PCNSE Practice Questions

The primary purpose of the Bonjour Reflector on a Palo Alto Networks firewall is to forward Bonjour (mDNS) traffic across different subnets. In a "segmented network," devices are separated into different broadcast domains, which are Layer 3 boundaries. The Bonjour protocol itself is link-local and does not cross these boundaries. To enable service discovery between these segments, the firewall must act as a router and forward this traffic. This is achieved by enabling the Bonjour Reflector on the Layer 3 interfaces that serve as the gateways for each network segment, allowing them to relay the mDNS packets between subnets.

A. Virtual Wire interface: Virtual Wire interfaces operate at Layer 2 and do not have IP addresses or participate in routing, so they cannot forward traffic between Layer 3 segments.

B. Loopback interface: Loopback interfaces are logical interfaces used for services like routing protocol peering or management access, not for forwarding user traffic between physical network segments.

D. Layer 2 interface: While the reflector can be enabled on a Layer 2 interface, its function in that mode is to forward Bonjour traffic within the same VLAN, not across different segments.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure Bonjour Reflector". The guide states

"The Bonjour Reflector enables the firewall to forward Bonjour traffic across Layer 3 boundaries

which allows clients to discover services in different subnets." This directly links the feature's purpose to Layer 3 functionality.

2. Palo Alto Networks PAN-OS® Networking Administrator’s Guide 11.0

"Bonjour Reflector". This guide clarifies the function: "When you enable the Bonjour Reflector on a Layer 3 interface

the firewall forwards Bonjour traffic between all hosts connected to the Layer 3 interfaces that have the Bonjour Reflector enabled." This describes the exact scenario of connecting segmented networks.

3. Palo Alto Networks PAN-OS® Networking Administrator’s Guide 11.0

"Layer 2 Interfaces". The guide explains that Layer 2 interfaces switch traffic between ports within the same VLAN. This mode does not inherently route between different network segments

which is the core requirement of the question.

The most appropriate solution is to use the predefined "Device Group and Template Admin" role. This role is specifically designed to grant administrators the necessary permissions to manage policies and objects within the context of device groups and templates. To meet the compliance requirement of segregating access, the superuser would assign this role to each of the three contractor accounts and then configure the "Access Domain" for each account to specify the unique device group that the respective contractor is authorized to manage. This method directly addresses the scenario using a standard, purpose-built role, enforcing the principle of least privilege.

A. Create a Dynamic Read only superuser: This is incorrect because "read-only" permissions are insufficient for deploying policies, and "superuser" access is overly permissive and not restricted to specific device groups.

B. Create a Dynamic Admin with the Panorama Administrator role: The "Panorama Administrator" role provides excessive permissions. Furthermore, dynamic roles grant access based on tags, not the device group hierarchy as required by the scenario.

D. Create a Custom Panorama Admin: While a custom role could achieve this, the predefined "Device Group and Template Admin" role already exists for this exact purpose, making it the most direct and appropriate choice without unnecessary configuration.

1. Palo Alto Networks - Panorama Administrator's Guide 11.0

"Administrative Role Types": This document describes the predefined roles available in Panorama. It specifies the "Device Group and Template Admin" role as providing "Role-based access to device groups and templates. You can select specific device groups and templates." This directly aligns with the requirements of the question.

2. Palo Alto Networks - Panorama Administrator's Guide 11.0

"Configure an Administrator Account": This section details the process of creating an administrator. Step 6 involves selecting a role

and for role-based administrators

Step 7 is to "Define the access domain (the device groups

templates

and virtual systems the administrator can access)." This confirms that you can assign a role like "Device Group and Template Admin" and then restrict its scope to specific device groups for each administrator.

3. Palo Alto Networks - Panorama Administrator's Guide 11.0

"Role-Based Access Control": This section explains the concept of combining roles (which define what an admin can do) with access domains (which define where an admin can do it). The scenario is a classic example of applying an access domain to a role to limit administrative scope. The "Device Group and Template Admin" role is the appropriate role to which an access domain should be applied.

SSL Forward Proxy requires the firewall to be deployed inline to intercept, decrypt, and re-encrypt traffic. Layer 3, Layer 2, and Virtual Wire are all inline deployment modes that process transit traffic. Security policies, including Decryption policies, can be applied to traffic flowing through these interface types, allowing the firewall to act as the required man-in-the-middle for SSL Forward Proxy.

