Free PSE-Software-Firewall Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

To minimize downtime when increasing throughput on a flexible-license VM-Series firewall running on ESXi, the following steps should be taken: Increase the vCPU within the deployment profile: This is the first step. By increasing the vCPU allocation in the licensing profile, you prepare the license system for the change. This does not require a VM reboot. Retrieve or fetch license keys on the VM-Series NGFW: After adjusting the licensing profile, the firewall needs to retrieve the updated license information to reflect the new vCPU allocation. This can be done via the web UI or CLI and usually does not require a reboot. Power-off the VM and increase the vCPUs within the hypervisor: Now that the license is prepared, the VM can be powered off, and the vCPUs can be increased within the ESXi hypervisor settings. Power-on the VM-Series NGFW: After increasing the vCPUs in the hypervisor, power on the VM. The firewall will now use the allocated resources and the updated license. Confirm the correct tier level and vCPU appear on the NGFW dashboard: Finally, verify in the firewall's web UI or CLI that the correct license tier and vCPU count are reflected. This order minimizes downtime because the licensing changes are handled before the VM is rebooted. Reference: While not explicitly documented in a single, numbered step list, the concepts are covered in the VM- Series deployment guides and licensing documentation: VM-Series Deployment Guides: These guides explain how to configure vCPUs and licensing. Flex Licensing Documentation: This explains how license allocation works with vCPUs. These resources confirm that adjusting the license profile before the VM reboot is crucial for minimizing downtime.

The CN-Series firewalls are specifically designed to secure containerized environments. They can secure

traffic between Kubernetes pods, which are the smallest deployable units in a Kubernetes cluster, and are

often composed of one or more containers. The primary focus of CN-Series firewalls is to ensure security

within Kubernetes environments by managing traffic and enforcing security policies at the pod level.

Reference:

Palo Alto Networks CN-Series Datasheet: CN-Series Datasheet

Palo Alto Networks CN-Series Documentation: CN-Series Documentation

The CN-Series firewalls are containerized firewalls designed to protect Kubernetes environments. They

offer several deployment methods to integrate with Kubernetes orchestration.

A . Terraform templates: Terraform is an Infrastructure-as-Code (IaC) tool that allows you to define and

provision infrastructure using declarative configuration files. 1 Palo Alto Networks provides Terraform

modules and examples to deploy CN-Series firewalls, enabling automated and repeatable deployments.

https://prathmeshh.hashnode.dev/day-62-terraform-and-docker

1. prathmeshh.hashnode.dev

https://prathmeshh.hashnode.dev/day-62-terraform-and-docker prathmeshh.hashnode.dev

B . Panorama plugin for Kubernetes: While Panorama is used to manage CN-Series firewalls centrally,

there isn't a direct "Panorama plugin for Kubernetes" for deploying the firewalls themselves.

Panorama is used for management after they're deployed using other methods.

C . YAML file: Kubernetes uses YAML files (manifests) to define the desired state of deployments,

including pods, services, and other resources. You can deploy CN-Series firewalls by creating YAML

files that define the necessary Kubernetes objects, such as Deployments, Services, and ConfigMaps. This

is a core method for Kubernetes deployments.

D . Helm charts: Helm is a package manager for Kubernetes. Helm charts package Kubernetes resources,

including YAML files, into reusable and shareable units. Palo Alto Networks provides Helm

charts for deploying CN-Series firewalls, simplifying the deployment process and managing updates. E .

Docker Swarm: Docker Swarm is a container orchestration tool, but CN-Series firewalls are specifically

designed for Kubernetes and are not deployed using Docker Swarm.

Reference:

The Palo Alto Networks documentation clearly outlines these deployment methods:

CN-Series Deployment Guide: This is the primary resource for deploying CN-Series firewalls. It provides

43/103

detailed instructions and examples for using Terraform, YAML files, and Helm charts. You can find this

on the Palo Alto Networks support portal by searching for "CN-Series Deployment Guide".

When using Terraform templates with a Cloud next-generation firewall (NGFW) for Amazon Web

Services (AWS), you must enable access to the Cloud NGFW for AWS console to manage and deploy

firewall resources effectively:

Access to the Cloud NGFW for AWS console: This access is crucial for the initial setup, configuration,

31/103

and ongoing management of the Cloud NGFW resources. Terraform templates automate the provisioning

and management of these resources, but initial access to the console is necessary to configure and retrieve

necessary information (such as API keys and configuration details) for the Terraform scripts.

Reference: Getting Started with Cloud NGFW for AWS

VM-Series firewalls provide advanced application-level security for web-server instances on AWS. These

virtual firewalls leverage Palo Alto Networks’ next-generation firewall capabilities to offer features like

application identification, threat prevention, and URL filtering, ensuring comprehensive security for web

applications hosted on AWS.

