I85PREP
⌘ K
PCNSE study materials
PCNSE study resources

PCNSE practice questions

One question at a time. Build your PCNSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Plan (architecture, design, and deployment planning)

A security team must inspect traffic inline between two routers without changing IP addressing, routing, or MAC learning behavior. Which deployment mode should be planned?

  1. Layer 2
  2. TAP
  3. Layer 3
  4. Virtual wire Correct answer.

Explanation

Virtual wire binds two interfaces into a transparent pair; the firewall forwards frames without IP addressing, routing, or MAC learning. Security policy and App-ID still apply to the inspected traffic.

Question 2Plan (architecture, design, and deployment planning)

Two firewalls in an active/passive HA pair boot at the same time. Peer A has device priority 100 and peer B has priority 150; preemption is disabled. Which peer becomes active?

  1. Peer A, because lower priority wins Correct answer.
  2. Peer B, because higher priority wins
  3. The peer with the lower HA1 MAC
  4. The peer with the higher HA1 MAC

Explanation

HA election prefers the lower numeric device priority. The HA1 MAC address is used only as a tie-break when priorities are equal.

Question 3Plan (architecture, design, and deployment planning)

Which Panorama component is used to push network settings such as interfaces, zones, and virtual routers to managed firewalls?

  1. Security policy rulebase
  2. Log collector group
  3. Template stack Correct answer.
  4. Device group

Explanation

Templates and template stacks contain network and device configuration; device groups contain policy and objects. Panorama pushes template stack configuration to firewalls in the stack.

Question 4Plan (architecture, design, and deployment planning)

A team wants to evaluate threat signatures against a copy of switch traffic and must guarantee that the firewall cannot block any packet. Which interface type should be selected?

  1. TAP Correct answer.
  2. Layer 3
  3. Virtual wire
  4. Layer 2

Explanation

A TAP interface receives mirrored traffic and never forwards it, so the firewall can log and alert but cannot block. Inline modes such as Layer 3, Layer 2, and virtual wire can drop traffic.

Question 5Plan (architecture, design, and deployment planning)

By default, what action does a Palo Alto Networks firewall take for traffic that matches no security policy rule?

  1. Allow intrazone
  2. Allow only known applications
  3. Allow interzone
  4. Deny Correct answer.

Explanation

Security policy is evaluated top-down, and an implicit default deny rule drops traffic that matches no explicit rule. Intrazone and interzone defaults are not allow-all.

Question 6Plan (architecture, design, and deployment planning)

Which HA link synchronizes sessions and forwarding tables between HA peers?

  1. HA3
  2. Management
  3. HA1
  4. HA2 Correct answer.

Explanation

HA1 carries control and hello messages, while HA2 carries session and forwarding state synchronization. HA3 is used for packet forwarding in some active/active designs.

Question 7Plan (architecture, design, and deployment planning)

Which statement about virtual systems (vsys) on a supported firewall is correct?

  1. Each vsys requires a dedicated management IP address
  2. Each vsys has independent policy and objects Correct answer.
  3. Every PA-200 series model supports vsys
  4. Two vsys can share one virtual router instance

Explanation

A vsys is a separate virtual firewall instance with its own zones, policy, objects, and administrators. The management interface is shared, and vsys support depends on platform and license.

Question 8Plan (architecture, design, and deployment planning)

An engineer plans destination NAT to publish an internal web server on a public address. Which match condition identifies the original traffic before translation?

  1. Translated source address
  2. Original destination address Correct answer.
  3. Post-NAT destination address
  4. Source zone after NAT

Explanation

Destination NAT policies match the pre-NAT destination address and port, then translate them to the internal server. The security policy is then evaluated against the translated session.

Question 9Plan (architecture, design, and deployment planning)

Which technology identifies an application by its characteristics rather than by TCP or UDP port?

  1. Content-ID
  2. WildFire
  3. App-ID Correct answer.
  4. User-ID

Explanation

App-ID classifies applications using signatures, protocol decoding, and behavioral heuristics, independent of port. Content-ID handles content scanning, User-ID maps users, and WildFire analyzes files.

Question 10Plan (architecture, design, and deployment planning)

In SSL forward proxy, which certificate does the firewall use to sign the certificates it presents to internal clients?

