Palo Alto PCNSE - Network Security Engineer - Advanced PAN-OS HA Panorama Decryption Routing Troubleshooting

By Chris Weber · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged2,344
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.5 (41)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A Palo Alto Networks engineer is designing a High Availability (HA) deployment for a pair of PA-5220 firewalls. The design requires that during a failover, the secondary firewall takes over without TCP sessions being dropped. Which HA configuration is required, and what are the prerequisites?

Answer choices

  • A. Active/Passive HA with Session Synchronization enabled; requires dedicated HA1 (control) and HA2 (data) links

  • B. Active/Active HA with VSYS load sharing; requires identical hardware and synchronization links

  • C. Active/Passive HA without session synchronization; requires only HA1 control link

  • D. Cluster HA with three nodes for session redundancy

Question 2

A security architect is designing a deployment where PAN-OS must inspect DNS traffic flowing through the firewall. An attacker is using DNS tunneling to exfiltrate data. Which PAN-OS features, when combined, provide comprehensive DNS threat detection and prevention?

Answer choices

  • A. URL Filtering with a custom block list of DNS server IP addresses

  • B. Anti-Spyware Profile with DNS Security enabled (detects DNS tunneling, C2 via DNS, DGA domains) combined with DNS Sinkholing configuration

  • C. Application Override to force DNS traffic classification

  • D. File Blocking Profile to block DNS zone transfer files

Question 3

An engineer is implementing QoS (Quality of Service) on a Palo Alto firewall to prioritize VoIP traffic over general web browsing. What are the two components required for QoS configuration?

Answer choices

  • A. QoS Profile and QoS Policy (matching criteria and profile assignment)

  • B. DoS Protection Profile and Security Profile Group with QoS settings

  • C. Traffic Shaping profile in the Network interface settings and a separate bandwidth limit

  • D. Only a QoS Profile is needed; it automatically applies based on application identification

Question 4

A Palo Alto PCNSE engineer is troubleshooting an SSL Forward Proxy decryption issue. HTTPS connections to a specific banking website are failing with certificate errors even though SSL decryption is configured. SSL decryption is working for all other HTTPS sites. What is the most likely cause?

Answer choices

  • A. The banking site uses certificate pinning or HSTS preloading, and the SSL decryption profile has "Certificate Error" handling set to block

  • B. The firewall CA certificate has expired

  • C. The banking site uses TLS 1.3 which is not supported by PAN-OS

  • D. The URL category for banking is in the SSL Decryption Exclusion list

Question 5

A PCNSE candidate is asked to explain how PAN-OS handles traffic when both Security Policy rules AND NAT policy rules exist. A packet arrives from 10.0.0.100 destined for 203.0.113.50, which NATs to 172.16.0.10. The Security Policy must allow this traffic. How should the Security Policy rule's destination be specified?

Answer choices

  • A. Destination: 172.16.0.10 (the post-NAT/translated IP address)

  • B. Destination: 203.0.113.50 (the pre-NAT/original destination IP address)

  • C. Destination: any (to avoid NAT/policy interaction issues)

  • D. Two rules are needed: one for pre-NAT and one for post-NAT processing