Palo Alto Networks Certified Network Security Engineer (PCNSE) — Questions and Answers

Question 1: What is the function of the HA3 link in an Active/Active HA deployment?

To carry heartbeat messages
To synchronize configuration only
To connect to the Panorama management server
To forward packets between peers when a session is owned by one firewall but traffic arrives at the other (Correct answer)

Correct answer: To forward packets between peers when a session is owned by one firewall but traffic arrives at the other

The HA3 link in Active/Active mode forwards packets between peers when asymmetric routing sends return traffic to the firewall that did not originate the session.

Question 2: A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?

The forward trust CA certificate was not imported correctly
The bank's server blocks all proxy-sourced connections
The decryption policy is missing the correct URL category
The app uses certificate pinning that rejects the firewall's re-signed certificate (Correct answer)

Correct answer: The app uses certificate pinning that rejects the firewall's re-signed certificate

Certificate pinning hard-codes a specific certificate fingerprint into the app; when the firewall re-signs with a different cert, the app rejects the connection.

Question 3: In Panorama, what does a Collector Group define?

A set of Log Collectors that work together to store and manage logs (Correct answer)
A cluster of Panorama management servers
A group of administrators with shared permissions
A group of firewalls sharing the same template

Correct answer: A set of Log Collectors that work together to store and manage logs

A Collector Group is a logical grouping of Log Collectors that share log storage responsibilities and are managed as a unit for log retention and forwarding.

Question 4: Which App-ID feature allows custom application signatures for proprietary internal applications?

Custom App-ID Signatures (Correct answer)
Threat Vault
Application Override
Dynamic Updates

Correct answer: Custom App-ID Signatures

Custom App-ID Signatures allow security teams to create fingerprints for proprietary or in-house applications that are not in the PAN-DB, enabling accurate policy enforcement.

Question 5: What is the primary function of Palo Alto Networks Panorama?

To act as a next-generation firewall
To provide centralized management and visibility across multiple Palo Alto firewalls (Correct answer)
To perform SSL decryption for managed devices
To generate certificates for IPsec tunnels

Correct answer: To provide centralized management and visibility across multiple Palo Alto firewalls

Panorama is the centralized management platform that allows administrators to configure, monitor, and manage logs across all Palo Alto Networks firewalls from a single console.

Question 6: What is the purpose of Application Filters in Palo Alto Networks security policy?

To block applications matching a threat signature
To assign bandwidth to specific applications
To dynamically group applications based on characteristics like category, risk, or technology (Correct answer)
To create static application groups for policy use

Correct answer: To dynamically group applications based on characteristics like category, risk, or technology

Application Filters dynamically match applications based on defined attributes (category, subcategory, technology, risk level), automatically including new applications that match the criteria.

Question 7: Which log type on the Palo Alto firewall would you review to troubleshoot a failed GlobalProtect authentication?

Traffic Logs
GlobalProtect Logs (Correct answer)
Decryption Logs
System Logs

Correct answer: GlobalProtect Logs

GlobalProtect Logs record connection attempts, authentication results, HIP check outcomes, and disconnection events for VPN troubleshooting.

Question 8: Which HA feature allows a Palo Alto firewall to monitor an upstream router and trigger failover if the path fails?

Link Monitoring
OSPF Graceful Restart
BFD
Path Monitoring (Correct answer)

Correct answer: Path Monitoring

Path Monitoring sends ICMP probes to specified IP addresses and triggers HA failover if the monitored path becomes unreachable.

Question 9: Which Palo Alto Networks firewall component is responsible for identifying applications regardless of port or protocol?

Device-ID
App-ID (Correct answer)
Content-ID
User-ID

Correct answer: App-ID

App-ID uses multiple classification mechanisms including application signatures, protocol decoding, and behavioral analysis to identify applications independent of port or protocol.

Question 10: Which Palo Alto Networks NGFW feature uses machine learning to create behavioral models for detecting unknown malware?

DNS Security
Threat Prevention
WildFire (Correct answer)
Advanced URL Filtering

Correct answer: WildFire

WildFire uses machine learning and dynamic analysis in a cloud-based sandbox to detect and generate protections for previously unknown malware.

Question 11: Which Palo Alto Networks feature provides Layer 2 segmentation by forwarding traffic based on MAC addresses without routing?