  1. Forward trust certificate Correct answer.
  2. Root CA certificate of the destination server
  3. User-ID certificate
  4. Forward untrust certificate

Explanation

The forward trust certificate is used to re-sign server certificates presented to clients; clients must trust its CA. The forward untrust certificate is used for sites the firewall cannot verify.

Question 11Plan (architecture, design, and deployment planning)

Which PAN-OS feature chooses an outbound path based on measured latency, jitter, and packet loss?

  1. NAT policy
  2. SD-WAN policy Correct answer.
  3. Zone protection profile
  4. QoS policy

Explanation

SD-WAN policies use path quality measurements to steer traffic across multiple links. QoS shapes traffic, zone protection defends the firewall, and NAT translates addresses.

Question 12Plan (architecture, design, and deployment planning)

Which platform characteristic most directly limits the number of concurrent sessions a firewall can maintain?

  1. Number of HA links
  2. Session table size Correct answer.
  3. Management CPU speed
  4. Support license level

Explanation

Concurrent session capacity is a data plane limit determined by the model's session table and memory. Management CPU and HA links do not set the session ceiling.

Question 13Plan (architecture, design, and deployment planning)

What is required for a Palo Alto Networks firewall to advertise routes to an upstream router using OSPF?

  1. Enable OSPF on the virtual router Correct answer.
  2. Create a source NAT policy
  3. Enable OSPF in a zone protection profile
  4. Create a policy-based forwarding rule

Explanation

OSPF is configured within a virtual router and enabled on the participating interfaces. Zone protection, NAT, and PBF do not advertise routes.

Question 14Plan (architecture, design, and deployment planning)

In a Panorama device group hierarchy, whose security rules are evaluated first?

  1. Parent device group rules Correct answer.
  2. Post-rules
  3. Local firewall rules
  4. Child device group rules

Explanation

Panorama evaluates pre-rules from the parent device group before rules from child device groups. Local rules follow device group rules, and post-rules are evaluated last.

Question 15Plan (architecture, design, and deployment planning)

Which HA configuration allows both firewalls to process sessions at the same time?

  1. Standby
  2. TAP
  3. Active/active Correct answer.
  4. Active/passive

Explanation

Active/active HA lets both peers forward traffic and synchronizes sessions between them. Active/passive keeps one peer in standby.

Question 16Plan (architecture, design, and deployment planning)

Users connect by RDP to a shared terminal server, and the firewall must map those sessions to individual users. Which User-ID method is designed for this?

  1. User-ID agent on the domain controller
  2. Captive portal
  3. Syslog listener
  4. Terminal Server Agent Correct answer.

Explanation

The Terminal Server Agent runs on the terminal server and reports which user owns each session. A domain controller agent maps logons to IPs but cannot distinguish users sharing one server IP.

Question 17Plan (architecture, design, and deployment planning)

Which profile is designed to protect the firewall from flood and reconnaissance attacks?

  1. Decryption profile
  2. URL filtering profile
  3. Zone protection profile Correct answer.
  4. Vulnerability protection profile

Explanation

Zone protection profiles apply flood, reconnaissance, and packet-based defenses at the ingress zone. Vulnerability protection inspects threats in allowed traffic.

Question 18Plan (architecture, design, and deployment planning)

In Prisma Access, which configuration connects a branch office network to the service?

  1. Remote network Correct answer.
  2. Compute location
  3. Service connection
  4. Mobile user license

Explanation

A remote network defines an IPSec connection from a branch to Prisma Access. A service connection links Prisma Access to customer data centers or headquarters.

Question 19Plan (architecture, design, and deployment planning)

Which rule-ordering practice is recommended when designing a security policy rulebase?

  1. Order rules alphabetically by application
  2. Place deny rules only at the bottom
  3. Place specific rules first Correct answer.
  4. Place broad allow rules at the top

Explanation

Because rules are evaluated top-down and stop at the first match, specific rules should precede broad rules. This prevents a general allow from shadowing a narrower rule.

Question 20Plan (architecture, design, and deployment planning)

In an active/active HA pair using two virtual routers, which link forwards packets between the peers?

  1. HA3 Correct answer.
  2. Management
  3. HA2
  4. HA1

Explanation

HA3 provides packet forwarding between active/active peers when separate virtual routers are used. HA1 carries control traffic and HA2 carries state synchronization.

Question 21Plan (architecture, design, and deployment planning)

Which statement about active/active HA with per-session load distribution is correct?

