing can cause incomplete but is less common for web traffic.

A
The App-ID signature database is outdated.
Why wrong: Outdated signatures cause misidentification, not 'incomplete' classification.
B
The security policy does not have an allow rule for web-browsing.
Why wrong: Lack of allow rule would drop traffic, not classify as incomplete.
C
The firewall is experiencing asymmetric routing.
Why wrong: Asymmetric routing can cause incomplete but is less common for web traffic.
D
SSL decryption is not enabled for the traffic.
Without SSL decryption, encrypted traffic cannot be fully inspected, leading to 'incomplete' App-ID.

Question 3easymultiple choice

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

Trap 1: The firewall's DNS settings

DNS settings affect name resolution, not traffic forwarding.

Trap 2: The server's SSL certificate

SSL certificate issues would cause browser warnings but not connectivity failure at firewall level.

Trap 3: The interface management profile

Management profile controls access to the firewall itself, not pass-through traffic.

A
The source and destination zones in the security policy
Mismatched zones are a common reason for policy not matching traffic.
B
The firewall's DNS settings
Why wrong: DNS settings affect name resolution, not traffic forwarding.
C
The server's SSL certificate
Why wrong: SSL certificate issues would cause browser warnings but not connectivity failure at firewall level.
D
The interface management profile
Why wrong: Management profile controls access to the firewall itself, not pass-through traffic.

Question 4hardmulti select

An engineer is troubleshooting a scenario where traffic from a specific source IP is not being logged although the security policy log setting is set to 'log at session end'. Which three conditions could prevent logging for that traffic? (Choose three.)

Trap 1: The source IP is in a global log filtering exclusion.

Palo Alto firewalls do not have a global IP-based log exclusion feature.

Trap 2: The traffic matches a rule with 'log at session start' only.

Log at session start would still generate a log at start, not missing completely.

A
The traffic is denied by a rule that has logging disabled.
If the denying rule has no logging configured, no log is generated.
B
The source IP is in a global log filtering exclusion.
Why wrong: Palo Alto firewalls do not have a global IP-based log exclusion feature.
C
The session is terminated before session end (e.g., reset).
If the session ends prematurely, the session-end log may not be written.
D
The traffic matches a rule with 'log at session start' only.
Why wrong: Log at session start would still generate a log at start, not missing completely.
E
The firewall is exceeding its log rate capacity.
When log rate is exceeded, logs may be dropped.

Question 5hardmultiple choice

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

Trap 1: The application is not recognized by the firewall and is treated as…

Unknown applications are handled based on the rule's unknown application setting, not mismatch.

Trap 2: The security rule is not configured to allow any application

The rule allows the application, but the traffic is identified as something else.

Trap 3: The firewall's SSL decryption is misconfigured

SSL decryption can affect visibility but does not cause application mismatch.

A
The firewall's App-ID identified the traffic as a different application than the one specified in the rule
The firewall uses App-ID to identify traffic; if the application detected does not match the rule's allowed application, the session is denied.
B
The application is not recognized by the firewall and is treated as unknown
Why wrong: Unknown applications are handled based on the rule's unknown application setting, not mismatch.
C
The security rule is not configured to allow any application
Why wrong: The rule allows the application, but the traffic is identified as something else.
D
The firewall's SSL decryption is misconfigured
Why wrong: SSL decryption can affect visibility but does not cause application mismatch.

Review the full subnetting walkthrough →

Question 6hardmultiple choice

Refer to the exhibit. An administrator has configured this decryption policy but users in the 10.1.1.0/24 subnet receive certificate warnings when accessing HTTPS sites. What is the most likely cause?

Exhibit

set shared decryption rule MyRule from trust to untrust source 10.1.1.0/24 destination any application ssl decryption forward-proxy

Trap 1: The rule should be at the top of the rulebase

Rule order may affect matching but would not cause certificate warnings.

Trap 2: The destination address should be specific

Destination 'any' is valid and does not affect certificate warnings.

Trap 3: The application should be web-browsing

SSL is the correct application for HTTPS; web-browsing is for HTTP.

A
The rule should be at the top of the rulebase
Why wrong: Rule order may affect matching but would not cause certificate warnings.
B
The destination address should be specific
Why wrong: Destination 'any' is valid and does not affect certificate warnings.
C
The application should be web-browsing
Why wrong: SSL is the correct application for HTTPS; web-browsing is for HTTP.
D
The decryption certificate is not trusted by clients
Clients must trust the firewall's CA certificate for seamless decryption; otherwise, certificate warnings appear.

