PCNSE PCNSE Palo Alto Networks Firewall Configuration 5 — Questions and Answers
Question 1: An administrator wants to prevent a compromised internal host from communicating with known command-and-control (C2) servers. Which combination of features provides the most comprehensive protection?
- URL Filtering with the 'malware' category blocked
- Anti-spyware profile with DNS sinkholing and C2 signature blocking enabled (Correct answer)
- Application override policy blocking suspicious ports
- Custom application signatures for known C2 ports
Correct answer: Anti-spyware profile with DNS sinkholing and C2 signature blocking enabled
Anti-spyware profiles with DNS sinkholing redirect C2 DNS queries to a controlled IP, while C2 signatures detect and block the actual C2 communication traffic.
Question 2: When configuring a Palo Alto firewall for a dual-ISP setup using Policy-Based Forwarding (PBF), what happens to the PBF rule when the monitored next-hop becomes unreachable?
- The PBF rule remains active and traffic is dropped
- The PBF rule is disabled and traffic falls back to the virtual router routing table (Correct answer)
- The firewall automatically fails over to the secondary ISP using ECMP
- The PBF rule triggers a HA failover to the passive unit
Correct answer: The PBF rule is disabled and traffic falls back to the virtual router routing table
When PBF path monitoring detects a next-hop failure, the PBF rule is temporarily disabled, allowing traffic to use the standard virtual router routing table as a fallback.
Question 3: What is the primary purpose of the 'no-decrypt' action in a Decryption policy rule in PAN-OS?
- It enables SSL inspection for the matched traffic
- It explicitly excludes matched traffic from SSL decryption, allowing it to pass through encrypted (Correct answer)
- It blocks all encrypted traffic that cannot be decrypted
- It applies certificate pinning to matched connections
Correct answer: It explicitly excludes matched traffic from SSL decryption, allowing it to pass through encrypted
The 'no-decrypt' action creates an explicit exclusion, ensuring that matched traffic (e.g., banking sites, healthcare systems) bypasses SSL decryption.
Question 4: A Palo Alto NGFW is configured with multiple virtual systems (vsys). Which statement correctly describes traffic flow between vsys on the same physical firewall?
- Traffic flows freely between vsys without any policy enforcement
- Inter-vsys traffic requires explicit security policy rules and traverses the firewall's dataplane as if it were between two separate devices (Correct answer)
- Virtual systems share the same security policy and session table
- Inter-vsys routing is only possible with a dedicated physical link between them
Correct answer: Inter-vsys traffic requires explicit security policy rules and traverses the firewall's dataplane as if it were between two separate devices
Inter-vsys traffic is treated as external traffic between separate logical firewalls, requiring explicit security policies in both vsys and traversing the dataplane for full inspection.
Question 5: An engineer needs to ensure that QoS is applied consistently across multiple security rules for video conferencing applications. What is the most efficient PAN-OS configuration approach?
- Configure QoS settings individually on each matching security rule
- Create a QoS Profile and reference it in the QoS policy matching the video conferencing application (Correct answer)
- Apply QoS through an Application Override policy
- Configure DSCP marking directly in the security policy profiles
Correct answer: Create a QoS Profile and reference it in the QoS policy matching the video conferencing application
QoS Profiles define bandwidth guarantees and priorities, and are applied via QoS policies that match traffic by zone, interface, application, and user for consistent treatment.
Question 6: Which PAN-OS feature allows security administrators to create dynamic security group memberships based on VM attributes such as tags, names, or operating systems in a VMware NSX environment?
- External Dynamic List (EDL) with VM inventory
- Dynamic Address Groups (DAG) using registered IP tags from VM monitoring (Correct answer)
- Static address groups with VM IP addresses
- Auto-tagging through the XML API only
Correct answer: Dynamic Address Groups (DAG) using registered IP tags from VM monitoring
Dynamic Address Groups use registered IP tags from VM Monitoring or the XML API to automatically include or exclude IP addresses based on current VM attributes without manual updates.
Question 7: After a software upgrade on a Palo Alto firewall results in unexpected behavior, an administrator wants to immediately restore the previous software version and configuration. Which recovery approach is the fastest?
- Reimage the device from a USB drive with the previous software
- Use the 'request system software revert' command to revert to the previously installed version (Correct answer)
- Restore a full backup from Panorama to the device
- Manually reinstall the previous PAN-OS version via the web interface
Correct answer: Use the 'request system software revert' command to revert to the previously installed version
'request system software revert' restores the previously running PAN-OS version along with its associated configuration, providing the fastest path back to a known-good state.
PCNSE PCNSE Palo Alto Networks Firewall Configuration 5
An administrator wants to prevent a compromised internal host from communicating with known command-and-control (C2) servers.
Which combination of features provides the most comprehensive protection?