  1. A single flow is processed by one peer Correct answer.
  2. A single flow can use both peers' combined throughput
  3. Session state is not synchronized between peers
  4. Both peers must use identical device priorities

Explanation

Active/active distributes separate sessions across peers; a single session is processed by one firewall and does not aggregate bandwidth. Session state is still synchronized so failover can preserve flows.

Question 22Plan (architecture, design, and deployment planning)

Which traffic is most appropriate to exclude from SSL forward proxy decryption?

  1. DNS queries
  2. All HTTP traffic
  3. SMTP traffic
  4. Applications that use certificate pinning Correct answer.

Explanation

Certificate-pinned applications expect the original server certificate and can break when re-signed. They are commonly placed in decryption exclusion rules; HTTP, DNS, and SMTP are not SSL/TLS sessions to decrypt.

Question 23Plan (architecture, design, and deployment planning)

An active/passive HA pair has preemption enabled. The active peer has priority 200, and the passive peer has priority 100. What happens after the passive peer becomes eligible?

  1. The passive peer remains passive until a failure
  2. The active peer stays active because preemption is disabled
  3. The passive peer preempts and becomes active Correct answer.
  4. Both peers become active

Explanation

With preemption enabled, a peer with a lower priority value takes over as active after the promotion hold time. Priority 100 is preferred over 200.

Question 24Plan (architecture, design, and deployment planning)

A firewall is deployed in TAP mode. Which enforcement action can it take on malicious traffic?

  1. Reset the offending session
  2. Drop the packet inline
  3. Log and alert but not block Correct answer.
  4. Block the flow with a security policy

Explanation

TAP mode only receives mirrored copies, so the firewall can log and alert but cannot affect the original flow. Blocking requires an inline mode such as Layer 3, Layer 2, or virtual wire.

Question 25Plan (architecture, design, and deployment planning)

Which measurement best estimates data plane load for sizing a firewall that will run App-ID and threat prevention?

  1. Raw interface line rate only
  2. Number of management sessions
  3. Number of configured security zones
  4. Peak throughput with profiles enabled Correct answer.

Explanation

Security processing reduces throughput, so sizing must use expected peak traffic with the actual profiles enabled. Line rate alone overestimates capacity, and management sessions do not measure data plane load.

Question 26Plan (architecture, design, and deployment planning)

An engineer must insert a firewall inline between two existing routers without readdressing the network or modifying the routers' routing tables. Which deployment mode satisfies this requirement?

  1. TAP mode with a monitoring profile
  2. Active/active HA using two virtual routers
  3. Layer 3 with routed subinterfaces
  4. Virtual wire Correct answer.

Explanation

A virtual wire binds two interfaces into a transparent pair that forwards frames without an IP address, routing table, or switching decision, so the surrounding routers keep their existing addressing and routes. The firewall still applies security policy and profiles to the inspected traffic.

Question 27Plan (architecture, design, and deployment planning)

Which statement about the dedicated management (MGT) interface on a PA-Series firewall is correct?

  1. It must be placed in a security zone before administrators can connect to it.
  2. It may be used to forward user data traffic between security zones.
  3. It requires a destination NAT rule so the firewall can reach update servers.
  4. Its traffic is handled by the management plane and is not evaluated by data-plane security policy. Correct answer.

Explanation

The MGT interface is an out-of-band port served by the management plane; administrative access is controlled by permitted IP addresses and allowed services on the interface rather than by Security policy rules. Security zones and Security policy apply to data-plane interfaces only.

Question 28Plan (architecture, design, and deployment planning)

A firewall will perform SSL inbound inspection for a public-facing web server. What must be present on the firewall for this to work?

  1. A client certificate issued by the internal root CA
  2. A forward trust CA certificate and its private key
  3. The web server's certificate and its private key Correct answer.
  4. A forward untrust CA certificate

Explanation

Inbound inspection terminates the client-side TLS session at the firewall, so the firewall must hold the web server's certificate and private key to present that identity to external clients and then re-encrypt the connection to the real server. Forward proxy certificates belong to the outbound decryption design.

Question 29Plan (architecture, design, and deployment planning)

In a GlobalProtect deployment, which function is performed by the gateway rather than the portal?

