CCNA Troubleshoot Questions

MCQhard

A firewall is experiencing high CPU utilization. The engineer suspects a denial-of-service attack. Which command should be used to identify the source of the attack?

A.show counter global | match drop

B.show session all | match <source IP>

C.request high-availability state

D.debug flow basic

AnswerB

This command lists all sessions and can be filtered to see if a single source has many sessions.

Why this answer

The 'show session all' command can show many sessions from a single source, indicating an attack. Filtering by source IP helps identify the attacker.

Practice this question →

MCQmedium

A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?

A.Check the traffic logs for any denial events

B.Check the IPSec tunnel status and IKE/IPSEC SA rekey timers

C.Reboot the firewall to clear any stale sessions

D.Verify the routing table on both firewalls

AnswerB

Intermittent connectivity every few minutes often indicates a mismatch in SA lifetime or rekey failure.

Why this answer

The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.

Exam trap

The trap here is that candidates often jump to routing or security rule checks, but the periodic nature of the outage is a classic symptom of IPsec SA rekey failure, not a routing or policy issue.

How to eliminate wrong answers

Option A is wrong because traffic logs showing denial events would indicate persistent blocking (e.g., by security rules), not the periodic connectivity pattern described; intermittent rekey failures do not generate consistent denial log entries. Option C is wrong because rebooting the firewall is a disruptive, non-diagnostic step that clears all sessions and logs, potentially destroying evidence of the rekey failure and delaying resolution. Option D is wrong because verifying the routing table checks for static or dynamic route stability, but routing is typically stable in a site-to-site VPN; the periodic nature of the issue points to a VPN rekey problem, not a routing change.

Practice this question →

MCQmedium

After upgrading a Palo Alto Networks firewall, the administrator notices that some URL filtering categories are not being blocked as configured. The URL filtering profile is applied to the security rule. What should the administrator verify first?

A.The SSL decryption policy is configured correctly

B.The security rule is still referencing the correct URL filtering profile

C.The URL filtering license is still valid

D.The URL filtering database is up-to-date

AnswerD

An upgrade may require a fresh download of the URL database to ensure proper categorization.

Why this answer

After a firewall upgrade, the URL filtering database may become outdated or corrupted, causing the firewall to fail to block categories as configured. Option D is correct because the administrator should first verify that the URL filtering database is up-to-date, as the upgrade process can reset or invalidate the local database, and a fresh download is required to restore accurate categorization and blocking.

Exam trap

The trap here is that candidates assume a configuration or license issue is the root cause, but Palo Alto Networks exams specifically test the knowledge that after an upgrade, the URL filtering database must be re-downloaded to ensure accurate categorization, as the upgrade process can invalidate the local database.

How to eliminate wrong answers

Option A is wrong because SSL decryption policy affects the ability to inspect encrypted traffic for URL categorization, but it does not cause configured URL filtering categories to stop being blocked; if decryption is misconfigured, the firewall would simply not see the full URL, but the existing categories would still be blocked for non-encrypted or decrypted traffic. Option B is wrong because the security rule referencing the correct URL filtering profile is a basic configuration check, but after an upgrade, the profile reference typically remains intact; the issue is more likely a stale database rather than a lost profile association. Option C is wrong because the URL filtering license is a subscription that enables the feature, but it does not expire or become invalid during a software upgrade; the license status is checked at the time of use and would generate a clear license error if invalid, not a silent failure to block categories.

Practice this question →

MCQhard

A firewall has a security policy that includes a rule with a 'Schedule' object. During the scheduled time, traffic should be allowed, but it is being blocked. The schedule is configured correctly. What could be the issue?

A.The schedule object uses the wrong time zone

B.The schedule object is not referenced in the rule

C.The user's traffic is using a different application

D.The rule is placed incorrectly in the security policy

AnswerA

If the firewall's time zone is different from the schedule's intended time zone, the schedule may not activate as expected.

Why this answer

If the firewall's system time is incorrect, the schedule may not be active during the intended period. This is a common oversight.

Practice this question →

MCQmedium

A company is using GlobalProtect for remote access. Users report that they can connect but cannot access internal resources. The firewall logs show successful GlobalProtect tunnel establishment. What is the most likely issue?

A.A security policy rule with a geolocation-based deny is blocking the traffic

B.Split tunneling is disabled, causing all traffic to go through the firewall and saturate bandwidth

C.The GlobalProtect gateway is not configured with the correct client settings

D.The DNS proxy setting is misconfigured

AnswerA

Geolocation-based rules can block traffic if the user's public IP is in a denied country.

Why this answer

After tunnel establishment, traffic is subject to security policies. A misconfigured rule (e.g., geolocation-based deny) could block the traffic. Also, split tunneling settings could be misconfigured.

The most common cause is a security policy blocking the traffic after tunnel is up.

Practice this question →

Multi-Selectmedium

Which TWO CLI commands can be used to check whether a specific security policy rule is being matched by traffic? (Choose two.)

Select 2 answers

A.show session limit

B.show security-policy rule-usage

C.show session all filter rule <rulename>

D.show security-policy rule <rulename>

E.show running security-policy

AnswersB, C

This command displays the number of times each rule has been matched.

Why this answer

Options B and C are correct. 'show session all filter rule <rulename>' shows sessions that matched a particular rule. 'show counter global filter severity drop' can show drops that may be due to a rule, but more directly, 'show security-policy rule-usage' shows rule hit counts. However, 'show security-policy rule-usage' is the correct command for rule hits. Option A shows all rules but not which are hit.

Option D shows session limits. Option E shows the running configuration, not hit statistics.

Practice this question →

Multi-Selecteasy

Which TWO methods can be used to export logs from Panorama to an external system? (Choose two.)

Select 2 answers

A.Configure a NetFlow exporter on Panorama.

B.Use the Panorama API to retrieve logs.

C.Export logs as CSV directly from the Panorama web interface.

D.Configure a Log Forwarding profile to send logs to a syslog server.

E.Use SNMP traps to send log data.

AnswersB, D

The API can be used to programmatically export logs in various formats.

Why this answer

Options A and D are correct. Panorama can export logs via syslog by configuring a log forwarding profile to send to a syslog server, and via the Panorama API. Option B is wrong because SNMP traps are for alerts, not bulk log export.

Option C is wrong because Panorama does not have a built-in CSV export via the web interface for bulk logs; that is done via API or syslog. Option E is wrong because NetFlow is not supported for log export.