Tap mode
Virtual Wire mode
Layer 2 deployment mode (Correct answer)
Layer 3 deployment mode

Correct answer: Layer 2 deployment mode

Layer 2 deployment mode enables the firewall to act as a transparent bridge, forwarding traffic based on MAC addresses within the same broadcast domain.

Question 12: Which certificate must be distributed to client machines to prevent SSL warnings when SSL Forward Proxy decryption is enabled?

The firewall's Forward Trust CA certificate (Correct answer)
The Palo Alto root CA certificate
The web server's public certificate
The Forward Untrust certificate

Correct answer: The firewall's Forward Trust CA certificate

The Forward Trust CA certificate must be installed as a trusted root CA on client devices so that firewall-re-signed certificates are trusted without browser warnings.

Question 13: Which Panorama feature enables automatic provisioning of new firewalls without manual configuration?

Policy Optimizer
Dynamic Address Groups
Zero Touch Provisioning (ZTP) (Correct answer)
Tag-Based Forwarding

Correct answer: Zero Touch Provisioning (ZTP)

Zero Touch Provisioning allows new Palo Alto firewalls to be automatically registered, assigned to Device Groups and Template Stacks, and configured via Panorama without manual intervention.

Question 14: What is WildFire in Palo Alto Networks?

An application identification engine
A URL filtering database
A hardware firewall appliance
A cloud-based malware analysis service that detonates unknown files to identify threats (Correct answer)

Correct answer: A cloud-based malware analysis service that detonates unknown files to identify threats

WildFire is Palo Alto's cloud-based sandbox that analyzes unknown files and URLs by executing them in a controlled environment to identify zero-day and unknown malware.

Question 15: Which authentication method can GlobalProtect use to verify user identity alongside username and password?

MFA via RADIUS or SAML (Correct answer)
LLDP authentication
BGP MD5 authentication
OSPF authentication

Correct answer: MFA via RADIUS or SAML

GlobalProtect supports multi-factor authentication (MFA) by integrating with RADIUS or SAML identity providers.

Question 16: In a Palo Alto Networks Active/Passive HA pair, which peer processes and forwards traffic during normal operation?

Only the passive peer
Only the active peer (Correct answer)
Both peers share the load equally
The peer with the lower priority value

Correct answer: Only the active peer

In Active/Passive HA, only the active peer processes and forwards traffic; the passive peer stays synchronized and ready to take over if the active peer fails.

Question 17: What is the role of the GlobalProtect Gateway?

To monitor endpoint health only
To issue client certificates
To terminate VPN tunnels and enforce security policy for remote users (Correct answer)
To distribute VPN configuration to agents

Correct answer: To terminate VPN tunnels and enforce security policy for remote users

The GlobalProtect Gateway terminates the IPsec/SSL VPN tunnel and applies security policy to inbound remote user traffic.

Question 18: In Palo Alto HA, what is the 'split brain' condition?

The HA2 link failing during a commit
Both firewalls simultaneously processing the same session
Both firewalls believing they are Active at the same time (Correct answer)
A firewall entering a suspended HA state

Correct answer: Both firewalls believing they are Active at the same time

Split brain occurs when both HA peers simultaneously assume the Active role, typically due to a loss of the HA1 control link, causing traffic disruption.

Question 19: Which PAN-OS feature copies decrypted traffic to a dedicated interface for passive, out-of-band inspection by third-party security tools?

Decryption Broker
SSL Inbound Inspection
Decryption Mirror (Correct answer)
Tap Mode

Correct answer: Decryption Mirror

Decryption Mirror sends a copy of decrypted SSL/TLS traffic to a separate interface for passive tools like DLP solutions or forensic analyzers to inspect.

Question 20: What does the 'continue' action do in a URL Filtering profile?

Blocks the site entirely and logs the attempt
Displays a warning page requiring the user to click through before accessing the site (Correct answer)
Automatically allows the user to access the site without interruption
Forwards the request to a SIEM for analysis

Correct answer: Displays a warning page requiring the user to click through before accessing the site

The 'continue' action presents the user with a warning page acknowledging the site category, requiring a manual click-through to proceed, while logging the access.

Question 21: What is the role of the Network Processing Card (NPC) in Palo Alto Networks chassis-based firewalls like the PA-7000 series?