  1. Delivering the GlobalProtect agent installer to endpoints
  2. Authenticating the user's first connection to the service
  3. Enforcing security policy and HIP checks on tunneled traffic Correct answer.
  4. Supplying the agent with the initial list of gateways

Explanation

The portal handles client distribution, client configuration, and gateway discovery, while the gateway terminates the tunnels and is the enforcement point where Security policy, HIP checks, and decryption apply to endpoint traffic.

Question 30Plan (architecture, design, and deployment planning)

An organization has 2,000 internal hosts but has been allocated only eight public IPv4 addresses for internet access. Which NAT design meets this requirement?

  1. Destination NAT with the bi-directional option enabled
  2. Dynamic IP translation without port translation
  3. Static IP translation with one-to-one address mappings
  4. Dynamic IP and port translation using the eight-address pool Correct answer.

Explanation

Dynamic IP and port translation also rewrites the source port, so thousands of internal hosts can share a small public pool; capacity is bounded by the number of ports usable per translated address rather than by the number of addresses.

Question 31Deploy and Configure

What is the default IPv4 address configured on the management (MGT) interface of a new Palo Alto Networks hardware firewall?

  1. 192.168.0.1/24
  2. 10.0.0.1/24
  3. 192.168.1.1/24 Correct answer.
  4. 172.16.0.1/24

Explanation

New Palo Alto Networks hardware firewalls ship with the MGT interface addressed as 192.168.1.1/24 and the default admin account enabled. The other addresses are common private ranges but are not preconfigured.

Question 32Deploy and Configure

Which credentials are configured by default on a new Palo Alto Networks firewall?

  1. paloalto / admin
  2. admin / paloalto
  3. admin / admin Correct answer.
  4. admin / password

Explanation

The factory configuration includes the admin account with the password admin, and the administrator is prompted to change it at first login. The other pairs are not default credentials.

Question 33Deploy and Configure

What is the default action of the intrazone-default security policy rule?

  1. Drop
  2. Deny
  3. Reset client
  4. Allow Correct answer.

Explanation

The intrazone-default rule permits traffic between interfaces in the same zone, and it is read-only. Interzone traffic is governed by the separate interzone-default rule.

Question 34Deploy and Configure

The interzone-default security policy rule has which default action?

  1. Deny Correct answer.
  2. Reset client
  3. Drop
  4. Allow

Explanation

The interzone-default rule denies traffic between different zones by default and is read-only. Administrators must create explicit allow rules for interzone traffic.

Question 35Deploy and Configure

When multiple security policy rules match a session, which rule is applied?

  1. The most recently created rule
  2. The first matching rule from the top Correct answer.
  3. The rule with the most applications
  4. The rule with the highest hit count

Explanation

Security policies are evaluated from top to bottom, and the first rule whose match criteria are satisfied is applied to the session. Later rules are not evaluated once a match occurs.

Question 36Deploy and Configure

Which address does source NAT translate?

  1. Source address Correct answer.
  2. Service port
  3. Both source and destination
  4. Destination address

Explanation

Source NAT rewrites the source IP address, and optionally the source port, of packets leaving an interface. Destination NAT rewrites the destination address instead.

Question 37Deploy and Configure

Which security policy component identifies an application regardless of TCP or UDP port?

  1. Source zone
  2. Service object
  3. URL category
  4. Application filter Correct answer.

Explanation

App-ID identifies applications by their protocol behavior and payload signatures, so a security policy can match the application independent of the TCP or UDP port. Service objects match only port and protocol.

Question 38Deploy and Configure

Where is a Zone Protection profile applied?

  1. To a NAT rule
  2. To a virtual router
  3. To a security policy rule
  4. To a zone Correct answer.

Explanation

A Zone Protection profile is attached to a security zone and applies to traffic entering that zone. It is not applied directly to policy rules or virtual routers.

Question 39Deploy and Configure

Which configuration object is required to route traffic between Layer 3 subnets on a Palo Alto Networks firewall?

  1. Loopback interface
  2. VLAN interface
  3. Aggregate interface
  4. Virtual router Correct answer.

Explanation

A virtual router contains the routing table and the Layer 3 interfaces that perform forwarding. It is the object that routes between subnets, while VLAN, loopback, and aggregate interfaces serve other purposes.

Question 40Deploy and Configure

An administrator needs to publish an internal web server on a public IP address. Which NAT type is required?