Practice this question →

MCQmedium

Refer to the exhibit. A user at 10.1.1.10 is trying to connect to a web server at 203.0.113.5 on port 443. The session shows 'State: DROP' with reason 'policy-deny'. However, the administrator has a security policy rule that allows SSL traffic from the source zone to the destination zone. What is the most likely cause of the drop?

A.The source NAT rule is missing, so the private IP cannot reach the internet.

B.The security policy rule that allows SSL is in a different rulebase or zone than the traffic.

C.The SSL application is not correctly identified because the traffic is encrypted.

D.The firewall is configured to block SSL sessions that use weak ciphers.

AnswerB

The traffic may be matched by an earlier deny rule or the zone context might be wrong.

Why this answer

Option C is correct because the exhibit shows no NAT translation, meaning the source IP is private. If the destination zone is the internet and no source NAT is applied, the return traffic would not route back, but the drop reason is policy-deny, indicating a security policy issue. The most likely cause is that the rule allowing SSL is configured for a different destination zone than the one the traffic is using.

Option A is wrong because session state DROP indicates the traffic did not pass. Option B is wrong because no NAT rule would cause a different issue. Option D is wrong because the session is dropped, not hijacked.

Practice this question →

MCQmedium

Refer to the exhibit. A user at 10.1.1.100 is browsing the internet. The session is established. However, the user reports that the page is not loading completely. What could be the issue?

A.The traffic is being blocked because the 'From Zone' is trust

B.The session is being denied by a different rule

C.The firewall might be incorrectly identifying the application as web-browsing when it is something else

D.The session is not being logged correctly

AnswerC

Application misidentification can cause partial loading if the firewall blocks embedded objects.

Why this answer

When a firewall incorrectly identifies an application, it may apply the wrong App-ID-based policy, potentially blocking or failing to allow all required subcomponents of the traffic (e.g., embedded objects, scripts, or secondary connections). In this scenario, the session is established but the page does not load completely, which is a classic symptom of the firewall misclassifying the application as 'web-browsing' (HTTP/HTTPS) when it is actually a more complex application (e.g., a web application using non-standard ports or dynamic content). The firewall then enforces the policy for 'web-browsing', which may not permit the necessary additional flows or decryption, causing partial loading.

Exam trap

Palo Alto Networks often tests the nuance that a session being 'established' does not guarantee full application functionality; candidates mistakenly assume that if the session is up, all traffic is passing, but App-ID misclassification can cause partial content delivery.

How to eliminate wrong answers

Option A is wrong because the 'From Zone' being trust does not inherently block traffic; zone-based policies are evaluated based on the rulebase, and a session being established indicates that a rule allowed the initial handshake. Option B is wrong because if the session is established, it has already matched a rule that permits the session; a different rule denying the session would prevent establishment entirely, not cause partial loading. Option D is wrong because logging is a reporting function and does not affect whether traffic is allowed or blocked; incorrect logging would not cause incomplete page loading.

Practice this question →

MCQmedium

A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?

A.The source and destination zones are misconfigured

B.The rule is disabled

C.The user's IP is in a block list

D.The firewall is in transparent mode

AnswerA

If the rule's source or destination zone does not match the traffic zones, it won't match.

Why this answer

If no rule matches, it's often because the zones are incorrectly configured. The source or destination zone may not match the rule's zone definitions.

Practice this question →

Multi-Selecthard

Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)

Select 3 answers

A.The server sends a TCP RST packet to the client.

B.The firewall's application override is incorrectly matching the traffic.

C.The session reaches the configured idle timeout.

D.A decryption error occurs during SSL handshake.

E.The firewall runs out of session resources and starts dropping new sessions.

AnswersA, B, D

The firewall records the RST as the session end reason.

Why this answer

Options A, B, and D are correct. Application override can cause the firewall to incorrectly handle the session, leading to resets. Decryption errors can cause the firewall to send resets if the SSL handshake fails.

A server that sends a RST will be recorded. Option C is wrong because a session timeout results in a 'aged-out' reason, not RST. Option E is wrong because resource exhaustion typically causes drops or age-outs, not RST.

Practice this question →

MCQeasy

After upgrading Panorama to a newer version, a configuration push to a managed firewall fails with the error 'Commit failed: template validation error.' Which of the following should be checked first?

A.Ensure that the administrator account has superuser privileges.

B.Verify that the firewall's PAN-OS version is supported by the Panorama version.

C.Check that the firewall is connected to the internet for cloud services.

D.Review the system logs on the firewall for disk space errors.

AnswerB

Incompatible versions between Panorama and firewalls can cause template validation failures during push.

Why this answer

Option A is correct because template validation errors often indicate that the version of the template or device group configuration is incompatible with the firewall's PAN-OS version. Options B, C, and D are less likely to be the root cause of a template validation error.

Practice this question →

MCQeasy

A user reports intermittent connectivity to a database server through the firewall. The session table shows active sessions, but the user experiences timeouts. What is the most likely cause?

A.DNS resolution failure

B.Asymmetric routing

C.Security policy configured with service 'any'

D.Incomplete TCP three-way handshake

AnswerB

Asymmetric routing causes the firewall to see packets that don't match existing sessions, leading to drops or session re-creation.

Why this answer

Asymmetric routing can cause sessions to be created on one firewall while traffic returns via a different path, leading to session lookup failures and drops. This is a common cause of intermittent connectivity with active sessions.

Practice this question →

MCQmedium

A company has two Palo Alto Networks firewalls in an active/passive high availability pair. The firewalls are configured with a virtual IP (VIP) for the internal network. Recently, the passive firewall was upgraded to a new PAN-OS version. After the upgrade, the active firewall is still running the old version. The administrator wants to perform a failover to make the upgraded firewall active. However, when the administrator attempts to manually failover, the new passive firewall does not become active. The HA synchronization status shows 'synchronized' but the preemption is disabled. The administrator checks the HA configuration and finds that the peer's version is not compatible. What should the administrator do to successfully failover to the upgraded firewall?

A.Disable HA, then reconfigure HA on both firewalls

B.Upgrade the active firewall to the same PAN-OS version as the passive firewall

C.Force the failover via the CLI using 'request high-availability state suspend' on the active firewall

D.Downgrade the passive firewall back to the old version

AnswerB

Both firewalls must run the same version for proper HA operation; upgrading the active is the correct action.

Why this answer

Option B is correct because PAN-OS requires both firewalls in an active/passive HA pair to run the same major version to form a compatible HA connection. Even if synchronization status shows 'synchronized', the version mismatch prevents failover from succeeding. Upgrading the active firewall to match the passive firewall's version restores version compatibility and allows the failover to proceed.