A. High availability (HA): HA interfaces are dedicated control links for state synchronization and heartbeat monitoring; they do not process user transit traffic and cannot apply decryption policies.

D. Tap: Tap interfaces receive a passive copy of traffic for monitoring. Because they are not inline, they cannot intercept or proxy traffic, which is a requirement for SSL Forward Proxy.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Decryption. "You can configure decryption for traffic that passes through Layer 2

Layer 3

virtual wire

and tunnel interfaces."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Interface Types. "The firewall supports the following interface types... Tap

HA

Decrypt Mirror

Log Card

Virtual Wire

Layer 2

Layer 3..."

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Tap Interfaces. "In a tap deployment

the firewall monitors traffic flowing across a network by using the switch SPAN or mirror port... The firewall cannot control the traffic flow in tap mode..."

4. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Virtual Wire Interfaces. "A virtual wire logically connects two firewall interfaces... This allows the firewall to be easily inserted into an existing topology... You can apply Security

QoS

and DoS Protection policy rules to traffic that traverses the virtual wire."

5. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Layer 2 Interfaces. "In a Layer 2 deployment

the firewall is installed transparently on a network segment... You can apply Security

QoS

and DoS Protection policy rules to the VLANs to which the Layer 2 interfaces are assigned."

To create Security policies in Panorama that reference Active Directory groups, Panorama must first be aware of those groups. Panorama itself does not directly query the directory server. Instead, you must designate a managed firewall as the "master device" for the device group. This master device is configured with Group Mapping settings to connect to the LDAP server (Active Directory). It retrieves the list of available groups and provides this list to Panorama. Panorama then uses this information to populate the user/group fields in the policy editor, allowing the administrator to build the rules.

A: A certificate profile is used to secure the LDAP connection (LDAPS) but is not the primary mechanism required for Panorama to obtain the list of groups for policy creation.

B: Group Mapping must be configured on the designated master device for the device group, not just any arbitrary firewall. The rules are created in the device group context.

C: User-ID Redistribution is for sharing learned IP-address-to-user mappings between firewalls and Panorama, not for retrieving the list of available directory groups for policy configuration.

1. Palo Alto Networks Panorama™ Administrator's Guide 10.2

Chapter: Centralized Logging and Reporting

Section: Configure a Master Device and Configure Group Mapping. "To use group-based policies

you must configure a Master Device for each device group that will use group-based policies. Panorama uses the master device to retrieve the list of groups from the LDAP server you specify in a group mapping configuration."

2. Palo Alto Networks User-ID™ Administrator's Guide 10.2

Chapter: Map Users to Groups

Section: Configure Group Mapping. This section details the process of configuring a firewall to connect to an LDAP directory to retrieve group information

which is the function performed by the master device on behalf of Panorama.

3. Palo Alto Networks Panorama™ Administrator's Guide 10.2

Chapter: Manage Firewalls

Section: User-ID Redistribution. "User-ID redistribution enables you to scale a User-ID deployment by allowing you to share user mapping information from one Palo Alto Networks firewall or Panorama to another." This confirms redistribution is for IP-user mappings

not group lists for policy creation.

According to PAN-OS documentation, the Advanced Routing Engine is a global firewall setting. It is enabled from Device > Setup > Management > General Settings by checking “Enable Advanced Routing Engine,” followed by a commit and firewall reboot. Only after this global toggle is on can individual virtual-router objects use the new engine. Therefore, option C is the only path that actually turns the feature on.

A. No “Advanced Routing” control exists under Device > Setup > Session; path is irrelevant.

B. Router-level “Forwarding Mode” appears only after the engine is enabled globally; it cannot enable the engine itself.

D. Redistribution Profiles control route-redistribution, not engine selection; path contains no such setting.

1. Palo Alto Networks

“Enable the Advanced Routing Engine

” PAN-OS 10.2 Administrator’s Guide

Routing chapter

step 1 (Device > Setup > Management > General Settings) – https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/route/advanced-routing/enable-advanced-routing-engine

2. Palo Alto Networks

“Advanced Routing Engine Overview

” PAN-OS 11.0 New Features Guide

section “Activate the Advanced Routing Engine

” bullets 1–2 (same GUI path and reboot requirement).