It stores the configuration and log database
It performs network I/O and initial packet processing (Correct answer)
It handles all management plane functions
It manages the Panorama connection

Correct answer: It performs network I/O and initial packet processing

NPCs in chassis-based firewalls handle network I/O, perform initial packet classification, and distribute traffic to Security Processing Cards (SPCs).

Question 22: With a Palo Alto Networks firewall, how many zones can be allocated to a given interface?

One (Correct answer)
Four
Three
Two

Correct answer: One

With a Palo Alto Networks firewall, each network interface can be allocated to only one security zone. This design principle ensures clear segmentation of the network and simplifies the application of security policies. Traffic flows between different zones are explicitly controlled by security rules, enhancing the overall security posture by enforcing strict boundaries.

Question 23: A Palo Alto NGFW is configured with multiple virtual systems (vsys). Which statement correctly describes traffic flow between vsys on the same physical firewall?

Inter-vsys traffic requires explicit security policy rules and traverses the firewall's dataplane as if it were between two separate devices (Correct answer)
Virtual systems share the same security policy and session table
Traffic flows freely between vsys without any policy enforcement
Inter-vsys routing is only possible with a dedicated physical link between them

Correct answer: Inter-vsys traffic requires explicit security policy rules and traverses the firewall's dataplane as if it were between two separate devices

Inter-vsys traffic is treated as external traffic between separate logical firewalls, requiring explicit security policies in both vsys and traversing the dataplane for full inspection.

Question 24: An organization uses PAN-OS Zone Protection profiles. Which threat protection setting within a Zone Protection profile helps mitigate reconnaissance activity?

Reconnaissance Protection (port scan and host sweep detection) (Correct answer)
Antivirus scanning
WildFire file forwarding
URL filtering category enforcement

Correct answer: Reconnaissance Protection (port scan and host sweep detection)

Zone Protection profiles include Reconnaissance Protection that detects and blocks TCP/UDP port scans and host sweep attempts before they reach security policies.

Question 25: What is the purpose of the 'Passive DNS Monitoring' feature in an Anti-Spyware profile?

It blocks all DNS queries to external resolvers
It replaces the DNS server with a sinkhole IP
It captures DNS query data and sends it to Palo Alto Networks for threat intelligence (Correct answer)
It rate-limits DNS traffic to prevent amplification attacks

Correct answer: It captures DNS query data and sends it to Palo Alto Networks for threat intelligence

Passive DNS Monitoring forwards DNS query logs to Palo Alto Networks to enhance threat intelligence without blocking or redirecting queries.

Question 26: In a Palo Alto HA pair, which sessions are synchronized to the Passive firewall by default?

Only HTTPS sessions
All established sessions including TCP, UDP, and ICMP (Correct answer)
Only management sessions
No sessions are synchronized unless manually configured

Correct answer: All established sessions including TCP, UDP, and ICMP

By default, the HA2 link synchronizes all established sessions so the Passive firewall can continue them transparently after a failover.

Question 27: Which Advanced Threat Prevention capability specifically protects against injection-based attacks within web application traffic by analyzing HTTP request patterns?

WildFire sandboxing
Vulnerability Protection signatures for web attacks (e.g., SQLi, XSS) (Correct answer)
File Blocking with custom MIME types
Anti-Spyware DNS sinkholing

Correct answer: Vulnerability Protection signatures for web attacks (e.g., SQLi, XSS)

Vulnerability Protection profiles include signatures that detect and block common web attack patterns like SQL injection and cross-site scripting in HTTP traffic.

Question 28: Which Panorama deployment mode allows it to manage firewalls AND act as a log collector on the same appliance?

Panorama mode (Correct answer)
Management Only mode
Cloud mode
Dedicated Log Collector mode

Correct answer: Panorama mode

In Panorama mode, the appliance can both manage firewall configurations and collect logs from managed devices, suitable for smaller deployments.

Question 29: In Panorama's policy hierarchy, which policy takes precedence over all others for a managed firewall?

Local Firewall Rules
Shared Pre-Rules (Correct answer)
Device Group Pre-Rules
Device Group Post-Rules

Correct answer: Shared Pre-Rules

Shared Pre-Rules defined at the top of the Panorama hierarchy take precedence over Device Group rules and local firewall rules, ensuring enterprise-wide policies are enforced.