Exam trap

The trap here is that candidates assume 'synchronized' status means HA is fully functional and failover will work, but they overlook that version compatibility is a prerequisite for stateful failover, not just configuration sync.

How to eliminate wrong answers

Option A is wrong because disabling and reconfiguring HA does not address the root cause—the version mismatch—and would cause unnecessary downtime and configuration loss. Option C is wrong because the 'request high-availability state suspend' command on the active firewall would force it to suspend, but the passive firewall still cannot become active due to the incompatible PAN-OS version, so failover would fail. Option D is wrong because downgrading the passive firewall back to the old version would revert the upgrade, defeating the purpose of making the upgraded firewall active, and is not a best practice for maintaining security and feature updates.

Practice this question →

MCQhard

A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?

A.Use the CLI command 'show running resource-monitor' to view CPU usage per module.

B.Review the security policy rule hit counts to see if a specific rule is hit frequently.

C.Check the number of active sessions using 'show session info'.

D.Inspect the packet buffer usage with 'show counter packet-buffer'.

AnswerA

Resource monitor breaks down CPU usage by dataplane and control plane, helping identify the culprit.

Why this answer

Option B is correct because 'show running resource-monitor' provides CPU, memory, and session utilization data that can pinpoint which component is using CPU. Option A is wrong because session count alone does not indicate high CPU. Option C is wrong because packet buffer usage is usually memory-related.

Option D is wrong because security policy rule hit count does not directly show CPU impact.

Practice this question →

MCQeasy

A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?

A.The firewall is not configured for TLS decryption.

B.The user-ID agent is not installed.

C.The firewall does not have network access to the domain controller.

D.The domain controller security policy is blocking RPC traffic.

AnswerD

RPC is used for User-ID polling; if blocked, mapping fails.

Why this answer

The correct answer is D because domain controller security policy blocking RPC traffic prevents User-ID from querying user information.

Practice this question →

Multi-Selectmedium

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Select 2 answers

A.Use the packet capture tool to capture the traffic

B.Check the rule order to see if a rule earlier in the policy is also matching

C.Enable logging at session end for all rules

D.Review the security rule that matched the session to ensure it is configured correctly

E.Check the server's network connectivity

AnswersB, D

Multiple rules may match; an earlier rule might deny the traffic.

Why this answer

When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Exam trap

The trap here is that candidates often assume the issue is with the server or network connectivity (Option E) or jump to packet capture (Option A) instead of focusing on the security policy itself, which is the direct cause indicated by the log's 'dropped by security rule' message.

Practice this question →

MCQmedium

A network engineer is troubleshooting a slow file transfer through a PA-5200. The file transfer is between two sites connected via IPsec VPN. The firewall has a symmetric crypto profile with AES-256 and SHA-256. The throughput is lower than expected. The engineer checks the dataplane CPU and sees it is 30%. The firewall's interface counters show no errors. What should be the first step to improve throughput?

A.Disable anti-replay protection.

B.Enable hardware acceleration for VPN.

C.Change the encryption algorithm to AES-128.

D.Increase the MTU on the tunnel interface.

AnswerB

Hardware acceleration uses dedicated chips to handle crypto, freeing CPU and increasing throughput.

Why this answer

Option B is correct because enabling hardware acceleration offloads VPN processing from the CPU, which improves throughput even if CPU is not at 100%.

Practice this question →

MCQmedium

A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?

A.The firewall's system log rate is exceeded and logs are dropped.

B.The rule has logging disabled for the 'deny' action.

C.The rule is not being matched because a previous rule allows the traffic.

D.The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.

AnswerD

Denied sessions are not established; they end immediately. Logging at session end does not trigger for sessions that never start. To log denied traffic, enable logging at session start.

Why this answer

Option B is correct because by default, interzone rules log at session end only for allowed traffic; denied traffic may not generate logs if logging is not explicitly enabled. Option A is wrong because disabling logging per rule is a common oversight. Option C is wrong because system logs are not related to security policy logs.

Option D is wrong because the rule can still deny without logging.

Practice this question →

MCQeasy

A new application is not being identified by the firewall. Traffic for the application is being treated as 'unknown-tcp'. Which action should be taken to resolve this?

A.Modify the security policy rule to allow 'unknown-tcp'.

B.Update the application and threat signatures.

C.Disable application identification on the zone.

D.Create an application override for the application.

AnswerD

An application override allows the firewall to identify traffic based on port and IP criteria, useful for custom applications.

Why this answer

Option B is correct because if the application is not identified, it may be a custom application that needs to be defined via an application override. Option A is wrong because the application signature would need to be updated if it's a known application, but the question implies it's a new application. Option C is wrong because disabling application identification would not help.

Option D is wrong because a security policy rule change would not cause the firewall to identify the application.

Practice this question →

MCQhard

Refer to the exhibit. The traffic log shows a drop event from source IP 203.0.113.10 to destination 10.1.1.200 on port 443. The rule matched is 'deny-rule'. What is the most likely reason for this drop?

A.The traffic matched a security rule that explicitly denies it

B.A threat prevention profile detected and blocked the session

C.The traffic was blocked because the application is not allowed

D.The destination URL is categorized as prohibited

AnswerA

The log clearly indicates rule 'deny-rule' matched, causing the drop.

Why this answer

The traffic log explicitly states that the rule matched is 'deny-rule'. In Palo Alto Networks firewalls, when a security rule is configured with an action of 'Deny', any traffic matching that rule is dropped and logged with a 'deny' action. Since the log shows a drop event and the matched rule is 'deny-rule', the most direct and likely reason is that the traffic was explicitly denied by this security rule, not by any additional security profiles or external factors.

Exam trap

The trap here is that candidates may confuse a security rule's 'deny' action with a block caused by a security profile (like Threat Prevention or URL Filtering), but the log explicitly shows the rule matched is 'deny-rule', indicating the drop is from the rule itself, not from any profile-based inspection.

How to eliminate wrong answers

Option B is wrong because a threat prevention profile blocking a session would be logged with a different action (e.g., 'reset-both' or 'drop') and would reference a specific threat ID or vulnerability signature, not simply show a rule match of 'deny-rule'. Option C is wrong because if the application were not allowed, the firewall would typically log an 'application not allowed' or 'deny' action with a different rule match, but the log explicitly shows the rule 'deny-rule' as the matched rule, indicating the deny is due to the rule itself, not an application-based policy. Option D is wrong because URL filtering blocks would be logged with a URL filtering profile action (e.g., 'block' or 'override') and would reference a URL category, not simply show a rule match of 'deny-rule'; the log does not indicate any URL filtering profile involvement.