Reference:

Palo Alto Networks VM-Series on AWS: VM-Series on AWS AWS Security Best Practices: AWS

Security Best Practices

When implementing active-active high availability (HA), a floating IP address must be configured to allow the HA pair to share a single IP address that may be used as the network's gateway IP address. This floating IP address ensures that either of the active-active firewalls can assume control of the traffic without interruption in case of a failover. Reference: Palo Alto Networks High Availability Guide: Active-Active HA Configuration Palo Alto Networks HA Configuration: HA Configuration

Service Cluster Mode:

In NSX-T, the Service Cluster mode allows the VM-Series firewalls to be deployed as part of a service

cluster, where they can provide security services to workloads.

Reference: The deployment guide for VM-Series firewalls in NSX-T outlines how to set up and configure

Service Cluster mode.

Palo Alto Networks NSX-T Integration Guide Host-based Mode:

Host-based mode involves deploying the VM-Series firewalls directly on the host machines within the

18/103

NSX-T environment. This allows for direct integration and security enforcement on the host level.

Reference: NSX-T documentation from Palo Alto Networks describes host-based deployment options

for VM-Series firewalls.

Palo Alto Networks NSX-T Integration Guide

The question asks about the primary purpose of the pan-os-python SDK.

D . To provide a Python interface to interact with PAN-OS firewalls and Panorama: This is the correct

answer. The pan-os-python SDK (Software Development Kit) is designed to allow Python scripts and

applications to interact programmatically with Palo Alto Networks firewalls (running PAN-OS) and

Panorama. It provides functions and classes that simplify tasks like configuration management,

monitoring, and automation.

Why other options are incorrect:

A . To create a Python-based firewall that is compatible with the latest PAN-OS: The pan-os-python SDK

is not about creating a firewall itself. It's a tool for interacting with existing PAN-OS firewalls.

B . To replace the PAN-OS web interface with a Python-based interface: While you can build custom

tools and interfaces using the SDK, its primary purpose is not to replace the web interface. The web

40/103

interface remains the standard management interface.

C . To automate the deployment of PAN-OS firewalls by using Python: While the SDK can be used as

part of an automated deployment process (e.g., in conjunction with tools like Terraform or Ansible), its

core purpose is broader: to provide a general Python interface for interacting with PAN-OS and

Panorama, not just for deployment.

Palo Alto Networks Reference:

The primary reference is the official pan-os-python SDK documentation, which can be found on GitHub

(usually in the Palo Alto Networks GitHub organization) and is referenced on the Palo Alto Networks

Developer portal. Searching for "pan-os-python" on the Palo Alto Networks website or on GitHub will

locate the official repository.

The documentation will clearly state that the SDK's purpose is to:

Provide a Pythonic way to interact with PAN-OS devices.

Abstract the underlying XML API calls, making it easier to write scripts.

Support various operations, including configuration, monitoring, and operational commands. The

documentation will contain examples demonstrating how to use the SDK to perform various tasks,

reinforcing its role as a Python interface for PAN-OS and Panorama.

App-ID is a feature that provides application-based segmentation and helps prevent lateral threat

movement within a network. By identifying and controlling applications traversing the network

regardless of port, protocol, or encryption (SSL or SSH), App-ID allows granular security policies to be

applied, thereby limiting the spread of threats within the network.

Reference:

Palo Alto Networks App-ID Technology: App-ID

Palo Alto Networks Application and Threat Content: App-ID Overview

In Kubernetes, configuration files are typically written in YAML (.yaml) format. YAML (Yet Another

Markup Language) is preferred due to its readability and ease of use for defining complex data structures

like those required for Kubernetes deployments. Kubernetes uses these YAML files to define resources

such as pods, services, and deployments.

Reference:

Kubernetes Documentation on YAML: Kubernetes YAML Kubernetes Getting Started Guide: YAML

Basics

Palo Alto Networks provides several tools to simplify NGFW configuration and ensure best practices are

followed:

A . Telemetry to ensure that Palo Alto Networks has full visibility into the firewall configuration: While

telemetry is crucial for monitoring and threat intelligence, it doesn't directly facilitate configuration in a

simplified or best-practice manner. Telemetry provides data about the configuration and its performance,

but it doesn't guide the configuration process itself.

B . Day 1 Configuration through the customer support portal (CSP): The CSP offers resources and

documentation, but it doesn't provide a specific "Day 1 Configuration" tool that automates or simplifies

initial setup in a guided way. The initial configuration is typically done through the firewall's web

interface or CLI.

C . Policy Optimizer to help identify and recommend Layer 7 policy changes: This is a key tool for

simplifying and optimizing security policies. Policy Optimizer analyzes traffic logs and provides

recommendations for refining Layer 7 policies based on application usage. This helps reduce policy

complexity and improve security posture by ensuring policies are as specific as possible.

D . Expedition to enable the creation of custom threat signatures: Expedition is a migration tool that can

also be used to create custom App-IDs and threat signatures. While primarily for migrations, its ability to

create custom signatures helps tailor the firewall's protection to specific environments and applications,

which is a form of configuration optimization.

