CertArea
All Palo Alto Networks exams

Free PCNSE practice test: 30 questions with answers

30 original questions for Palo Alto Networks Certified Network Security Engineer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

PCNSE exam guide: topics, cost and format

All 30 PCNSE questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Policies (4 questions)

  1. Question 1

    In what order does the PAN-OS firewall evaluate security policy rules?

    1. AFrom the bottom of the rule base upwards, applying the last rule that matches the traffic in the list
    2. BFrom the top of the rule base downwards, applying the first rule whose criteria match the traffic
    3. CAlphabetically by rule name, applying the first rule whose name matches the application of the traffic
    4. DRandomly, so that rule order does not matter for the outcome of any traffic flow in the network at all
    Show answer and explanation
    Correct answer: B

    PAN-OS evaluates security rules from top to bottom and applies the first match. The other orders are not how the rule base is evaluated.

  2. Question 2

    What does the implicit deny rule at the end of the security rule base do?

    1. AIt allows all traffic that does not match an explicit rule, so that new applications work without configuration
    2. BIt denies any traffic that does not match an explicit allow rule before it
    3. CIt logs the traffic but takes no action, so that the traffic continues to the destination unchanged
    4. DIt forwards unmatched traffic to the internet without any inspection, which is the default behaviour of the firewall
    Show answer and explanation
    Correct answer: B

    The implicit deny rule blocks traffic not matched by an allow rule. Allowing, logging only and forwarding without inspection are incorrect defaults.

  3. Question 3

    Which policy element identifies the traffic by the application it uses, rather than only by port number?

    1. AThe schedule field, which identifies traffic only by the time of day at which the packets are sent
    2. BThe destination port field, which identifies traffic only by the numeric port in each packet header
    3. CThe source zone field, which identifies traffic only by the zone on which it entered the firewall at its edge
    4. DApp-ID, which identifies applications regardless of the port they use
    Show answer and explanation
    Correct answer: D

    App-ID identifies applications regardless of port. Port, zone and schedule fields do not identify the application.

  4. Question 4

    Which profile inspects allowed traffic for viruses and malware files?

    1. AAn antivirus profile, which scans allowed traffic for viruses and malware
    2. BA URL filtering profile, which controls web access by category and does not scan files for malware content
    3. CA data filtering profile, which detects sensitive data patterns in traffic but not malicious file content
    4. DA schedule object, which defines when a rule is active and does not inspect the content of any traffic at all
    Show answer and explanation
    Correct answer: A

    An antivirus profile scans traffic for viruses and malware. URL, data filtering and schedule objects do other jobs.

Interfaces, Zones and Routing (4 questions)

  1. Question 5

    What is a security zone on a PAN-OS firewall?

    1. AA subnet reserved for management traffic only, which the data plane is not allowed to use at all
    2. BA physical cable that connects the firewall to the internet service provider's network at the edge
    3. CA logical grouping of interfaces that policies use to decide where traffic enters and leaves
    4. DA list of approved domain names that the firewall uses to filter web browsing for all users in the network
    Show answer and explanation
    Correct answer: C

    A zone is a logical grouping of interfaces that policies reference. It is not a cable, a management subnet or a domain list.

  2. Question 6

    Which interface type is used when the firewall acts as the default gateway for hosts on a layer 3 subnet?

    1. AA tap interface, which copies traffic for monitoring and cannot forward or route packets for the hosts at all
    2. BA layer 2 interface with no IP address, which only switches frames between the hosts on the same segment
    3. CA layer 3 interface with an IP address that the hosts use as their default gateway
    4. DA virtual wire interface, which passes traffic transparently and does not provide a default gateway address to hosts
    Show answer and explanation
    Correct answer: C

    A layer 3 interface with an IP address acts as a default gateway. Layer 2, tap and virtual wire interfaces do not provide a routed gateway.

  3. Question 7

    What is a virtual router in PAN-OS?

    1. AA physical router placed in front of the firewall to filter traffic before it reaches the security rule base
    2. BA cloud service that rents extra bandwidth from the provider during peak hours for the customer's traffic
    3. CA routing instance that holds the routing table and forwarding decisions for the interfaces assigned to it
    4. DA virtual machine image of the firewall used only to test policies in a lab with no production traffic at all
    Show answer and explanation
    Correct answer: C

    A virtual router is a routing instance with its own routing table for assigned interfaces. The other options describe cloud bandwidth, physical routers and lab images.

  4. Question 8

    Which routing protocol does PAN-OS support for dynamic route exchange with neighbours?