Practice this question →

MCQhard

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

A.The service 'application-default' does not match port 443; a custom service must be used.

B.The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.

C.The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

D.SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

AnswerB

Although not shown here, if an application-group containing 'ssl' is in a deny rule higher in the order, it would deny the traffic.

Why this answer

Option B is correct because the exhibited configuration includes an application-group 'Web-Apps' that includes both ssl and web-browsing. If this application-group is referenced in a policy rule that is evaluated before the 'Allow-SSL' rule and has a deny action, traffic matching any member of the group would be denied. However, the exhibit does not show such a rule; the analysis is that the 'Block-HTTP' rule might be matching if the application is misidentified, but since it's ssl, that rule should not match.

The error is that the application-group 'Web-Apps' is defined but not used, so it's not causing the issue. Actually, the most likely reason is that there is a rule with application-group that denies the traffic. Since the exhibit shows no such rule, perhaps the correct answer is that the 'service' is incorrectly set to 'application-default' and SSL uses port 443, but that should be fine.

Re-assess: The exhibit shows only two rules; the 'Allow-SSL' rule should allow the traffic. But the user reports denial. Possibly another rule is present in the actual configuration.

But based on the exhibit, the most plausible is that the 'Block-HTTP' rule matches because the application identification is failing. Given the difficulty, I'll go with a different correct answer: The firewall is not correctly identifying the application due to missing decryption. Option D is plausible.

Let me rework.

Practice this question →

Multi-Selecthard

Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)

Select 3 answers

A.Matching IKE version and encryption algorithms

B.Same firewall model

C.Same certificate authority

D.Matching proxy IDs (local/remote subnets)

E.Matching pre-shared keys or certificates

AnswersA, D, E

These are phase 1 parameters that must match.

Why this answer

IPSec requires matching IKE phase 1 parameters, pre-shared key, and proxy IDs (phase 2 selectors).

Practice this question →

MCQmedium

A company uses GlobalProtect for remote access. After upgrading the GP portal and gateway from 5.0 to 5.1, some users cannot connect. They report that they receive 'Unable to connect to gateway' error. The firewall logs show that the user is unable to authenticate. The authentication profile uses LDAP. The administrator can successfully bind to the LDAP server from the firewall CLI. What could be the issue?

A.The LDAP server certificate has expired.

B.The RADIUS server is not reachable.

C.The authentication sequence changed after upgrade.

D.The GP portal certificate is not trusted by the client.

AnswerC

Upgrades can rearrange authentication profiles or require re-selection, leading to authentication failures.

Why this answer

Option C is correct because the upgrade may have altered the authentication sequence, causing the LDAP profile to not be used in the correct order.

Practice this question →

MCQeasy

A network engineer needs to verify that a specific security rule is being hit by traffic. Which firewall log should be examined?

A.Configuration log

B.Traffic log

C.Threat log

D.System log

AnswerB

Traffic logs show session details including the security rule that matched.

Why this answer

Traffic logs record all sessions that match security rules, including the rule ID that matched.

Practice this question →

MCQmedium

A security administrator notices that traffic logs are not being generated for allowed traffic from a specific subnet. The security policy rule for that subnet has 'Log at Session End' enabled. What should the engineer check?

A.The security policy rule's logging setting

B.The interface management profile

C.The log retention settings

D.The system log severity level

AnswerA

The rule may have 'Log at Session End' set to 'None' instead of 'Enabled', which would suppress logs.

Why this answer

If the security rule does not have logging enabled, no traffic logs are generated even if sessions are active. This is a common misconfiguration.

Practice this question →

MCQeasy

A firewall administrator is troubleshooting a scenario where users cannot reach an internal web server. The security policy allows the traffic, and the server is reachable from other networks. What should the administrator check first?

A.The source and destination zones in the security policy

B.The firewall's DNS settings

C.The server's SSL certificate

D.The interface management profile

AnswerA

Mismatched zones are a common reason for policy not matching traffic.

Why this answer

If the interface receiving the traffic has no management profile or is not configured to allow the necessary services (e.g., HTTP/HTTPS), the traffic may be dropped at the interface level. However, for pass-through traffic, the zone and interface assignment are critical. The most common first step is to verify the source and destination zones in the policy.

Practice this question →

MCQeasy

A company with multiple branch offices connects to headquarters using IPSec VPN tunnels terminated on PA-220 firewalls. Users at one branch report intermittent connectivity issues when accessing critical applications hosted at HQ. Ping tests to HQ servers succeed consistently, but TCP-based applications (e.g., file transfers, web access) frequently drop connections after a few seconds, particularly when transferring large data. The VPN tunnel status shows 'active' with no rekeys. Security policies are configured to allow all required application traffic. Interface statistics show no discards or errors. Which action should be taken to resolve the issue?

A.Disable TCP checksum offloading on the clients.

B.Change the IPSec encryption algorithm from AES-256 to AES-128.

C.Increase the TCP timeout value in the security policy.

D.Reduce the MTU on the branch firewall's WAN interface to 1400.

AnswerD

MTU mismatch across VPN can cause packet fragmentation and reassembly issues, leading to drops for large packets. Reducing MTU ensures packets fit within the tunnel.

Why this answer

Option A is correct because the symptoms (TCP connections dropping mid-transfer, ping success) strongly suggest an MTU issue across the VPN tunnel. Reducing the MTU on the branch firewall's WAN interface to 1400 bytes often resolves fragmentation problems without disabling TCP MSS clamping. Option B is wrong because increasing TCP timeouts would delay disconnections but not prevent them; the drops are likely due to packet fragmentation.

Option C is wrong because changing encryption algorithms does not significantly affect packet size and is unlikely to fix fragmentation. Option D is wrong because disabling TCP checksum offloading on clients might help if checksum offload were causing corruption, but the described symptoms point to MTU issues.

Practice this question →

Multi-Selectmedium

Which TWO are common causes of session drops after the initial handshake? (Choose two.)

Select 2 answers

A.TCP sequence number mismatch due to packet reordering

B.Firewall interface speed mismatch

C.Security policy change after session creation

D.DNS resolution failure

E.Asymmetric routing

AnswersA, E

Reordering can cause the firewall to drop packets as out-of-state.

Why this answer

Asymmetric routing and TCP sequence number mismatch are common causes of session drops after the handshake.

Practice this question →

MCQhard

An engineer is troubleshooting a case where users on a specific subnet cannot reach a web server behind a Palo Alto Networks firewall. The security policy allows the traffic, and the firewall sees the session hit the rule. However, the server does not receive the request. What is the most likely cause?

