PCNSE PCNSE Palo Alto Networks Firewall Configuration 2 — Questions and Answers
Question 1: Which Palo Alto Networks feature allows you to define a logical grouping of interfaces that share the same security policy and is the fundamental building block for zone-based firewall policies?
- Virtual Router
- Security Zone (Correct answer)
- VLAN Interface
- Tunnel Interface
Correct answer: Security Zone
Security Zones are logical groupings of interfaces that share the same security policy, forming the foundation of PAN-OS zone-based firewall policies.
Question 2: When configuring High Availability (HA) on a Palo Alto firewall, which HA mode uses an active/active configuration where both firewalls process traffic simultaneously?
- HA Mode 1
- Active/Passive HA
- Active/Active HA (Correct answer)
- Cluster HA
Correct answer: Active/Active HA
Active/Active HA allows both firewalls to process traffic simultaneously, requiring session synchronization and typically used with dynamic routing protocols.
Question 3: A firewall administrator needs to allow traffic from the DMZ to the internet but block all return traffic that was not initiated from the DMZ. Which security policy configuration achieves this correctly?
- Create an intrazone policy allowing DMZ to DMZ traffic
- Create an interzone policy from DMZ to Untrust with application 'any' and action 'allow' (Correct answer)
- Create an interzone policy from Untrust to DMZ with action 'deny'
- Enable 'Reject' as the default interzone action
Correct answer: Create an interzone policy from DMZ to Untrust with application 'any' and action 'allow'
An interzone policy from DMZ to Untrust with 'allow' action permits outbound traffic, while stateful inspection automatically blocks unsolicited inbound return traffic.
Question 4: What is the purpose of the 'commit and push' operation in Panorama when managing multiple firewalls?
- Commits changes locally to Panorama only
- Commits changes to Panorama and immediately pushes device group and template configurations to managed firewalls (Correct answer)
- Pushes only template configurations, not device group policies
- Performs a candidate config validation without applying changes
Correct answer: Commits changes to Panorama and immediately pushes device group and template configurations to managed firewalls
'Commit and Push' in Panorama saves changes to Panorama's running config and simultaneously distributes device group policies and template settings to managed firewalls.
Question 5: Which PAN-OS feature inspects encrypted SSL/TLS traffic by acting as a man-in-the-middle, allowing App-ID and Content-ID to analyze the decrypted payload?
- SSL Forward Proxy Decryption (Correct answer)
- IPsec Tunnel Inspection
- URL Filtering Profile
- GlobalProtect Gateway
Correct answer: SSL Forward Proxy Decryption
SSL Forward Proxy Decryption intercepts outbound SSL/TLS connections, decrypts them for inspection, then re-encrypts before forwarding to the destination.
Question 6: An administrator configures a Palo Alto firewall with two ISP connections. Which PAN-OS feature should be used to distribute outbound internet traffic across both ISP links based on bandwidth utilization?
- ECMP (Equal-Cost Multi-Path)
- Policy-Based Forwarding with PBF rules
- Virtual Router with static routes and equal metrics
- SD-WAN path quality profiles (Correct answer)
Correct answer: SD-WAN path quality profiles
SD-WAN path quality profiles allow distributing traffic across multiple WAN links based on bandwidth, latency, jitter, and packet loss metrics.
Question 7: What happens when a Palo Alto firewall encounters a packet that matches no security policy rule and the default intrazone action is set to 'allow'?
- The packet is dropped and logged
- The packet is allowed if source and destination zones are the same (Correct answer)
- The packet is forwarded to the next rule in the rulebase
- The packet triggers a security profile scan before being allowed
Correct answer: The packet is allowed if source and destination zones are the same
The default intrazone action applies to traffic where source and destination zones are identical; if set to 'allow', such traffic is permitted without matching an explicit rule.
PCNSE PCNSE Palo Alto Networks Firewall Configuration 2
Which Palo Alto Networks feature allows you to define a logical grouping of interfaces that share the same security policy and is the fundamental building block for zone-based firewall policies?