Question 30: An administrator configures a NAT policy on a Palo Alto firewall where the source IP is translated to an IP address from a pool. When the pool is exhausted, what happens to new connection attempts by default?

The firewall logs a warning and continues with the original IP
Connections are dropped silently (Correct answer)
The firewall falls back to the interface IP address
Connections are queued until a pool address becomes available

Correct answer: Connections are dropped silently

When a dynamic IP NAT pool is exhausted, new connections that require translation are dropped because no available translation address exists.

Question 31: What is the primary purpose of security zones in Palo Alto Networks firewalls?

To configure routing protocols
To assign bandwidth limits to interfaces
To define NAT address pools
To logically group interfaces and enforce policy between groups (Correct answer)

Correct answer: To logically group interfaces and enforce policy between groups

Security zones logically group network interfaces, and all traffic between zones is subject to security policy inspection and enforcement.

Question 32: Which feature in Panorama allows administrators to group multiple templates to simplify large-scale deployments?

Log Forwarding Profiles
Template Stacks (Correct answer)
Device Groups
Collector Groups

Correct answer: Template Stacks

Template Stacks allow multiple templates to be layered together, with higher-priority templates overriding lower ones, simplifying configuration management for large environments.

Question 33: Which log type in Panorama captures all connections allowed or denied by security policy?

Config Logs
Traffic Logs (Correct answer)
System Logs
Threat Logs

Correct answer: Traffic Logs

Traffic Logs record all sessions that match security policy rules, showing source, destination, application, action (allow/deny), and bytes transferred.

Question 34: Which WildFire verdict type indicates a file has been analyzed and found to contain malicious behavior?

Malicious (Correct answer)
Benign
Grayware
Phishing

Correct answer: Malicious

WildFire assigns a 'Malicious' verdict when dynamic or static analysis confirms the file contains harmful code or behavior.

Question 35: It's called ____ to recognize a person automatically using their physical or behavioral traits.

Personal characteristics scanning
Bioscanning
Biological monitoring
Biometrics (Correct answer)
Fingerprint analysis

Correct answer: Biometrics

Biometrics refers to the automatic recognition of individuals based on their unique physical or behavioral traits. This technology utilizes distinct characteristics such as fingerprints, facial features, iris patterns, or voice recognition for identification and authentication purposes. Biometric systems offer a secure and convenient method of verifying identity, widely used in access control and security systems.

Question 36: What is a Device Group in Panorama?

A collection of log collectors for a region
A physical cluster of firewalls in a single data center
A list of administrators authorized to manage firewalls
A logical grouping of firewalls that share common policy and object configurations (Correct answer)

Correct answer: A logical grouping of firewalls that share common policy and object configurations

A Device Group in Panorama is a logical container for firewalls that share common security policies and objects, enabling centralized policy management.

Question 37: Which PAN-OS object type allows an administrator to reference a dynamically updated list of IP addresses, URLs, or domains that is maintained externally and automatically refreshed by the firewall?

Custom URL Category
External Dynamic List (EDL) (Correct answer)
Address Group
Dynamic Address Group (DAG)

Correct answer: External Dynamic List (EDL)

External Dynamic Lists (EDLs) allow the firewall to pull and automatically refresh IP, URL, or domain lists from an external web server at configured intervals.

Question 38: What does 'preemption' mean in the context of Palo Alto HA?

Disabling HA temporarily for maintenance
Manually swapping Active and Passive roles
The passive firewall blocking all traffic during sync
The higher-priority firewall automatically reclaiming the Active role after recovery (Correct answer)

Correct answer: The higher-priority firewall automatically reclaiming the Active role after recovery

Preemption allows the firewall with a higher HA priority to automatically take back the Active role once it recovers from a failure.

Question 39: In what order does PAN-OS evaluate decryption policies?

Top-down, with the first matching rule applied (Correct answer)
By specificity, most specific rule first regardless of position
Bottom-up, with the last matching rule applied
Alphabetically by rule name

Correct answer: Top-down, with the first matching rule applied

Like security policies, decryption policies are evaluated from top to bottom and the first rule that matches the traffic criteria is applied.

Question 40: What is the purpose of Host Information Profile (HIP) in GlobalProtect?