Question 7mediummultiple choice

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

Exhibit

admin@PA-5000> show session id 12345
Session ID: 12345
Source IP: 10.1.1.100
Destination IP: 203.0.113.50
Application: web-browsing
State: ESTABLISHED
From Zone: trust
To Zone: untrust
Rule: allow-web

Trap 1: The traffic is being blocked because the 'From Zone' is trust

The session is allowed; zone is correct.

Trap 2: The session is being denied by a different rule

The session shows rule allow-web, so it is allowed.

Trap 3: The session is not being logged correctly

Logging is not relevant to page loading.

A
The traffic is being blocked because the 'From Zone' is trust
Why wrong: The session is allowed; zone is correct.
B
The session is being denied by a different rule
Why wrong: The session shows rule allow-web, so it is allowed.
C
The firewall might be incorrectly identifying the application as web-browsing when it is something else
Application misidentification can cause partial loading if the firewall blocks embedded objects.
D
The session is not being logged correctly
Why wrong: Logging is not relevant to page loading.

Question 8easymultiple choice

A firewall is experiencing performance issues. The administrator wants to collect diagnostic data for TAC analysis. Which command generates a comprehensive support file?

Trap 1: debug system dump

This is used for debugging specific issues, not for general support.

Trap 2: show system resources

This shows real-time resource usage but does not generate a file.

Trap 3: show log system

This displays system logs but does not generate a file for TAC.

A
debug system dump
Why wrong: This is used for debugging specific issues, not for general support.
B
show system resources
Why wrong: This shows real-time resource usage but does not generate a file.
C
show log system
Why wrong: This displays system logs but does not generate a file for TAC.
D
generate tech-support file
This creates a support file in the opt directory.

Question 9easymulti select

Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?

Trap 1: Decryption Broker

Decryption Broker is not a standard Palo Alto Networks feature.

Trap 2: SSL Termination

SSL Termination is not a separate decryption scenario; it is part of inbound inspection.

Trap 3: SSH Proxy

SSH Proxy is not a decryption scenario; it handles non-SSL traffic.

A
Decryption Broker
Why wrong: Decryption Broker is not a standard Palo Alto Networks feature.
B
SSL Forward Proxy
Correct: SSL Forward Proxy decrypts outbound traffic from internal clients to external servers.
C
SSL Termination
Why wrong: SSL Termination is not a separate decryption scenario; it is part of inbound inspection.
D
SSH Proxy
Why wrong: SSH Proxy is not a decryption scenario; it handles non-SSL traffic.
E
SSL Inbound Inspection
Correct: SSL Inbound Inspection decrypts inbound traffic to internal servers.

Review the full routing breakdown →

Question 10mediummultiple choice

In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?

Trap 1: Decrease the path monitoring interval

Decreasing the interval would increase sensitivity and cause more failovers, not prevent false ones.

Trap 2: HA1 backup link

HA1 backup provides redundancy for the control link, not monitoring.

Trap 3: Enable pre-emptive mode

Pre-emptive mode allows the original active unit to resume after recovery, not related to causing failover.

A
Decrease the path monitoring interval
Why wrong: Decreasing the interval would increase sensitivity and cause more failovers, not prevent false ones.
B
HA1 backup link
Why wrong: HA1 backup provides redundancy for the control link, not monitoring.
C
Enable pre-emptive mode
Why wrong: Pre-emptive mode allows the original active unit to resume after recovery, not related to causing failover.
D
Use link monitoring instead of path monitoring
Link monitoring only detects physical link failures, so temporary router unreachability would not trigger failover.

Question 11hardmultiple choice

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

Trap 1: The firewall is using a forward trust certificate that is expired.

An expired certificate would cause errors, but likely the certificate is self-signed and not trusted.

Trap 2: The decryption policy is not applied to the correct security rule.

Decryption is applied via decryption policy, not security rules; order might matter but not the cause of certificate error.

Trap 3: The decryption policy is set to 'no-decrypt' for the traffic.

If set to no-decrypt, traffic would pass through without decryption, so no certificate error from the firewall.

A
The firewall is using a forward trust certificate that is expired.
Why wrong: An expired certificate would cause errors, but likely the certificate is self-signed and not trusted.
B
The decryption policy is not applied to the correct security rule.
Why wrong: Decryption is applied via decryption policy, not security rules; order might matter but not the cause of certificate error.
C
The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.
Correct. Clients must trust the firewall's issuing CA to avoid certificate warnings.
D
The decryption policy is set to 'no-decrypt' for the traffic.
Why wrong: If set to no-decrypt, traffic would pass through without decryption, so no certificate error from the firewall.

Question 12hardmultiple choice

In a Panorama-managed deployment, the device group has a rule called 'Allow-Web' that allows 'web-browsing'. The local firewall also has a rule with the same name and content. After Panorama pushes the device group configuration, what happens to the local rule?