A.Session offload is causing the packet to bypass security checks

B.The firewall is unable to resolve the destination MAC address

C.Asymmetric routing causes the firewall to drop the SYN packet

D.The destination NAT is misconfigured

AnswerC

The firewall might receive the SYN but if the return path is different, it can drop the packet or not forward it properly.

Why this answer

The most likely cause is asymmetric routing, where the SYN packet traverses one firewall path but the SYN-ACK returns via a different path that does not go through the same firewall. Since Palo Alto Networks firewalls are stateful and require both directions of a TCP handshake to pass through the same device to build the session table entry, the SYN-ACK arriving on a different interface or firewall is treated as a non-session packet and dropped, even though the security policy permits the initial SYN. This explains why the firewall sees the session hit the rule but the server never receives the request.

Exam trap

The trap here is that candidates often assume a security policy hit means the packet is fully allowed, but they forget that stateful inspection requires symmetric traffic flow for the TCP handshake to complete, and the firewall will drop the SYN-ACK if it arrives on a different interface or firewall.

How to eliminate wrong answers

Option A is wrong because session offload (hardware acceleration) does not bypass security checks; it offloads established session processing to hardware while still enforcing policy, and the issue occurs before the session is established. Option B is wrong because if the firewall could not resolve the destination MAC address, it would generate an ARP failure and the session would not be created at all, yet the firewall sees the session hit the rule. Option D is wrong because a misconfigured destination NAT would cause the firewall to translate the destination IP incorrectly or not at all, resulting in the server receiving the request at a wrong IP or the firewall dropping the packet due to NAT rule mismatch, but the scenario states the server does not receive the request at all, which aligns with asymmetric routing dropping the SYN-ACK before it reaches the server.

Practice this question →

MCQeasy

A network engineer notices that traffic from a specific subnet is being dropped by the firewall. The traffic log shows 'drop' with reason 'policy deny'. The engineer checks the security policy and confirms there is an allow rule for that subnet. What should be checked next?

A.Check the application override.

B.Check the QoS policy.

C.Check the rule order and ensure the allow rule is above any deny rules.

D.Check the NAT policy for the traffic.

AnswerC

A rule order issue is the most common cause when a policy deny occurs despite an allow rule existing.

Why this answer

The correct answer is A because if the allow rule is not above a deny rule, the deny rule will match first.

Practice this question →

MCQmedium

A company deploys a new application that uses UDP on port 12345. The security policy is configured to allow UDP traffic from the internal network to the application server. However, users report that the application does not work. The firewall logs show that the traffic is allowed. What is the most likely cause?

A.The application is using asymmetric routing

B.The security policy is not logging the traffic correctly

C.The firewall is not inspecting UDP traffic correctly

D.The firewall is dropping the return traffic due to a missing policy

AnswerD

The application may require responses; if the return traffic is not allowed by policy, the application breaks.

Why this answer

Option D is correct because even though the outbound UDP traffic is allowed by the security policy, the firewall must also have a corresponding policy to allow the return traffic from the application server back to the internal clients. Without a return policy, the firewall drops the response packets, breaking the UDP communication. The logs show the outbound traffic as allowed, but the return traffic is silently dropped, which is why users report the application not working.

Exam trap

The trap here is that candidates assume that because the outbound traffic is allowed and logged, the application should work, but they overlook the requirement for a return policy in stateful firewall operation, especially for UDP which is connectionless and does not have a built-in handshake like TCP.

How to eliminate wrong answers

Option A is wrong because asymmetric routing would cause the firewall to see traffic in one direction only, but the logs show the traffic is allowed, and the issue is specifically about missing return policy, not routing asymmetry. Option B is wrong because the logs correctly show the traffic as allowed, so the logging is functioning properly; the problem is that the return traffic is not logged because it is dropped by a missing policy. Option C is wrong because Palo Alto Networks firewalls inspect UDP traffic correctly by default, and the issue is not about inspection but about the absence of a security policy for the return path.

Practice this question →

MCQmedium

A security administrator reports that they can ping and access internal resources, but cannot access any external websites. The firewall is configured with a default route pointing to the internet router, and the NAT policy includes a source NAT rule for the internal subnet. Which step should the administrator take first to troubleshoot this issue?

A.Check the NAT rule for correct interface assignment.

B.Check the DNS proxy configuration on the firewall.

C.Review the security policy to ensure traffic from the internal zone to the external zone is allowed.

D.Verify that the default route is active by checking the routing table.

AnswerC

If internal access works but external website access fails, the most likely cause is a security policy blocking web traffic. Checking the security policy is the logical first step.

Why this answer

Option C is correct because if internal access works but external website access fails, the most likely cause is a security policy blocking web traffic. The default route and NAT appear configured, so checking the security policy is the logical first step. Option A is wrong because DNS proxy would affect name resolution, but the issue could persist even with DNS if the web traffic is blocked by policy.

Option B is wrong because internal access working indicates routing is likely correct. Option D is wrong because the NAT rule is already configured and internal access works, so NAT is likely functioning.

Practice this question →

Multi-Selecthard

Which THREE components should be verified when troubleshooting a site-to-site IPSec VPN that is not coming up?

Select 3 answers

A.Zone protection profile on the untrust zone

B.Interface management profile on the external interface

C.Pre-shared key configuration on both ends

D.Peer IP address in the tunnel interface configuration

E.IKE version (v1 vs v2) compatibility

AnswersC, D, E

Mismatched PSK will prevent IKE authentication.

Why this answer

The pre-shared key (PSK) must match exactly on both VPN peers. If the PSK differs, IKE Phase 1 authentication fails, preventing the tunnel from establishing. This is a fundamental requirement for both IKEv1 and IKEv2, as the PSK is used to generate authentication keys during the main or aggressive mode exchange.

Exam trap

The trap here is that candidates often confuse zone protection profiles or interface management profiles with VPN-related security settings, but these profiles only affect data-plane or management-plane traffic, not the control-plane IKE negotiation required for tunnel establishment.

Practice this question →

MCQmedium

Refer to the exhibit. The session is in FIN_WAIT state. What does this indicate about the TCP connection?

A.The connection is actively transferring data

B.The firewall has closed the connection and is waiting for the client or server to finish

C.The connection has timed out and is being removed

D.The firewall is waiting for a SYN-ACK from the destination

AnswerB

FIN_WAIT means the firewall initiated the close and is waiting for final packets.

Why this answer

FIN_WAIT state indicates that the firewall has sent a FIN and is waiting for the other side to acknowledge or send its own FIN. This is part of normal TCP teardown.