To assign IP addresses to remote clients
To collect and report endpoint security posture data (Correct answer)
To encrypt VPN tunnel traffic
To manage firewall policy rules

Correct answer: To collect and report endpoint security posture data

HIP collects endpoint security posture data such as OS patch level and antivirus status, enabling policy enforcement based on device health.

Question 41: What selection displays the qualities that can be made while configuring application filters?

Category, Subcategory, Technology, and Characteristic
Category, Subcategory, Technology, Risk, and Characteristic (Correct answer)
Name, Category, Technology, Risk, and Characteristic
Category, Subcategory, Risk, Standard Ports, and Technology

Correct answer: Category, Subcategory, Technology, Risk, and Characteristic

When configuring application filters on a Palo Alto Networks firewall, administrators can define criteria based on several qualities to precisely control application usage. These qualities include the application's Category, Subcategory, underlying Technology, associated Risk level, and specific Characteristics. This comprehensive set of attributes allows for highly granular and effective policy enforcement.

Question 42: Which HA link is used to synchronize session tables and runtime data between HA peers?

HA3 (Packet Forwarding Link)
HA2 (Data Link) (Correct answer)
Management Interface
HA1 (Control Link)

Correct answer: HA2 (Data Link)

The HA2 Data Link synchronizes session state, forwarding tables, and IPsec security associations between the Active and Passive firewalls.

Question 43: An addressable device on a network that can receive, process, and react to network signals is known as a .

network node (Correct answer)
cluster
static node
IP block

Correct answer: network node

A network node is any addressable device connected to a network that can send, receive, and process network signals. This broad definition includes various devices such as computers, servers, printers, routers, and switches, all of which contribute to the network's functionality. Each node has a unique identifier, like an IP address or MAC address, allowing it to communicate within the network.

Question 44: In Panorama, which administrator role has full read/write access to all managed devices and Panorama itself?

Device Group Admin
Superuser (Correct answer)
Template Admin
Log Viewer

Correct answer: Superuser

The Superuser role in Panorama has unrestricted read/write access to all configurations, policies, templates, and managed devices.

Question 45: Which Vulnerability Protection profile action drops the packet and resets both the client and server connections when a threat is detected?

Drop
Block IP
Alert
Reset Both (Correct answer)

Correct answer: Reset Both

'Reset Both' sends TCP resets to both the client and server, immediately terminating the connection when an exploit signature matches.

Question 46: In Palo Alto Networks firewall, what is 'single-pass parallel processing' (SP3)?

Analyzing the packet once while simultaneously performing all security functions (Correct answer)
Running App-ID and User-ID in parallel separate threads
Parallel processing of packets across multiple SPCs only
Processing each security function in separate sequential passes

Correct answer: Analyzing the packet once while simultaneously performing all security functions

SP3 architecture analyzes network traffic in a single pass, simultaneously applying App-ID, User-ID, Content-ID, and policy enforcement without multiple scanning passes.

Question 47: In a PAN-OS Antivirus security profile, what does the 'Wildfire Analysis' action do when set to 'Send' for unknown files?

Blocks the file immediately
Quarantines the file on the endpoint
Resets the TCP connection
Forwards the file to WildFire for analysis while allowing the session to continue (Correct answer)

Correct answer: Forwards the file to WildFire for analysis while allowing the session to continue

The 'Send' action uploads unknown files to WildFire for cloud-based analysis without blocking the in-progress session.

Question 48: Which PAN-OS feature inspects encrypted SSL/TLS traffic by acting as a man-in-the-middle, allowing App-ID and Content-ID to analyze the decrypted payload?

SSL Forward Proxy Decryption (Correct answer)
URL Filtering Profile
IPsec Tunnel Inspection
GlobalProtect Gateway

Correct answer: SSL Forward Proxy Decryption

SSL Forward Proxy Decryption intercepts outbound SSL/TLS connections, decrypts them for inspection, then re-encrypts before forwarding to the destination.

Question 49: Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

The full URL path of the requested resource
Application identification from App-ID signatures
Server Name Indication (SNI) field containing the destination hostname (Correct answer)
The server's certificate Common Name (CN)

Correct answer: Server Name Indication (SNI) field containing the destination hostname

The SNI extension in the TLS ClientHello is sent in plaintext before encryption begins, allowing the firewall to match decryption policy rules on the destination hostname early in the handshake.