In a Panorama-managed environment where direct internet access is unavailable, the PAN-OS software image must first be manually uploaded to Panorama from a local host. The correct administrative path in the Panorama web interface to manage and deploy operating system software to managed firewalls is Panorama > Device Deployment > Software. From this section, an administrator can upload the pre-downloaded image file and then push it to the designated firewalls for installation. This process centralizes the upgrade for all managed devices without requiring them to have individual internet connectivity.

A: The Panorama > Software menu is used for managing and upgrading the PAN-OS software for the Panorama appliance itself, not for the managed firewalls.

B: The Dynamic Updates menu is for deploying content updates, such as application and threat signatures or antivirus definitions, not for PAN-OS system software images.

C: The Panorama > Dynamic Updates menu is incorrect for the same reason as option B; it is designated for content files, not the core operating system.

1. Palo Alto Networks Panorama Administrator's Guide 10.2: In the section "Install a PAN-OS Software Release

" the procedure for an offline environment is detailed. It states

"If Panorama does not have internet access

you must first download the software release from the Palo Alto Networks Customer Support Portal to your client system. Then

in Panorama

select Panorama > Device Deployment > Software and Upload the software to Panorama." This directly confirms the path in option D.

2. Palo Alto Networks Panorama Administrator's Guide 10.2: The section "Manage Software Upgrades for Firewalls" further clarifies the process: "Use Panorama to centrally manage software upgrades for the firewalls it manages... The workflow begins with retrieving the software from the Palo Alto Networks update server or by uploading it to Panorama. Then you can install the software on one or more firewalls." This distinguishes the Device Deployment > Software section's purpose from other menus.

3. Palo Alto Networks Panorama Administrator's Guide 10.2: The section "Manage Content and Software Updates for Panorama" describes the process for updating Panorama itself

which uses the Panorama > Software path

confirming why option A is incorrect as it applies to Panorama

not the managed firewalls.

Palo Alto Networks firewalls enhance administrative access security by supporting multi-factor authentication (MFA). This is accomplished through native configurations and integrations with external authentication servers. The firewall can be configured to require a user certificate (a "something you have" factor) in addition to a password. It also integrates with external MFA platforms via RADIUS or SAML. These platforms commonly provide authentication using one-time passwords (OTPs) generated by authenticator apps or hardware tokens, and SMS messages containing verification codes. These three methods—SMS, user certificate, and OTP—are all established mechanisms for implementing MFA for firewall administrators.

A. Voice: Voice biometrics are not a natively supported authentication method on the firewall. This would require integration with a third-party Identity Provider via SAML.

B. Fingerprint: Like voice, fingerprint biometrics are not directly processed by the firewall and would depend on an external authentication service, making it an indirect method.

1. Palo Alto Networks Documentation - Configure Multi-Factor Authentication: This document explicitly states

"To configure multi-factor authentication (MFA)

you must integrate the firewall with an MFA server

such as Okta or Duo

or with a generic RADIUS-based solution

such as RSA SecurID." These services are the typical providers for SMS (C) and One-time password (E) methods.

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Configure Multi-Factor Authentication".

2. Palo Alto Networks Documentation - Certificate-Based Administrator Authentication: This guide details the process for using client certificates for authenticating administrators to the web interface

confirming the validity of User certificate (D) as an authentication factor.

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Device > Certificate Management > Certificate Profile".

3. Palo Alto Networks Documentation - Authentication Policy: The documentation on Authentication Policy and Authentication Profiles shows how different methods are configured. It details creating RADIUS server profiles (used for OTP and SMS-based systems) and Certificate Profiles (for User certificates).

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Device > Authentication Profile".

Policy-Based Forwarding (PBF) allows administrators to create forwarding policies that override the firewall's route table. A primary use case is to route specific traffic, such as a high-bandwidth application like FTP, over a secondary or backup ISP link to preserve bandwidth on the primary link. Another key capability is providing resiliency; PBF rules can be configured with path monitoring. If the primary path becomes unavailable, the PBF rule can be disabled, allowing traffic to failover to a secondary path defined either in another PBF rule or in the main routing table, thus maintaining application connectivity.

C. Enabling the firewall to bypass Layer 7 inspection: This is incorrect. Security Policy rules, not PBF rules, determine the level of security inspection (including Layer 7 App-ID) applied to traffic. PBF only dictates the forwarding path.