Practice this question →

MCQhard

A Panorama-managed firewall is not sending logs to Panorama. The firewall is operational and policies are being pushed successfully. Which of the following is the most likely cause?

A.The security policy rules do not have a Log Forwarding profile applied.

B.The Panorama collector group is not configured correctly.

C.The firewall's management interface is not reachable from Panorama.

D.The log buffer on the firewall is full.

AnswerA

Without a Log Forwarding profile, logs are not sent to Panorama; they remain local.

Why this answer

Option C is correct because for log forwarding to Panorama, a Log Forwarding profile must be applied to the security rules; otherwise logs are stored locally. Option A is wrong because collector groups are for Panorama aggregation, not for initial log forwarding. Option B is wrong because log buffering would cause delays, not complete failure.

Option D is wrong because management interface connectivity is required for push, but log forwarding may use a different interface or port.

Practice this question →

MCQhard

A large enterprise uses a PA-5250 as a perimeter firewall with multiple virtual systems (vsys). One vsys is for the DMZ, and it is logging high amounts of dropped traffic. The administrator notices that the firewall's dataplane CPU is consistently above 80%. The logs show many 'application-id timeout' drops. The DMZ hosts are running custom applications on non-standard ports. What is the first step to mitigate the issue?

A.Disable application identification for the DMZ zone.

B.Reduce the number of security rules in the DMZ.

C.Use a custom application signature for the custom applications.

D.Increase the application identification timeout for the custom applications.

AnswerC

Custom app signatures allow the firewall to identify traffic without deep packet inspection, reducing CPU.

Why this answer

Option C is correct because creating custom application signatures reduces the need for heuristic analysis of unknown traffic, lowering CPU load.

Practice this question →

MCQmedium

During a troubleshooting session, a user reports that they cannot access an internal web server through the firewall's public IP. The firewall is configured with destination NAT. The engineer checks the NAT policy and sees the rule is active. What should be the next step to verify the NAT is functioning correctly?

A.Check the session table to see if the NAT translation is occurring.

B.Check the application dependency.

C.Check the security policy for the post-NAT zone.

D.Check the routing table for the destination.

AnswerA

The session table shows the original and translated IPs, confirming NAT is working.

Why this answer

The correct answer is C because checking the session table shows whether the destination IP is being translated as expected.

Practice this question →

MCQeasy

A healthcare organization recently replaced their primary internet circuit and changed the next-hop IP for the default route from 203.0.113.1 to 198.51.100.1. After the change, all internet traffic is failing. The firewall is a PA-220 running PAN-OS 9.1. The administrator verifies that the new default route is present in the virtual router and that the security policies are unchanged. The IP address configuration on the ethernet interface is correct and the link is up. When pinging 8.8.8.8 from the firewall's management interface, it succeeds. But traffic from internal hosts fails. The traffic log shows 'drop' with reason 'route - no route to host'. What is the most likely cause?

A.The default route is not in the same virtual router as the internal zones.

B.The new internet circuit does not allow ICMP.

C.The internal hosts have incorrect DNS settings.

D.The ARP table for the gateway is stale.

AnswerA

If internal zones are in a different VR, traffic from them cannot use the default route, resulting in no route to host.

Why this answer

Option B is correct because internal zones may be in a different virtual router (VR) that still has the old default route or lacks the new one, causing the 'no route to host' error.

Practice this question →

MCQhard

An engineer is troubleshooting an issue where GlobalProtect users are unable to connect to the portal. The portal is configured with a certificate signed by an internal CA. Users can reach the portal's IP address from the internet, but the connection fails. The firewall log shows 'TLS handshake failed'. What is the most likely cause?

A.The portal service is not running

B.The portal's IP address is not routable from the internet

C.The portal certificate's subject name does not match the portal URL

D.The client does not trust the certificate authority that signed the portal certificate

AnswerD

The TLS handshake fails because the client cannot verify the server certificate.

Why this answer

The firewall log shows 'TLS handshake failed', which indicates that the SSL/TLS negotiation between the GlobalProtect client and the portal failed. Since users can reach the portal's IP address from the internet, the issue is not network connectivity but certificate validation. The most common cause is that the client does not trust the internal CA that signed the portal certificate, so the client rejects the certificate during the TLS handshake, causing the failure.

Exam trap

The trap here is that candidates often confuse a certificate name mismatch (subject name vs. URL) with a trust issue, but the 'TLS handshake failed' log entry specifically points to a failure in the certificate chain validation, not a name mismatch, which would produce a different error or warning.

How to eliminate wrong answers

Option A is wrong because if the portal service were not running, the connection would fail at a lower level (e.g., TCP connection refused or timeout), not specifically with a 'TLS handshake failed' log entry. Option B is wrong because the scenario explicitly states that users can reach the portal's IP address from the internet, so the IP is routable and connectivity exists. Option C is wrong because a subject name mismatch would typically cause a browser warning or a 'certificate name mismatch' error, not a generic 'TLS handshake failed' log entry; the TLS handshake can still complete if the client trusts the CA, even if the name doesn't match, though the client may then disconnect.

Practice this question →

MCQmedium

A remote user is unable to connect to the GlobalProtect gateway. The user's client shows 'Connecting' but never establishes a tunnel. The firewall shows no drops in the GlobalProtect logs. Which of the following should be checked first?

A.Verify that the GlobalProtect portal is reachable from the internet.

B.Check if the user's authentication credentials are correct.

C.Confirm that the user's client is on the same subnet as the gateway.

D.Ensure the gateway's certificate is trusted by the client machine.

AnswerD

If the client does not trust the gateway certificate, the SSL handshake fails and the connection never establishes.

Why this answer

Option D is correct because the Gateway certificate is crucial for SSL/TLS handshake; if the client does not trust it, the connection fails silently. Option A is wrong because the portal is not involved in the gateway tunnel establishment. Option B is wrong because the client can still connect if it is not on the internal network (remote access).

Option C is wrong because gateway configuration should be checked after authentication issues.

Practice this question →

MCQeasy

A network administrator wants to verify if a specific internal IP address (10.1.1.100) is being translated to a public IP when accessing the internet. Which CLI command should be used?

A.show running nat-policy

B.show session all filter source 10.1.1.100

C.show nat rule

D.show address 10.1.1.100

AnswerB

This command displays all active sessions from the specified source, including NAT source and destination translations.

Why this answer

Option C is correct because 'show session all filter source 10.1.1.100' will display all sessions originating from that IP, including NAT translations. Option A shows NAT rules but not active translations. Option B shows the running configuration of NAT rules.