Question 50: What is the function of the Palo Alto Networks 'Commit' operation in relation to the candidate configuration?

It exports the configuration to Panorama
It backs up the running configuration to the cloud
It saves changes to the running configuration immediately
It validates and activates the candidate configuration replacing the running configuration (Correct answer)

Correct answer: It validates and activates the candidate configuration replacing the running configuration

A commit validates the candidate configuration for errors and then activates it, making it the new running configuration.

Question 51: Which Palo Alto Networks security feature analyzes DNS queries to block connections to malicious domains, including C2 servers?

Anti-Spyware Profile
URL Filtering
DNS Security (Correct answer)
GlobalProtect

Correct answer: DNS Security

DNS Security uses threat intelligence to analyze DNS queries and block requests to known malicious domains, disrupting command-and-control communications and malware distribution.

Question 52: Which Palo Alto Networks product is primarily meant to stop endpoints from successfully running malicious software?

GlobalProtect
Cortex XDR (Correct answer)
Cortex XDR - Analytics
Prisma Cloud

Correct answer: Cortex XDR

Cortex XDR is Palo Alto Networks' comprehensive extended detection and response platform, primarily designed to protect endpoints from advanced threats. It uses a combination of behavioral analytics, machine learning, and threat intelligence to prevent, detect, and respond to various forms of malicious software, including malware, ransomware, and exploits. Its core function is to stop malicious software from successfully running and compromising endpoints.

Question 53: What is the role of a Log Collector in Panorama?

To provide a GUI for firewall management
To apply security policies to managed devices
To aggregate and store logs from multiple firewalls at scale (Correct answer)
To synchronize configuration between HA peers

Correct answer: To aggregate and store logs from multiple firewalls at scale

A Panorama Log Collector receives, stores, and forwards logs from managed firewalls, enabling centralized log management at enterprise scale.

Question 54: An administrator is troubleshooting why traffic matching a security policy rule is being dropped. The 'test security-policy-match' CLI command shows the correct rule, but traffic still fails. What should be checked next?

Increase the session limit on the firewall
Check if the interface is in layer 3 mode
Verify the security profile applied to the rule is not blocking the traffic (Correct answer)
Re-run the commit to refresh the policy

Correct answer: Verify the security profile applied to the rule is not blocking the traffic

Even when a security rule allows traffic, an attached Security Profile (e.g., Vulnerability Protection, Antivirus) may detect and block the traffic based on threat content.

Question 55: Which Palo Alto feature allows a virtual IP address to move between HA peers during failover, ensuring uninterrupted connectivity?

Loopback Interface
ECMP
Dynamic Routing Redistribution
Floating IP (Correct answer)

Correct answer: Floating IP

A Floating IP is a virtual IP address configured on an HA pair that moves to the currently Active firewall, maintaining connectivity for downstream devices.

Question 56: What is the purpose of the Clientless VPN feature in GlobalProtect?

To tunnel all traffic over HTTP
To bypass MFA for trusted users
To establish IPsec tunnels without an agent
To provide browser-based access to internal web applications without installing the GP agent (Correct answer)

Correct answer: To provide browser-based access to internal web applications without installing the GP agent

Clientless VPN provides access to internal web applications through an SSL-secured browser portal without requiring the GlobalProtect agent to be installed.

Question 57: An administrator configures a Palo Alto firewall with two ISP connections. Which PAN-OS feature should be used to distribute outbound internet traffic across both ISP links based on bandwidth utilization?

Policy-Based Forwarding with PBF rules
Virtual Router with static routes and equal metrics
ECMP (Equal-Cost Multi-Path)
SD-WAN path quality profiles (Correct answer)

Correct answer: SD-WAN path quality profiles

SD-WAN path quality profiles allow distributing traffic across multiple WAN links based on bandwidth, latency, jitter, and packet loss metrics.

Question 58: What does the 'HA Suspended' state mean on a Palo Alto firewall?

The firewall is in the process of synchronizing with its peer
The firewall is waiting for a configuration commit
The firewall has been administratively removed from the HA pair and will not take over (Correct answer)
The firewall has detected a hardware failure

Correct answer: The firewall has been administratively removed from the HA pair and will not take over

A Suspended HA firewall has been manually taken out of the HA pair by an administrator and will not participate in failover.