    1. ANTP, which synchronises the clocks of the devices and does not carry routing information between them
    2. BDNS, which resolves domain names to addresses and does not exchange routes between routers at all
    3. CDHCP, which assigns addresses to clients and does not advertise any routes to neighbouring routers in the network
    4. DOSPF and BGP, which exchange routes dynamically with peer routers
    Show answer and explanation
    Correct answer: D

    OSPF and BGP are routing protocols that exchange routes dynamically. DNS, DHCP and NTP are not routing protocols.

App-ID, User-ID and Content-ID (4 questions)

  1. Question 9

    What does User-ID add to a PAN-OS security policy?

    1. AIt identifies the application inside the traffic regardless of the port used by the session
    2. BIt maps IP addresses to user identities so that policies can match on users and groups
    3. CIt scans the content of files for malware using signatures stored on the firewall's local disk
    4. DIt translates the user's address to a public address so that the user can reach the internet
    Show answer and explanation
    Correct answer: B

    User-ID maps IP addresses to users and groups for policy matching. Application identification is App-ID, content scanning is Content-ID, and address translation is NAT.

  2. Question 10

    Which component of PAN-OS identifies the application in a session even when it runs on a non-standard port?

    1. AApp-ID, which identifies applications from traffic patterns and signatures regardless of port
    2. BUser-ID, which maps IP addresses to user identities for policy matching and does not classify applications
    3. CContent-ID, which inspects file and threat content in allowed sessions but does not identify the application itself
    4. DZone protection, which limits floods and scans at the zone boundary and does not classify applications
    Show answer and explanation
    Correct answer: A

    App-ID identifies applications regardless of port. User-ID, Content-ID and zone protection serve different functions.

  3. Question 11

    Why might an administrator create a custom application object?

    1. ATo replace all built-in applications with custom ones so that the firewall uses no vendor signatures at all
    2. BTo identify an internal or proprietary application that is not recognised by the built-in App-ID signatures
    3. CTo change the colour of the application's icon in the policy editor for each team's readability
    4. DTo disable App-ID for a specific application so that its traffic is treated as unknown by every policy
    Show answer and explanation
    Correct answer: B

    A custom application object identifies proprietary applications not covered by App-ID. Replacing all signatures, cosmetic changes and disabling App-ID do not serve that purpose.

  4. Question 12

    Which Content-ID component blocks files that match a defined type and direction in a policy?

    1. AAddress groups, which group IP addresses for policy matching and do not inspect any file types at all
    2. BURL filtering, which controls web access by category and does not inspect the file types of downloads
    3. CSchedule objects, which define the times at which a rule is active and do not inspect any file content
    4. DFile blocking, which blocks or alerts on file types in allowed sessions as defined by a profile
    Show answer and explanation
    Correct answer: D

    File blocking inspects file types and directions in allowed sessions. URL filtering, schedules and address groups do not inspect file types.

Troubleshooting (3 questions)

  1. Question 13

    Which PAN-OS CLI command shows the session table entries that match a filter?

    1. Ashow session all filter, which lists the sessions that match the filter criteria
    2. Bshow system info, which displays the model and software version of the firewall without any session details
    3. Cshow interface all, which lists the interfaces and their states but shows no sessions in the table at all
    4. Dshow admins, which lists the administrator accounts that are configured on the device for the team
    Show answer and explanation
    Correct answer: A

    show session all filter lists matching sessions. System info, interface and administrator commands show different information.

  2. Question 14

    What is a common first step when traffic is unexpectedly blocked by a PAN-OS firewall?

    1. ADisabling all security profiles at once so that traffic flows, then leaving them off for the rest of the day
    2. BChecking the traffic and threat logs to see which rule and profile acted on the session
    3. CRebooting the firewall without reviewing the logs, so that the cause is hidden by the restart of the device
    4. DDeleting the security policy and re-adding it from memory without first reviewing the logs of the session
    Show answer and explanation
    Correct answer: B

    Reviewing traffic and threat logs shows which rule and profile acted, guiding the fix. Disabling protections, rebooting and deleting rules without evidence are poor first steps.

  3. Question 15

    Which tool captures packets passing through a PAN-OS firewall for detailed analysis?

    1. AThe URL category lookup, which returns the category of a web address but does not record any packets
    2. BThe commit log, which records the times at which configuration changes were applied to the device
    3. CThe HIP report, which lists the host profile checks made for remote clients connecting through GlobalProtect
    4. DThe packet capture feature, which records traffic on selected interfaces and filters for analysis
    Show answer and explanation
    Correct answer: D

    The packet capture feature records traffic on selected interfaces for analysis. Commit logs, HIP reports and URL lookups do not capture packets.