Option D shows addresses but not active translations.

Practice this question →

MCQhard

An administrator is troubleshooting a situation where traffic from a specific application is being dropped by the firewall. The security policy allows the application. The firewall logs show the session is denied, and the reason is 'application mismatch'. What does this indicate?

A.The firewall's App-ID identified the traffic as a different application than the one specified in the rule

B.The application is not recognized by the firewall and is treated as unknown

C.The security rule is not configured to allow any application

D.The firewall's SSL decryption is misconfigured

AnswerA

The firewall uses App-ID to identify traffic; if the application detected does not match the rule's allowed application, the session is denied.

Why this answer

The 'application mismatch' log reason indicates that the firewall's App-ID engine identified the traffic as a different application than the one specified in the security rule. Even though the rule allows the application you intended, the actual traffic does not match that App-ID signature, so the session is denied. This is a common scenario when the application classification does not align with the rule's application object.

Exam trap

The trap here is that candidates often assume 'application mismatch' means the application is unknown or unsupported, but it specifically means the traffic was identified as a different application than what the rule expects, highlighting the importance of verifying App-ID results versus rule configuration.

How to eliminate wrong answers

Option B is wrong because 'application mismatch' is a specific denial reason that occurs when the traffic is recognized but as a different application, not when it is unknown (unknown traffic would show 'unknown-tcp' or 'incomplete' App-ID). Option C is wrong because the scenario explicitly states the security policy allows the application, so the rule is configured to allow an application; the issue is a mismatch, not a missing 'any' application. Option D is wrong because SSL decryption misconfiguration would cause decryption errors or 'ssl-decrypt' related drops, not an 'application mismatch' denial; App-ID can still match encrypted traffic based on metadata or SNI.

Practice this question →

MCQeasy

A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?

A.Disable URL filtering on the existing security rule

B.Check the user-ID mapping to ensure the user is authenticated

C.Create a new security rule allowing the user's IP to any

D.Add the URL to an allow list in the URL filtering profile

AnswerD

This allows the specific URL while keeping the profile active.

Why this answer

Option D is correct because the traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.

Exam trap

The trap here is that candidates may assume disabling URL filtering entirely (Option A) is the quickest fix, but the PCNSE exam tests the understanding that URL filtering profiles should be modified granularly using allow/block lists rather than disabling the feature completely.

How to eliminate wrong answers

Option A is wrong because disabling URL filtering on the existing security rule would remove all URL-based controls for that rule, potentially exposing the network to malicious or inappropriate websites, which is an overreaction to a single blocked URL. Option B is wrong because the user-ID mapping is irrelevant to a URL filtering block; URL filtering decisions are based on the URL category or list, not user authentication status, and the traffic log already shows the session is denied due to URL filtering, not authentication. Option C is wrong because creating a new security rule allowing the user's IP to any would bypass all security policies, including URL filtering, but it is an insecure and overly permissive solution that ignores the specific URL filtering block and could allow unrestricted access to any destination.

Practice this question →

MCQhard

An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?

A.The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.

B.The firewall's decryption policy is set to 'no-decrypt' for the application.

C.The firewall's internet link experiences periodic packet loss.

D.The SaaS application's certificate is expired or revoked.

AnswerA

SSL/TLS version mismatch can cause intermittent failures; the firewall may attempt a higher version than the server supports.

Why this answer

Option A is correct because the firewall may negotiate a TLS version or cipher that is not supported by the SaaS server, causing the connection to fail intermittently. Option B is wrong because packet loss on the internet link would affect all traffic and be visible in session metrics. Option C is wrong because it would affect all users.

Option D is wrong because decryption is enabled and the firewall is actively proxying.

Practice this question →

MCQmedium

A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?

A.The security policy rule does not have logging enabled at session end.

B.SSL decryption is enabled but the website certificate is untrusted.

C.A DoS protection profile is configured on the zone and is rate-limiting the user's IP.

D.A URL Filtering profile is applied to the rule and is blocking the website's URL category.

AnswerD

URL Filtering profiles can override application-level allowances by blocking specific URL categories, causing the session to be dropped.

Why this answer

Option C is correct because if the URL Filtering profile is set to block the requested URL, the session will be dropped even if the application is allowed. Option A is wrong because SSL decryption would not cause a drop for web-browsing unless the certificate is untrusted. Option B is wrong because a lack of logging does not affect session forwarding.

Option D is wrong because a DoS protection profile typically drops excessive sessions, not individual user access.

Practice this question →

MCQmedium

After upgrading a PA-5250, the firewall is not passing traffic. The administrator checks the dataplane CPU utilization and sees it is at 100%. Which command should be run to identify the cause?

A.show session all

B.show system resources dataplane

C.show counter global

D.show running resource-monitor

AnswerB

This command displays dataplane CPU and memory, helping identify the bottleneck.

Why this answer

The correct answer is B because 'show system resources dataplane' provides detailed dataplane CPU and memory usage.

Practice this question →

Multi-Selecteasy

Which TWO are valid methods to troubleshoot a firewall not passing traffic? (Choose two.)

Select 2 answers

A.Reboot the firewall

B.Change the interface IP address

C.Verify the security policy order

D.Check the session table for the traffic

E.Update the threat prevention signature

AnswersC, D

Misplaced rules can cause traffic to be denied or not matched.

Why this answer

Checking session table and verifying security policy rules are both direct troubleshooting steps.

Practice this question →

Multi-Selecteasy

Which TWO commands can be used to check the status of an IPSec tunnel on a Palo Alto Networks firewall?

Select 2 answers

A.show system info

B.show vpn ike-sa

C.show routing route

D.show vpn ipsec-sa

E.show interface all

AnswersB, D

This shows the IKE security associations.

Why this answer

Option B is correct because 'show vpn ike-sa' displays the status of IKE Phase 1 security associations, which are essential for establishing the control channel of an IPSec tunnel. Option D is correct because 'show vpn ipsec-sa' shows the status of IKE Phase 2 security associations, which represent the actual data-plane IPSec tunnel. Both commands are used together to verify the full lifecycle of an IPSec VPN tunnel on Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often confuse general network commands (like routing or interface status) with VPN-specific commands, assuming that a working route or interface implies a functional IPSec tunnel, when in fact the tunnel may be down due to IKE or IPSec SA failures.

Practice this question →

MCQhard

In an active/passive HA pair, the passive firewall shows state 'non-functioning'. Both firewalls are running PAN-OS 10.1.5. What is the most likely cause?

