PCNSE Palo Alto Networks Firewall Configuration Flashcards

An administrator wants to prevent a compromised internal host from communicating with known command-and-control (C2) servers. Which combination of features provides the most comprehensive protection?

Answer: Anti-spyware profile with DNS sinkholing and C2 signature blocking enabled

Anti-spyware profiles with DNS sinkholing redirect C2 DNS queries to a controlled IP, while C2 signatures detect and block the actual C2 communication traffic.

When configuring a Palo Alto firewall for a dual-ISP setup using Policy-Based Forwarding (PBF), what happens to the PBF rule when the monitored next-hop becomes unreachable?

Answer: The PBF rule is disabled and traffic falls back to the virtual router routing table

When PBF path monitoring detects a next-hop failure, the PBF rule is temporarily disabled, allowing traffic to use the standard virtual router routing table as a fallback.

What is the primary purpose of the 'no-decrypt' action in a Decryption policy rule in PAN-OS?

Answer: It explicitly excludes matched traffic from SSL decryption, allowing it to pass through encrypted

The 'no-decrypt' action creates an explicit exclusion, ensuring that matched traffic (e.g., banking sites, healthcare systems) bypasses SSL decryption.

A Palo Alto NGFW is configured with multiple virtual systems (vsys). Which statement correctly describes traffic flow between vsys on the same physical firewall?

Answer: Inter-vsys traffic requires explicit security policy rules and traverses the firewall's dataplane as if it were between two separate devices

Inter-vsys traffic is treated as external traffic between separate logical firewalls, requiring explicit security policies in both vsys and traversing the dataplane for full inspection.

An engineer needs to ensure that QoS is applied consistently across multiple security rules for video conferencing applications. What is the most efficient PAN-OS configuration approach?

Answer: Create a QoS Profile and reference it in the QoS policy matching the video conferencing application

QoS Profiles define bandwidth guarantees and priorities, and are applied via QoS policies that match traffic by zone, interface, application, and user for consistent treatment.

Which PAN-OS feature allows security administrators to create dynamic security group memberships based on VM attributes such as tags, names, or operating systems in a VMware NSX environment?

Answer: Dynamic Address Groups (DAG) using registered IP tags from VM monitoring

Dynamic Address Groups use registered IP tags from VM Monitoring or the XML API to automatically include or exclude IP addresses based on current VM attributes without manual updates.

After a software upgrade on a Palo Alto firewall results in unexpected behavior, an administrator wants to immediately restore the previous software version and configuration. Which recovery approach is the fastest?

Answer: Use the 'request system software revert' command to revert to the previously installed version

'request system software revert' restores the previously running PAN-OS version along with its associated configuration, providing the fastest path back to a known-good state.