Trap 1: The local rule is overwritten by the device group rule.

It is not overwritten; the device group rule supersedes it.

Trap 2: The local rule is deleted.

The local rule remains in the configuration but is not active.

Trap 3: The rules are merged into a single rule.

There is no merge; only the device group rule is active.

A
Both rules are present; the device group rule takes precedence and the local rule is not installed.
Device group rules have higher priority and replace local rules at the same position.
B
The local rule is overwritten by the device group rule.
Why wrong: It is not overwritten; the device group rule supersedes it.
C
The local rule is deleted.
Why wrong: The local rule remains in the configuration but is not active.
D
The rules are merged into a single rule.
Why wrong: There is no merge; only the device group rule is active.

Question 13hardmultiple choice

Two firewalls in an active/passive HA pair are not synchronizing. The administrator checks 'show high-availability state' and sees 'active' on both firewalls. What is the most likely cause?

Trap 1: Session owner is set to 'primary' on both firewalls.

Session owner is for flow control, not HA state.

Trap 2: Preemptive mode is enabled on both firewalls.

Preemptive mode only affects failback behavior, not the initial state.

Trap 3: Both firewalls have different PAN-OS versions.

Version mismatch would prevent configuration sync, but both would still show as standbys or one active.

A
The HA3 control link is misconfigured or down.
Without heartbeat, each firewall assumes the other is down and becomes active.
B
Session owner is set to 'primary' on both firewalls.
Why wrong: Session owner is for flow control, not HA state.
C
Preemptive mode is enabled on both firewalls.
Why wrong: Preemptive mode only affects failback behavior, not the initial state.
D
Both firewalls have different PAN-OS versions.
Why wrong: Version mismatch would prevent configuration sync, but both would still show as standbys or one active.

Question 14easymultiple choice

The traffic log shows a threat severity 'medium' and the threat log shows action 'allow' for the same session. What is the most likely reason that the threat was allowed?

Exhibit

Refer to the exhibit.

Traffic Log:
Time: 2024-07-15 10:00:00
Source: 10.1.1.10
Destination: 198.51.100.20
Application: web-browsing
Action: allow
Threat: High
Severity: medium

Threat Log:
Time: 2024-07-15 10:00:00
Source: 10.1.1.10
Destination: 198.51.100.20
Threat ID: 12345
Action: allow

Trap 1: The action 'allow' in the threat log is misleading; the traffic was…

The log explicitly says action: allow.

Trap 2: The threat was not detected by the firewall.

It was detected as shown in the threat log.

Trap 3: The threat log does not record blocked threats.

Threat logs record both allowed and blocked threats.

A
The security policy rule that matched this traffic is configured to allow the threat.
The profile for that rule likely has an 'allow' action for this threat.
B
The action 'allow' in the threat log is misleading; the traffic was actually blocked.
Why wrong: The log explicitly says action: allow.
C
The threat was not detected by the firewall.
Why wrong: It was detected as shown in the threat log.
D
The threat log does not record blocked threats.
Why wrong: Threat logs record both allowed and blocked threats.

Question 15hardmultiple choice

Two Palo Alto Networks firewalls are configured in an active/passive HA pair. During a scheduled maintenance, the network team reboots both firewalls simultaneously. After reboot, both firewalls appear as 'active' in the HA state. What is the most likely cause and the correct troubleshooting step?

Trap 1: Both firewalls have the same priority; the tie is broken by serial…

Priority and serial number determine active, but simultaneous reboot should still result in one active based on tie-breaker; split-brain typically indicates heartbeat failure.

Trap 2: The HA configuration is set to active/active mode instead of…

In active/active, both are always active, but the question says active/passive.

Trap 3: The heartbeat interfaces are not configured on each firewall.

If heartbeat interfaces are configured but down, it would cause split-brain; but the correct fix is to first check them.

A
Both firewalls have the same priority; the tie is broken by serial number, but due to simultaneous reboot, both came up as active. The solution is to reboot one firewall.
Why wrong: Priority and serial number determine active, but simultaneous reboot should still result in one active based on tie-breaker; split-brain typically indicates heartbeat failure.
B
The HA configuration is set to active/active mode instead of active/passive.
Why wrong: In active/active, both are always active, but the question says active/passive.
C
The heartbeat link between the firewalls is missing or fails, causing each to believe the other is down. The correct step is to restore the heartbeat link and then set the appropriate firewall as passive.
Split-brain is usually due to lost heartbeat; restoring it and setting one as passive resolves.
D
The heartbeat interfaces are not configured on each firewall.
Why wrong: If heartbeat interfaces are configured but down, it would cause split-brain; but the correct fix is to first check them.