A.Heartbeat interface down

B.Firmware version mismatch (one firewall is on 10.1.4)

C.Management IP mismatch

D.License mismatch

AnswerB

HA requires exact PAN-OS version match. Even a minor patch difference can cause synchronization failure.

Why this answer

HA requires identical PAN-OS versions. A minor version mismatch, even a patch level difference, can cause the passive firewall to fail to synchronize.

Practice this question →

MCQhard

A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?

A.The gateway's interface is not in the same subnet as the IP pool

B.The GlobalProtect client is outdated

C.The LDAP authentication profile is misconfigured

D.The client certificate is not trusted by the gateway

AnswerA

GlobalProtect gateway requires the IP pool to be on the same subnet as the gateway's interface for proper routing.

Why this answer

The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.

Exam trap

The trap here is that candidates assume IP pool assignment is independent of the gateway's interface subnet, but the gateway must have a directly connected route to the pool range for the tunnel to establish.

How to eliminate wrong answers

Option B is wrong because an outdated client would typically cause connection or feature issues, not a failure to assign an IP address after successful authentication. Option C is wrong because the LDAP authentication profile is confirmed working—the user authenticates successfully—so the issue lies after authentication. Option D is wrong because client certificate trust is not relevant here; the gateway is using LDAP authentication, not certificate-based authentication, and the client successfully connects to the portal.

Practice this question →

MCQeasy

Refer to the exhibit. A firewall system log contains a critical license expiration entry for URL Filtering. What will happen to URL Filtering functionality?

A.The firewall will stop passing traffic until the license is renewed.

B.URL Filtering will stop working immediately until a new license is installed.

C.URL Filtering will continue to use the last downloaded URL database but will not receive updates.

D.The firewall will automatically fall back to a basic URL category list.

AnswerC

Licensed features continue to function with the last downloaded data when the license expires.

Why this answer

Option C is correct: When a license expires, the related functionality typically continues to work with the last downloaded signature database but does not update; Palo Alto Networks firewalls do not automatically disable the feature but it may stop updating. Option A is wrong because the feature does not stop working immediately; it continues with existing data. Option B is wrong because the firewall does not automatically switch to a secondary method.

Option D is wrong because a warning is displayed but the administrator is not locked out.

Practice this question →

Multi-Selectmedium

A security administrator is trying to isolate a performance issue on a PA-3220. Which two commands provide real-time information about the dataplane performance? (Choose two.)

Select 2 answers

A.show system resources dataplane

B.show counter global

C.show running resource-monitor

D.show session info

E.show job all

AnswersA, C

This command displays dataplane-specific resource statistics in real time.

Why this answer

The correct answers are A and B because both 'show running resource-monitor' and 'show system resources dataplane' provide real-time dataplane CPU and memory usage.

Practice this question →

MCQhard

An administrator is troubleshooting VPN tunnel flapping. The logs show multiple Phase 2 rekeys. The tunnel uses IKEv2 with pre-shared key. What is the most likely cause?

A.Mismatched IKE version.

B.Dead Peer Detection (DPD) interval too long.

C.The rekey time settings are too short.

D.Incorrect local or peer ID.

AnswerC

Short rekey intervals cause the tunnel to renegotiate frequently, leading to flapping.

Why this answer

The correct answer is D because frequent rekeys due to short rekey time settings can cause the tunnel to flap.

Practice this question →

Multi-Selecthard

An engineer is troubleshooting a scenario where traffic from a specific source IP is not being logged although the security policy log setting is set to 'log at session end'. Which three conditions could prevent logging for that traffic? (Choose three.)

Select 3 answers

A.The traffic is denied by a rule that has logging disabled.

B.The source IP is in a global log filtering exclusion.

C.The session is terminated before session end (e.g., reset).

D.The traffic matches a rule with 'log at session start' only.

E.The firewall is exceeding its log rate capacity.

AnswersA, C, E

If the denying rule has no logging configured, no log is generated.

Why this answer

The correct answers are B, C, and D because a deny rule with logging disabled, log rate exceeded, or session reset can all prevent session-end logging.

Practice this question →

MCQeasy

A network administrator notices that traffic from a specific user to the internet is being blocked by the firewall. The user's IP is 10.1.1.100, and the destination is a public website. The security policy has a rule that allows traffic from subnet 10.1.1.0/24 to any. What is the first thing the administrator should verify?

A.Check the security policy rulebase order and matching

B.Verify the user-ID agent is mapping the IP correctly

C.Check the service configuration for the destination port

D.Check the NAT configuration for the user's subnet

AnswerA

The traffic might be matching a deny rule placed before the allow rule.

Why this answer

The first thing to verify is the security policy rulebase order and matching because Palo Alto Networks firewalls evaluate rules in a top-down order and apply the first matching rule. Even if a rule exists that allows traffic from subnet 10.1.1.0/24 to any, a preceding rule with a deny action or a more specific match could be blocking the traffic from 10.1.1.100. Checking rule order ensures that the intended allow rule is actually being hit before investigating other potential issues.

Exam trap

The trap here is that candidates often jump to NAT or service configuration issues, but the PCNSE exam emphasizes that rule order and first-match logic are the most common root cause of unexpected blocks, especially when a seemingly correct allow rule exists.

How to eliminate wrong answers

Option B is wrong because verifying the User-ID agent mapping is only relevant if the security policy uses user-based criteria (e.g., source user), but the rule in question is based on source IP (subnet 10.1.1.0/24), not user identity. Option C is wrong because checking the service configuration for the destination port is secondary; if the rule is not matched due to order, service configuration is irrelevant until the correct rule is identified. Option D is wrong because NAT configuration affects the translated IP address, not the pre-NAT source IP used for policy matching; the firewall applies security policy before NAT, so NAT issues would not cause the traffic to be blocked by a policy that matches the original source IP.

Practice this question →

Multi-Selecthard

Based on the exhibit, which THREE conclusions can be drawn?

Select 3 answers

A.The session was matched by the security rule 'allow-ssl'.

B.The source NAT is not translating the source IP.

C.The traffic is using UDP protocol.

D.The session is in an active state.

E.The session is destined for a public IP address.

AnswersA, D, E

Both Policy ID and Rule show 'allow-ssl'.

Why this answer

Options A, C, and E are correct. The destination IP 203.0.113.50 is a public IP address (A). The session matched rule 'allow-ssl' (C).

The session state is ACTIVE (E). Option B is incorrect because the NAT source IP differs from the original source IP (10.10.1.100 -> 192.0.2.100), indicating source NAT is applied. Option D is incorrect because the protocol is TCP, not UDP.

Practice this question →