D. Forwarding all traffic by using source port 78249 to a specific egress interface: This is incorrect. PBF rules match traffic based on criteria such as application or service (protocol and destination port), not the ephemeral source port of a session.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policy-Based Forwarding": "You can also use PBF to forward traffic to a specific egress interface or next-hop IP address when you have multiple ISP connections and you want to route traffic from a specific source or for a specific application over a connection that is not the preferred connection in your routing table." This directly supports option A.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policy-Based Forwarding": "To ensure that the firewall forwards PBF traffic only to active paths

you can enable path monitoring for the next-hop IP addresses in a PBF rule." This describes the mechanism for the failover scenario in option B.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policy-Based Forwarding Rule": The PBF rule configuration options listed under the "Service/URL Category" tab include "Service

" which is defined as a protocol and destination port. There is no option to match based on a source port

making option D incorrect.

The High Availability (HA) Heartbeat Backup feature uses ICMP pings between the management interfaces of the two firewalls to provide a secondary path for failure detection. If the management interface is configured with an access control list (the "Permitted IP Addresses" list), it must explicitly allow traffic from the peer firewall's management IP address. If the peer's IP is not on this list, the heartbeat pings will be dropped, and the firewall will report the Heartbeat Backup link status as "down". Checking this permit list is a critical troubleshooting step for this specific issue.

A: The peer IP for heartbeat backup is the device's management IP. This is not configured under HA Pair Settings, which is primarily for the control link (HA1).

C: This path is for enabling or disabling the Heartbeat Backup feature. The question states the feature was already enabled, so this is not a troubleshooting step for a "down" status.

D: Packet Forwarding settings are used to configure traffic forwarding over the HA data links (e.g., HA2), not the management interface which is used for the heartbeat backup.

1. Palo Alto Networks Administrator's Guide - Configure Active/Passive HA: "Heartbeat Backup—Select to enable the firewall to use the management port as a backup heartbeat link. The firewall sends heartbeat polls (ICMP pings) between the management ports of the HA peers." This confirms the use of the management port for heartbeats.

2. Palo Alto Networks Administrator's Guide - Device > Setup > Management: "To secure access to the firewall

you can configure a list of permitted IP addresses that can access the firewall... If you configure a list of permitted IP addresses

the firewall denies access to all other IP addresses." This explains that if the peer's management IP is not on the list

its ICMP heartbeats will be denied

causing the link to show as down.

3. Palo Alto Networks Administrator's Guide - HA Timers: "The heartbeat backup uses the management port to exchange ICMP packets (pings) between the HA peers." This explicitly states the protocol and port used

reinforcing that management interface access control rules would apply.

Packet buffer protection must be explicitly enabled for the zones where it is needed, in addition to the global setting. The global setting (under Device > Setup > Session) acts as a master switch, but the protection is not active on any specific zone until it is configured for that zone. This is accomplished by configuring packet buffer protection within a Zone Protection Profile and applying that profile to the ingress zone(s) receiving the attack traffic. The administrator's action of enabling it globally was insufficient because the protection was not yet applied to the specific, affected zone.

A. Apply DOS profile to security rules allow traffic from outside.

This is incorrect because DoS Protection profiles apply to traffic that is already allowed by a Security policy rule. Zone-based protections are more efficient as they act earlier in the packet flow.

B. Add the default Vulnerability Protection profile to all security rules that allow traffic from outside.

This is incorrect because Vulnerability Protection profiles are designed to stop known exploits and vulnerability-based attacks, not to mitigate volumetric flood attacks that exhaust packet buffers.

D. Add a Zone Protection profile to the affected zones.

This is less precise than option C. While adding a profile is the mechanism, the fundamental missing step is enabling the protection for the zone. A profile might already exist on the zone, requiring modification rather than addition.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Zone Protection Profiles": "To protect a zone from flood

reconnaissance

and other packet-based attacks

you create a Zone Protection profile and apply it to the zone."

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Configure Packet Buffer Protection": "To use packet buffer protection

you must enable it for each zone where you want to apply protection and then attach the Zone Protection profile to the zone." This reference directly supports that protection must be enabled for the specific zone

which is the action described in the correct answer.

3. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Packet Buffer Protection": "You can enable packet buffer protection globally for all zones or for individual zones... When you enable packet buffer protection

you can also set thresholds for two types of protection: RED and packet buffer block. The firewall applies the thresholds on a per-zone basis." This confirms that even with a global setting

the application is per-zone.