  1. Destination NAT with dynamic IP and port
  2. Source NAT with dynamic IP and port
  3. Destination NAT with a static rule Correct answer.
  4. Source NAT with a fixed port

Explanation

Publishing an internal server on a public address requires destination NAT so that the firewall translates the public destination IP to the server's private IP. A static destination NAT rule is typical for inbound access.

Question 41Deploy and Configure

Policy-based forwarding is used to send traffic from a specific source subnet to a dedicated ISP. Which configuration is required?

  1. A PBF policy with source and next-hop Correct answer.
  2. A static route with a lower metric value
  3. A NAT rule that matches the source address
  4. A QoS policy with a guaranteed class

Explanation

Policy-based forwarding overrides the virtual router's routing table for matching traffic and sends it to a specified next hop or interface. A PBF policy therefore needs match criteria and a forwarding action.

Question 42Deploy and Configure

In an active/passive HA pair, which interface is used for state synchronization?

  1. HA3
  2. MGT
  3. HA2 Correct answer.
  4. HA1

Explanation

In HA, HA1 carries control and hello messages, while HA2 carries session state synchronization. HA2 must be configured for session state to sync between peers.

Question 43Deploy and Configure

Which Panorama object type is used to push device-specific configuration such as interface settings to firewalls?

  1. Template Correct answer.
  2. Device group
  3. Security profile group
  4. Log collector group

Explanation

Panorama templates contain device and network settings, such as interface and virtual router configuration, that are pushed to managed firewalls. Device groups contain policy objects and rules instead.

Question 44Deploy and Configure

Which action must be configured in a security policy rule to enforce a policy based on user or group?

  1. Create a URL filtering profile
  2. Enable SSL decryption on the rule
  3. Source User field contains the group Correct answer.
  4. Set the source zone to the Trust zone

Explanation

User-ID maps IP addresses to users, and a security policy rule enforces user-based control when a user or group is specified in the Source User field. Zones, URL filtering, and decryption do not by themselves bind a rule to a user.

Question 45Deploy and Configure

Which decryption policy is used to inspect outbound SSL traffic to unknown sites?

  1. SSH proxy
  2. SSL forward proxy Correct answer.
  3. SSL tunnel
  4. SSL inbound inspection

Explanation

SSL forward proxy decrypts outbound client sessions to external sites, allowing the firewall to inspect the traffic. Inbound inspection is used for traffic destined to internal servers.

Question 46Deploy and Configure

Which setting controls how often a firewall checks for new content updates?

  1. Content update schedule Correct answer.
  2. Commit schedule
  3. Log forwarding profile
  4. Session timeout value

Explanation

The content update schedule defines when the firewall checks for and downloads new content releases. Commit schedules and log profiles do not control content updates.

Question 47Deploy and Configure

Which interface type can be configured to act as a DHCP server for a Layer 3 subnet?

  1. Layer 3 Correct answer.
  2. Virtual wire
  3. Layer 2
  4. Tap

Explanation

A Layer 3 interface can be configured with a DHCP server to assign addresses to clients on that subnet. Virtual wire, Layer 2, and tap interfaces do not provide DHCP server service for routed clients.

Question 48Deploy and Configure

Which feature allows the firewall to resolve DNS queries for clients on a Layer 3 interface?

  1. DNS proxy Correct answer.
  2. DHCP relay
  3. PPPoE client
  4. NAT64

Explanation

DNS proxy lets the firewall answer DNS queries from clients and forward them to configured DNS servers. DHCP relay and PPPoE are unrelated to DNS resolution.

Question 49Deploy and Configure

Which interface feature is used when an ISP requires a PPPoE login for WAN connectivity?

  1. DHCP client
  2. PPPoE client Correct answer.
  3. SLAAC
  4. PPP server

Explanation

A PPPoE client configuration on an interface supplies the ISP credentials and establishes the WAN session. A DHCP client is used when the ISP assigns addresses without PPPoE.

Question 50Deploy and Configure

Which object defines where logs are sent, such as to a syslog server or Panorama?

  1. Certificate profile
  2. Server profile
  3. Security profile group
  4. Log forwarding profile Correct answer.

Explanation

A log forwarding profile specifies destinations such as syslog servers, SNMP traps, email, or Panorama for the logs it is attached to. Server profiles define destination settings but not the forwarding match rules.