Question 59: Which CLI command on PAN-OS can an administrator use to confirm whether a specific active session is being SSL decrypted?

show running decryption sessions
debug ssl decrypt list
show decryption status all
show session id <session-id> (Correct answer)

Correct answer: show session id <session-id>

'show session id <session-id>' displays detailed session attributes including a 'decrypt' field indicating whether SSL/TLS decryption is active for that session.

Question 60: In Palo Alto Networks firewall architecture, which plane handles the actual packet forwarding and security policy enforcement?

Control plane
Data plane (Correct answer)
Management plane
Log plane

Correct answer: Data plane

The data plane (also called the forwarding plane) performs packet processing, App-ID, Content-ID, and policy enforcement at line rate.

Question 61: Which Panorama report type provides a summary of traffic patterns and top applications across all managed firewalls?

HA Status Report
Application Usage and Risk Report (Correct answer)
Configuration Audit Report
Certificate Expiry Report

Correct answer: Application Usage and Risk Report

The Application Usage and Risk Report aggregates data from managed firewalls to show top applications, bandwidth consumption, and associated risk levels.

Question 62: What is the purpose of the HA1 Control Link in a Palo Alto HA pair?

To pass decrypted traffic between peers
To synchronize session tables
To forward user traffic during failover
To exchange heartbeats and synchronize configuration between peers (Correct answer)

Correct answer: To exchange heartbeats and synchronize configuration between peers

The HA1 Control Link carries heartbeat packets, hello messages, and configuration synchronization between HA peers.

Question 63: What is the default behavior for intra-zone traffic (traffic within the same zone) on a Palo Alto firewall?

Sent to a sandbox for analysis
Allowed by default (Correct answer)
Denied by default
Logged but not inspected

Correct answer: Allowed by default

By default, intra-zone traffic is allowed without inspection; administrators must create explicit deny rules or enable intra-zone security profiles to inspect same-zone traffic.

Question 64: In Palo Alto HA, which log type records failover events and HA state transitions?

Traffic Logs
Threat Logs
System Logs (Correct answer)
Authentication Logs

Correct answer: System Logs

System Logs record HA state changes, failover events, peer connectivity issues, and configuration sync status.

Question 65: Which configuration on the firewall defines which traffic from GlobalProtect clients bypasses the VPN tunnel?

Security Policy
QoS Profile
Split Tunnel Access Route (Correct answer)
NAT Policy

Correct answer: Split Tunnel Access Route

Split Tunnel Access Routes configured on the gateway define which subnets or domains are routed through the VPN versus sent directly to the internet.

Question 66: In Palo Alto Networks, what is the purpose of a Security Policy 'Service' field set to 'application-default'?

It enables decryption for the matched application
It applies the default threat profile to all traffic
It restricts the allowed ports to those normally used by the identified application (Correct answer)
It allows traffic on any port

Correct answer: It restricts the allowed ports to those normally used by the identified application

Setting Service to 'application-default' allows the application only on its standard, expected ports, preventing evasion by running applications on non-standard ports.

Question 67: A Palo Alto firewall is configured in Virtual Wire (V-Wire) mode. Which statement accurately describes a characteristic of this deployment mode?

The firewall requires IP addresses on all interfaces for traffic forwarding
Virtual Wire mode only supports IPv4 traffic
NAT policies are required for all traffic passing through the firewall
The firewall is transparent to the network — no IP routing changes are needed (Correct answer)

Correct answer: The firewall is transparent to the network — no IP routing changes are needed

Virtual Wire mode makes the firewall completely transparent to the network, requiring no changes to IP addressing or routing infrastructure on adjacent devices.

Question 68: Which of the following describes an access policy for a firewall?

It determines the number of zones your firewall will have.
It provides a set of rules that determine who gets in or out of your network and who doesn't (Correct answer)
It determines the operational state (on/off) of the firewall.
It gives your firewall threat-intelligence.

Correct answer: It provides a set of rules that determine who gets in or out of your network and who doesn't

An access policy for a firewall provides a set of rules that explicitly determine who gets in or out of your network and who doesn't. These rules define criteria such as source and destination IP addresses, ports, protocols, and applications, governing which network connections are permitted or denied. This granular control is fundamental to network security, protecting against unauthorized access and malicious traffic.

