Mixed Deck — All PCNSE Topics Flashcards

Which Palo Alto Networks feature enables the firewall to identify users even when they authenticate through a proxy or Citrix environment?

Answer: Terminal Services Agent (TSA)

The Terminal Services Agent maps individual user traffic on shared-IP environments like Citrix or RDS by tracking port ranges assigned to each user.

Which zone type on a Palo Alto Networks firewall is used to inspect traffic that originates and terminates on the firewall itself?

Answer: Loopback zone

The loopback zone handles traffic that originates or terminates on the firewall itself, such as management services hosted on the device.

What happens when a firewall running WildFire receives a 'Phishing' verdict for a submitted URL?

Answer: A phishing signature is generated and distributed to WildFire subscribers

A Phishing verdict causes WildFire to generate and distribute a new anti-phishing signature to all WildFire-subscribed firewalls.

Which Palo Alto Networks feature provides Layer 2 segmentation by forwarding traffic based on MAC addresses without routing?

Answer: Layer 2 deployment mode

Layer 2 deployment mode enables the firewall to act as a transparent bridge, forwarding traffic based on MAC addresses within the same broadcast domain.

What is the function of the Palo Alto Networks 'Decryption Broker' feature?

Answer: It decrypts traffic and forwards plaintext copies to third-party security tools

Decryption Broker allows the firewall to decrypt SSL/TLS traffic and forward the plaintext to third-party inline security appliances for additional inspection.

A firewall is deployed in tap mode. Which Threat Prevention actions will be enforced on matched traffic?

Answer: Only 'Alert' and 'Allow' — tap mode cannot block traffic

In tap mode, the firewall receives a copy of traffic and cannot inject packets to block or reset connections, so only passive actions like alerting are effective.

Which zone type allows a Palo Alto firewall to monitor traffic passively without being in the traffic path?

Answer: Tap

A Tap zone connects to a SPAN or mirror port, allowing the firewall to inspect a copy of traffic without being inline, enabling visibility without policy enforcement.

A dramatic increase in the number of message packets being transmitted into the network was detected by the network administrator of the Chocolate Biscuit International company. He begins procedures to look into the cause of the increase. The system crashes and shuts down before he could find anything out from his inquiry. Attacks on Chocolate Biscuit International could happen.

Answer: Denial of Service

The scenario described, with a dramatic increase in message packets overwhelming the network and causing a system crash, is a classic indication of a Denial of Service (DoS) attack. A DoS attack aims to make a machine or network resource unavailable to its intended users by flooding it with traffic or requests, thereby preventing legitimate access. This disruption can lead to significant operational downtime.

An engineer needs to ensure that QoS is applied consistently across multiple security rules for video conferencing applications. What is the most efficient PAN-OS configuration approach?

Answer: Create a QoS Profile and reference it in the QoS policy matching the video conferencing application

QoS Profiles define bandwidth guarantees and priorities, and are applied via QoS policies that match traffic by zone, interface, application, and user for consistent treatment.

What Panorama feature allows an administrator to compare the running configuration of a managed firewall against the Panorama-pushed configuration?

Answer: Config Audit

Config Audit in Panorama highlights differences between configurations, helping identify unauthorized local changes or configuration drift on managed firewalls.

When configuring High Availability (HA) on a Palo Alto firewall, which HA mode uses an active/active configuration where both firewalls process traffic simultaneously?

Answer: Active/Active HA

Active/Active HA allows both firewalls to process traffic simultaneously, requiring session synchronization and typically used with dynamic routing protocols.

Which authentication method can GlobalProtect use to verify user identity alongside username and password?

Answer: MFA via RADIUS or SAML

GlobalProtect supports multi-factor authentication (MFA) by integrating with RADIUS or SAML identity providers.

When configuring a Palo Alto firewall for a dual-ISP setup using Policy-Based Forwarding (PBF), what happens to the PBF rule when the monitored next-hop becomes unreachable?

Answer: The PBF rule is disabled and traffic falls back to the virtual router routing table

When PBF path monitoring detects a next-hop failure, the PBF rule is temporarily disabled, allowing traffic to use the standard virtual router routing table as a fallback.

What is the effect of enabling 'Enforce GlobalProtect Connection for Network Access' on an endpoint?

Answer: It blocks network access until the GlobalProtect VPN is connected

This setting prevents the endpoint from accessing any network resources until the GlobalProtect agent successfully establishes a VPN connection.

When WildFire analysis identifies a previously unknown file as malware, how does PAN-OS distribute the new threat signature to subscribed firewalls?

Answer: Automatically through WildFire signature updates, delivered within minutes of verdict generation

WildFire delivers new malware signatures to subscribed firewalls within approximately 5 minutes of verdict generation through automated signature updates.

What is the purpose of the HA1 Control Link in a Palo Alto HA pair?

Answer: To exchange heartbeats and synchronize configuration between peers

The HA1 Control Link carries heartbeat packets, hello messages, and configuration synchronization between HA peers.

Which GlobalProtect feature enables seamless user authentication using Windows credentials without prompting the user?

Answer: SSO (Single Sign-On) with Windows credentials

SSO allows GlobalProtect to use Windows domain credentials so users authenticate to the VPN automatically at Windows login.

Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

Answer: Server Name Indication (SNI) field containing the destination hostname

The SNI extension in the TLS ClientHello is sent in plaintext before encryption begins, allowing the firewall to match decryption policy rules on the destination hostname early in the handshake.

Which traffic flow direction would require a 'Trust to Untrust' security policy rule on a Palo Alto firewall?

Answer: An internal user browsing the internet

When an internal user in the Trust zone accesses the internet (Untrust zone), the security policy must have a rule permitting Trust-to-Untrust traffic for the desired application.

Which database does Palo Alto Networks use to classify URLs into categories for URL Filtering?

Answer: PAN-DB

PAN-DB is Palo Alto Networks' proprietary URL categorization database, which classifies billions of URLs into categories that can be used in URL Filtering profiles.