Pass PCNSE Exam Latest Practice Questions Updated on Sep 06, 2025 [Q30-Q47]

Rate this post

Pass PCNSE Exam Latest Practice Questions Updated on Sep 06, 2025

Palo Alto Networks PCNSE Study Guide Archives

Palo Alto Networks PCNSE (Palo Alto Networks Certified Security Engineer) certification exam is a highly sought-after certification for IT security professionals. Palo Alto Networks Certified Network Security Engineer Exam certification is designed to validate the skills and knowledge required to deploy, manage and troubleshoot Palo Alto Networks next-generation firewalls in a real-world environment. Palo Alto Networks Certified Network Security Engineer Exam certification targets individuals who are responsible for deploying and managing Palo Alto Networks firewalls, including security administrators, network engineers, and support staff.

Q30. Refer to the exhibit.

Which certificates can be used as a Forward Trust certificate?

Certificate from Default Trust Certificate Authorities

Domain Sub-CA

Forward_Trust

Domain-Root-Cert

Q31. An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing.
The administrator generates three encrypted BitTorrent connections and checks the Traffic logs.
There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL.
Which action will stop the second and subsequent encrypted BitTorrent connections from being allowed as SSL?

Create a decryption rule matching the encrypted BitTorrent traffic with action “No- Decrypt,” and place the rule at the top of the Decryption policy.

Create a Security policy rule that matches application “encrypted BitTorrent” and place the rule at the top of the Security policy.

Disable the exclude cache option for the firewall.

Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.

Q32. A customer wants to combine multiple Ethernet interfaces into a single virtual interface using link aggregation.
Which two formats are correct for naming aggregate interfaces? (Choose two.)

ae.8

aggregate.1

ae.1

aggregate.8

Q33. Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two)

Dos Protection policy

QoS Profile

Zone Protection Profile

DoS Protection Profile

Explanation
Flood Attack Protection
Zone Protection Profiles protect against of five types of floods:
* SYN (TCP)
* UDP
* ICMP
* ICMPv6
* Other IP

Q34. A firewall engineer creates a new App-ID report under Monitor > Reports > Application Reports > New Applications to monitor new applications on the network and better assess any Security policy updates the engineer might want to make.
How does the firewall identify the New App-ID characteristic?

It matches to the New App-IDs downloaded in the last 90 days.

It matches to the New App-IDs in the most recently installed content releases.

It matches to the New App-IDs downloaded in the last 30 days.

It matches to the New App-IDs installed since the last time the firewall was rebooted.

The New App-ID characteristic enables the firewall to monitor new applications on the network, so that the engineer can better assess the security policy updates they might want to make. The New App-ID characteristic always matches to only the new App-IDs in the most recently installed content releases. When a new content release is installed, the New App-ID characteristic automatically begins to match only to the new App-IDs in that content release version. This way, the engineer can see how the newly-categorized applications might impact security policy enforcement and make any necessary adjustments. Reference: Monitor New App-IDs

Q35. Where can an administrator see both the management-plane and data-plane CPU utilization in the WebUI?

System Resources widget

System Logs widget

Session Browser

General Information widget

Explanation
The System Resources widget of the Exadata WebUI, displays a real-time overview of the various resources like CPU, Memory, and I/O usage across the entire Exadata Database Machine. It shows the usage of both management-plane and data-plane CPU utilization.
System Resources Widget Displays the Management CPU usage, Data Plane usage, and the Session Count (the number of sessions established through the firewall or Panorama).https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/dashboard/dashboard-widge

Q36. A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections. Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)

Application Override policy.

Security policy to identify the custom application.

Custom application.

Custom Service object.

Best way – to create custom app. Alternatively you can create application override for fast path:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/manage-custom-or- unknown-applications Create a Custom Application with a signature and attach it to a security policy, or create a custom application and define an application override policy.

Q37. A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server.
Which solution in PAN-OS® software would help in this case?

application override

Virtual Wire mode

content inspection

redistribution of user mappings

Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/deploy-user-id-in- a-large-scale-network

Q38. Refer to Exhibit:

An administrator can not see any Traffic logs from the Palo Alto Networks NGFW in Panorama reports.
The configuration problem seems to be on the firewall.
Which settings, if configured incorrectly, most likely would stop only Traffic logs from being sent from the NGFW to Panorama?

Q39. An engineer is planning an SSL decryption implementation
Which of the following statements is a best practice for SSL decryption?

Obtain an enterprise CA-signed certificate for the Forward Trust certificate

Obtain a certificate from a publicly trusted root CA for the Forward Trust certificate

Use an enterprise CA-signed certificate for the Forward Untrust certificate

Use the same Forward Trust certificate on all firewalls in the network

Q40. What are three valid actions in a File Blocking Profile? (Choose three)

Forward

Block

Alret

Upload

Reset-both

Continue

You can configure a file blocking profile with the following actions:
Forward – When the specified file type is detected, the file is sent to WildFire for analysis. A log

is also generated in the data filtering log.
Block – When the specified file type is detected, the file is blocked and a customizable block

page is presented to the user. A log is also generated in the data filtering log.
Alert – When the specified file type is detected, a log is generated in the data filtering log.