Firewall Deployment and Management (3 questions)

  1. Question 16

    Which PAN-OS management interface is used to configure the firewall through its web console?

    1. AThe management interface, which is reached by HTTPS to the firewall's management address
    2. BThe first data interface, which carries the user traffic and can also serve the administrator's web console
    3. CA serial console used only during the first boot, with no web access to the management interface afterwards
    4. DThe HA control link, which is reserved for synchronising the configuration between the two firewall peers
    Show answer and explanation
    Correct answer: A

    The management interface serves the web console over HTTPS. Data interfaces, a boot-only console and the HA link are not used for routine web administration.

  2. Question 17

    What is the purpose of a candidate configuration on PAN-OS?

    1. ATo define the default policy applied to traffic that matches no rule in the firewall's security rule base
    2. BTo store a backup of the running configuration in a separate partition that the firewall restores automatically at boot
    3. CTo hold pending changes that take effect only after the administrator commits them to the running configuration
    4. DTo list the candidate firewalls that may join a high availability pair with the current device
    Show answer and explanation
    Correct answer: C

    The candidate configuration holds pending changes until they are committed. The other options describe backups, default policies and HA pairing, which are different features.

  3. Question 18

    Which Panorama feature pushes a common configuration to many managed firewalls?

    1. AThe URL filtering database, which downloads new category definitions to each firewall in the estate daily
    2. BLog forwarding profiles, which send traffic logs from each firewall to an external syslog server only
    3. CThe dynamic address group, which lists the IP addresses of the firewalls currently online in the network
    4. DDevice groups and templates, which push shared policies and network settings to selected firewalls
    Show answer and explanation
    Correct answer: D

    Device groups and templates push shared policies and network settings. Log forwarding, dynamic address groups and URL databases do different jobs.

NAT (3 questions)

  1. Question 19

    What is the difference between source NAT and destination NAT?

    1. ASource NAT changes the source address of outbound traffic, while destination NAT changes the destination address of inbound traffic
    2. BSource NAT changes the destination port of traffic, while destination NAT changes the source port of traffic
    3. CSource NAT and destination NAT both change only the protocol of the packet, and neither changes any address field
    4. DSource NAT blocks traffic and destination NAT allows it, with no change made to any address in the packet at all
    Show answer and explanation
    Correct answer: A

    Source NAT changes the source address, typically for outbound traffic, while destination NAT changes the destination address, typically for inbound services. The other options misstate what each changes.

  2. Question 20

    Which NAT type maps many internal addresses to one public address using different ports?

    1. ANo NAT, which keeps the private addresses on the internet side so that they are reachable from the public network
    2. BStatic NAT, which maps one internal address to one public address on a permanent one-to-one basis
    3. CDestination NAT only, which changes the destination of inbound traffic and does not translate outbound source addresses
    4. DDynamic IP and port NAT, which translates many internal addresses to one address with different source ports
    Show answer and explanation
    Correct answer: D

    Dynamic IP and port NAT maps many internal addresses onto one address using ports. Static, destination-only and no NAT do not do many-to-one port translation.

  3. Question 21

    Why must a NAT policy match the security policy that allows the same traffic?

    1. ABecause the security policy is evaluated only on the public address, and the NAT policy is evaluated on the internal address
    2. BBecause NAT policies are never evaluated at all, so the security policy must carry the translation itself
    3. CBecause the security policy evaluates the post-NAT addresses for the matching criteria in each session
    4. DBecause NAT and security policies are stored in the same file, so they must be written with identical rule names each time
    Show answer and explanation
    Correct answer: C

    Security policies match on the translated addresses where NAT applies, so the rules must align. The other statements misdescribe the evaluation order and storage.

High Availability (3 questions)

  1. Question 22

    Which high availability mode runs two firewalls so that one can take over if the other fails?

    1. AActive/passive HA, where a passive peer takes over when the active peer fails
    2. BTwo independent firewalls with no synchronisation, each handling different users with no failover between them at all
    3. CA single firewall with a second power supply only, which provides hardware redundancy but no failover of the policy
    4. DA load balancer in front of two firewalls that shares no configuration, state or failover logic at all
    Show answer and explanation
    Correct answer: A

    Active/passive HA lets a passive peer take over on failure. The other options describe no failover, power-only redundancy or unsynchronised balancing.

  2. Question 23

    What is the purpose of the HA control link between two PAN-OS firewalls?