Question 69: What file actions can be configured in a File Blocking profile on a Palo Alto firewall?

Encrypt, Log, and Forward
Alert, Block, and Continue (Correct answer)
Scan, Quarantine, and Delete
Allow, Deny, and Compress

Correct answer: Alert, Block, and Continue

File Blocking profiles support Alert (log the file transfer), Block (prevent the transfer), and Continue (notify the user but allow transfer after confirmation) actions.

Question 70: What happens when you push a configuration from Panorama to a managed firewall?

The firewall's local configuration is permanently deleted
Panorama-managed policies and templates are committed and activated on the firewall (Correct answer)
The firewall reboots automatically
Only log forwarding profiles are updated

Correct answer: Panorama-managed policies and templates are committed and activated on the firewall

A Panorama push commits the centrally managed configurations (policies, objects, templates) to the managed firewall, making them active.

Question 71: In Palo Alto Networks High Availability, what is the role of the Active firewall?

It actively processes all network traffic and enforces security policy (Correct answer)
It processes only management traffic
It monitors the passive peer health only
It synchronizes configuration to the passive peer

Correct answer: It actively processes all network traffic and enforces security policy

In an Active/Passive HA pair, the Active firewall processes all live network traffic while the Passive firewall stands by in a synchronized state.

Question 72: In a large enterprise GlobalProtect deployment, what is the recommended approach for scaling gateway capacity?

Disable HIP checks to reduce load
Deploy multiple gateways in different geographic locations (Correct answer)
Use software-only virtual gateways on endpoints
Deploy a single high-memory gateway

Correct answer: Deploy multiple gateways in different geographic locations

Deploying multiple geographically distributed gateways distributes load and reduces latency for remote users worldwide.

Question 73: What is the default action for traffic between two different security zones if no matching security policy rule exists?

Log only without blocking
Allow all traffic
Deny all traffic (implicit deny) (Correct answer)
Apply default threat profiles

Correct answer: Deny all traffic (implicit deny)

Palo Alto firewalls apply an implicit deny-all rule at the bottom of the security policy, blocking all inter-zone traffic that does not match an explicit allow rule.

Question 74: In GlobalProtect, what is split tunneling used for?

Routing only specific traffic through the VPN tunnel (Correct answer)
Load balancing between multiple gateways
Encrypting all traffic through the VPN
Authenticating users with two factors

Correct answer: Routing only specific traffic through the VPN tunnel

Split tunneling directs only specified destination traffic through the VPN tunnel while other traffic goes directly to the internet.

Question 75: How does Panorama handle log storage when a Log Collector's disk is full?

Panorama deletes all logs and resets the collector
Oldest logs are overwritten in a circular buffer fashion (Correct answer)
Logs are automatically archived to cloud storage
Log collection stops until disk space is freed manually

Correct answer: Oldest logs are overwritten in a circular buffer fashion

When a Log Collector reaches its storage limit, it overwrites the oldest log entries first, operating as a circular log buffer to ensure continuous logging.

Question 76: Which PAN-OS feature automatically builds a list of sites that should be excluded from SSL decryption based on observed SSL errors and handshake failures?

Dynamic Address Group for SSL exclusions
Decryption Profile exceptions list
URL Filtering automatic exclusion
SSL Exclude Cache (Decryption Exclusion Cache) (Correct answer)

Correct answer: SSL Exclude Cache (Decryption Exclusion Cache)

The SSL Exclude Cache automatically adds sites causing SSL errors during decryption (such as certificate-pinned apps) to a dynamic exclusion list to prevent recurring connectivity failures.

Palo Alto Networks Certified Network Security Engineer (PCNSE)

The PCNSE validates advanced skills in designing, deploying, configuring, maintaining, and troubleshooting Palo Alto Networks Next-Generation Firewalls and the broader PAN-OS security platform. It is intended for experienced network security engineers working with Palo Alto Networks products.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

paloaltonetworks.com — Retake fee, score release, passing score, renewal, exam information · verified Nov 2026
pearsonvue.com — Test delivery · verified Oct 2026
live.paloaltonetworks.com — Score validity · verified Oct 2026