PCNSE Palo Alto Networks Firewall Configuration Flashcards

Which Palo Alto Networks feature allows you to define a logical grouping of interfaces that share the same security policy and is the fundamental building block for zone-based firewall policies?

Answer: Security Zone

Security Zones are logical groupings of interfaces that share the same security policy, forming the foundation of PAN-OS zone-based firewall policies.

When configuring High Availability (HA) on a Palo Alto firewall, which HA mode uses an active/active configuration where both firewalls process traffic simultaneously?

Answer: Active/Active HA

Active/Active HA allows both firewalls to process traffic simultaneously, requiring session synchronization and typically used with dynamic routing protocols.

A firewall administrator needs to allow traffic from the DMZ to the internet but block all return traffic that was not initiated from the DMZ. Which security policy configuration achieves this correctly?

Answer: Create an interzone policy from DMZ to Untrust with application 'any' and action 'allow'

An interzone policy from DMZ to Untrust with 'allow' action permits outbound traffic, while stateful inspection automatically blocks unsolicited inbound return traffic.

What is the purpose of the 'commit and push' operation in Panorama when managing multiple firewalls?

Answer: Commits changes to Panorama and immediately pushes device group and template configurations to managed firewalls

'Commit and Push' in Panorama saves changes to Panorama's running config and simultaneously distributes device group policies and template settings to managed firewalls.

Which PAN-OS feature inspects encrypted SSL/TLS traffic by acting as a man-in-the-middle, allowing App-ID and Content-ID to analyze the decrypted payload?

Answer: SSL Forward Proxy Decryption

SSL Forward Proxy Decryption intercepts outbound SSL/TLS connections, decrypts them for inspection, then re-encrypts before forwarding to the destination.

An administrator configures a Palo Alto firewall with two ISP connections. Which PAN-OS feature should be used to distribute outbound internet traffic across both ISP links based on bandwidth utilization?

Answer: SD-WAN path quality profiles

SD-WAN path quality profiles allow distributing traffic across multiple WAN links based on bandwidth, latency, jitter, and packet loss metrics.

What happens when a Palo Alto firewall encounters a packet that matches no security policy rule and the default intrazone action is set to 'allow'?

Answer: The packet is allowed if source and destination zones are the same

The default intrazone action applies to traffic where source and destination zones are identical; if set to 'allow', such traffic is permitted without matching an explicit rule.