    1. ATo serve the administrator's web console for both firewalls at the same time from a single management address
    2. BTo carry user traffic from the internal network to the internet during the normal working day of the company
    3. CTo synchronise the configuration and state information and exchange heartbeats between peers
    4. DTo connect the firewalls to the internet service provider's router so that they can share one public address
    Show answer and explanation
    Correct answer: C

    The HA control link synchronises configuration and state and exchanges heartbeats. It does not carry user traffic, serve consoles or connect to the ISP.

  3. Question 24

    What is a failover trigger that causes a PAN-OS HA peer to take over?

    1. AThe administrator viewing the logs on the web console for the active firewall during a routine review of the day's events
    2. BA change in the colour of the status light on the front panel of the active firewall during its normal operation
    3. CLoss of heartbeats or monitored link or path failure on the active peer
    4. DA routine commit of the candidate configuration, which always forces a failover on both peers at the same moment
    Show answer and explanation
    Correct answer: C

    Heartbeat loss and monitored path failures trigger failover. Status lights, log viewing and routine commits do not trigger it.

GlobalProtect and VPN (3 questions)

  1. Question 25

    What is GlobalProtect used for on a PAN-OS firewall?

    1. AProviding secure remote access for users, with VPN connectivity and policy enforcement on endpoints
    2. BProviding a public website hosting service for the company's marketing team on the firewall's own storage
    3. CProviding time synchronisation for the firewall's internal clock across the network so that logs match
    4. DProviding a database for the user's personal files on the firewall so that the files are backed up automatically
    Show answer and explanation
    Correct answer: A

    GlobalProtect provides secure remote access with VPN and endpoint policy enforcement. Web hosting, time synchronisation and file storage are not its purpose.

  2. Question 26

    Which element of a GlobalProtect deployment provides the connection and configuration to the client?

    1. AThe NAT rule, which translates the client's private address to a public address for each outbound session
    2. BThe antivirus profile, which scans files that the client downloads from the internet after the connection
    3. CThe portal, which delivers configuration to the client and the gateway list
    4. DThe schedule object, which defines when the client may connect to the network during the day or night
    Show answer and explanation
    Correct answer: C

    The GlobalProtect portal delivers configuration and the gateway list to clients. Antivirus, NAT and schedules are different features.

  3. Question 27

    What does a GlobalProtect gateway do?

    1. AIt replaces the firewall's management interface so that administrators connect through the VPN in every case
    2. BIt stores the user's password in plain text so that the client can reconnect without signing in again
    3. CIt terminates VPN tunnels from clients and applies security policies to their traffic
    4. DIt blocks all VPN connections by default, so that remote clients must use a separate application to reach the network
    Show answer and explanation
    Correct answer: C

    A GlobalProtect gateway terminates VPN tunnels and applies policy. The other options describe insecure storage, management replacement and blanket blocking.

Panorama and Management (3 questions)

  1. Question 28

    What is the role of Panorama in a PAN-OS deployment?

    1. ATo act as the firewall for the internet traffic of the whole company, replacing the physical firewalls at the edge
    2. BTo centrally manage, configure and monitor many firewalls from one console
    3. CTo provide the internet connection to the firewalls, which the firewalls cannot obtain from their own interfaces
    4. DTo store the users' personal files on a shared drive for the company's staff in every office across the region
    Show answer and explanation
    Correct answer: B

    Panorama centrally manages, configures and monitors many firewalls. It is not a replacement firewall, an ISP connection or a file store.

  2. Question 29

    What does a Panorama template define that is shared across firewalls?

    1. AThe list of employees who may sign in to each firewall's web console, kept by the human resources team
    2. BThe colours and logos of each firewall's login page, which are set for each individual device by the owner
    3. CThe schedule for the physical maintenance of each firewall by the datacentre staff in the building
    4. DNetwork settings such as interfaces, zones and virtual routers that a group of firewalls share
    Show answer and explanation
    Correct answer: D

    Templates define shared network settings such as interfaces, zones and routers. Cosmetic settings, maintenance schedules and staff lists are not template contents.

  3. Question 30

    What does a Panorama device group allow an administrator to do?

    1. AJoin the firewalls into one physical cluster that shares a single set of interfaces and power supplies
    2. BApply shared security policies and objects to the firewalls assigned to the group
    3. CDelete the local policies on each firewall so that only the central policy remains active for the team
    4. DAssign the firewalls to the internet service providers in the region so that each one has its own uplink
    Show answer and explanation
    Correct answer: B

    A device group applies shared policies and objects to assigned firewalls. The other options describe physical clustering, deletion and ISP assignment.