Continue – When the specified file type is detected, a customizable response page is presented

to the user. The user can click through the page to download the file. A log is also generated in the data filtering log. Because this type of forwarding action requires user interaction, it is only applicable for web traffic.
Continue-and-forward – When the specified file type is detected, a customizable continuation

page is presented to the user. The user can click through the page to download the file. If the user clicks through the continue page to download the file, the file is sent to WildFire for analysis.
A log is also generated in the data filtering log.
https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/policy/file-blocking- profiles.html

Q41. In which two scenarios is it necessary to use Proxy IDs when configuring site-to-site VPN tunnels? (Choose two.)

Remote device is a non-Palo Alto Networks firewall.

The remote device is a Palo Alto Networks firewall.

Firewalls that only support policy-based VPNs.

Firewalls that only support route-based VPNs.

Q42. A network administrator wants to deploy GlobalProtect with pre-logon for Windows 10 endpoints and follow Palo Alto Networks best practices.
To install the certificate and key for an endpoint, which three components are required? (Choose three.)

server certificate

local computer store

private key

self-signed certificate

machine certificate

Q43. To connect the Palo Alto Networks firewall to AutoFocus, which setting must be enabled?

Device>Setup>Services>AutoFocus

Device> Setup>Management >AutoFocus

AutoFocus is enabled by default on the Palo Alto Networks NGFW

Device>Setup>WildFire>AutoFocus

Device>Setup> Management> Logging and Reporting Settings

Explanation/Reference:
Reference: https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/getting-started/enable- autofocus-threat-intelligence

Q44. A customer has an application that is being identified as unknown-tcp for one of their custom PostgreSQL
database connections.
Which two configuration options can be used to correctly categorize their custom database application?
(Choose two.)

Application Override policy.

Security policy to identify the custom application.

Custom application.

Custom Service object.

Q45. A network administrator notices a false-positive state after enabling Security profiles. When the administrator checks the threat prevention logs, the related signature displays the following:
threat type: spyware category: dns-c2 threat ID: 1000011111
Which set of steps should the administrator take to configure an exception for this signature?

Navigate to Objects > Security Profiles > Anti-Spyware Select related profile Select DNS exceptions tabs Search related threat ID and click enable Commit

Navigate to Objects > Security Profiles > Vulnerability Protection Select related profileSelect the signature exceptions tab and then click show all signatures Search related threat ID and click enable Change the default action Commit

Navigate to Objects > Security Profiles > Vulnerability ProtectionSelect related profileSelect the Exceptions lab and then click show all signaturesSearch related threat ID and click enableCommit

Navigate to Objects > Security Profiles > Anti-SpywareSelect related profileSelect the Exceptions lab and then click show all signaturesSearch related threat ID and click enable Commit

When dealing with a false positive, particularly for a spyware threat detected through DNS queries (as indicated by the category “dns-c2”), the correct course of action involves creating an exception in the Anti- Spyware profile, not the Vulnerability Protection profile. This is because the Anti-Spyware profile in Palo Alto Networks firewalls is designed to detect and block spyware threats, which can include command and control (C2) activities often signaled by DNS queries.
The steps to configure an exception for this specific spyware signature (threat ID: 1000011111) are as follows:
* Navigate to Objects > Security Profiles > Anti-Spyware. This is where all the Anti-Spyware profiles are listed.
* Select the related Anti-Spyware profile that is currently applied to the security policy which is generating the false positive.
* Within the profile, go to the DNS Exceptions tab. This tab allows you to specify exceptions based on DNS signatures.
* Search for the related threat ID (in this case, 1000011111) and click enable to create an exception for it.
By doing this, you instruct the firewall to bypass the detection for this specific signature, effectively treating it as a false positive.
* Commit the changes to make the exception active.
By following these steps, the administrator can effectively address the false positive without disabling the overall spyware protection capabilities of the firewall.

Q46. The administrator has enabled BGP on a virtual router on the Palo Alto Networks NGFW, but new routes do not seem to be populating the virtual router.
Which two options would help the administrator troubleshoot this issue? (Choose two.)

View the System logs and look for the error messages about BGP.

Perform a traffic pcap on the NGFW to see any BGP problems.

View the Runtime Stats and look for problems with BGP configuration.

View the ACC tab to isolate routing issues.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/network/network- virtual-routers/more-runtime-stats-for-a-virtual-router/bgp-tab.html
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEWCA0

Q47. Place the steps in the WildFire process workflow in their correct order.