E . Best Practice Assessment (BPA) in Strata Cloud Manager (SCM): The BPA is a powerful tool that

analyzes firewall configurations against Palo Alto Networks best practices. It provides detailed reports

with recommendations for improving security, performance, and compliance. This is a direct way to

ensure configurations adhere to best practices.

Reference:

Palo Alto Networks documentation highlights these tools:

Policy Optimizer documentation: Search for "Policy Optimizer" on the Palo Alto Networks support

portal. This documentation explains how the tool analyzes traffic and provides policy recommendations.

Expedition documentation: Search for "Expedition" on the Palo Alto Networks support portal. This

documentation describes its migration and custom signature creation capabilities.

Strata Cloud Manager documentation: Search for "Strata Cloud Manager" or "Best Practice Assessment"

within the SCM documentation on the support portal. This will provide details on how the BPA works

and the types of recommendations it provides.

These

confirm that Policy Optimizer, Expedition (for custom signatures), and the BPA in SCM

are tools specifically designed to facilitate simplified and best-practice configuration of Palo Alto

Networks NGFWs.

45/103

13/103

Consistent Security Across the Environment:

CN-Series firewalls are designed to provide security for containerized environments by protecting traffic

between pods and other workload types. This ensures that security policies are consistently enforced

across all elements of the environment, maintaining a unified security posture.

Reference: The Palo Alto Networks documentation emphasizes that the CN-Series provides consistent

security enforcement across Kubernetes environments, ensuring that security policies apply uniformly.

Palo Alto Networks CN-Series Documentation

Software next-generation firewall (NGFW) credits can be used to enable DNS security on Palo Alto

Networks firewalls. These credits allow customers to activate DNS Security service, which provides real-

time protection against DNS-based threats by leveraging machine learning and continuous analysis.

Reference:

Palo Alto Networks DNS Security: DNS Security

Palo Alto Networks Licensing Guide: Software NGFW Credits

Credit-based flexible licensing provides flexibility in deploying and managing Palo Alto Networks software firewalls. Let's analyze the options: A . Create virtual Panoramas: While Panorama can manage software firewalls, credit-based licensing is primarily focused on the firewalls themselves (VM-Series, CN-Series, Cloud NGFW), not on Panorama. Panorama has its own licensing model. B . Add Cloud-Delivered Security Services (CDSS) subscriptions to CN-Series firewalls: This is a VALID benefit. Credit-based licensing allows customers to use credits to enable CDSS subscriptions (like Threat Prevention, URL Filtering, WildFire) on CN-Series firewalls. This provides flexibility in choosing and applying security services as needed. Reference: Palo Alto Networks licensing guides and documentation on flexible licensing explicitly mention its applicability to enabling CDSS subscriptions for software firewalls, including CN-Series. C . Create Cloud NGFWs: This is a VALID benefit. Cloud NGFW for AWS and Azure are licensed through a credit-based system. Customers consume credits based on usage. Reference: The documentation for Cloud NGFW for AWS and Azure describes the credit-based licensing model. D . Add Cloud-Delivered Security Services (CDSS) subscriptions to PA-Series firewalls: PA-Series firewalls are hardware appliances and use traditional licensing methods. Credit-based licensing is not applicable to them.

VM-Series qcow2 image:

The qcow2 image format is commonly used in OpenStack environments. The VM-Series firewalls are

provided in the qcow2 format for compatibility with OpenStack.

Reference: Palo Alto Networks documentation states that for OpenStack environments, the VM- Series

firewall is available in a qcow2 image format.

Palo Alto Networks VM-Series Deployment Guide OpenStack heat template in YAML format:

OpenStack Heat Orchestration Templates (HOT) are written in YAML. These templates define the

infrastructure needed for deployment and can automate the deployment process.

Reference: OpenStack documentation specifies the use of YAML for heat templates, and Palo Alto

Networks supports YAML format for ease of integration and automation.

OpenStack Heat Documentation

Comprehensive and Detailed In-Depth Step-by-Step Explanation :

Automating the deployment of VM-Series firewalls in public cloud service provider (CSP) environments

like AWS, Azure, and GCP requires tools that support Infrastructure-as-Code (IaC) and integration with

cloud APIs. The Palo Alto Networks Systems Engineer Professional - Software Firewall documentation

outlines tools for automation, focusing on scalability and integration with DevOps workflows.

Terraform Automated Config agent (Option B): Terraform is an IaC tool that automates the provisioning

and configuration of infrastructure, including VM-Series firewalls in public clouds. The “Terraform

Automated Config agent” refers to using Terraform scripts or modules (available in the Palo Alto

Networks GitHub repository) to deploy VM-Series firewalls, configure networking, apply policies, and

integrate with cloud-native services (e.g., AWS VPC, Azure VNet, GCP VPC). The documentation

highlights Terraform as a primary tool for automating VM-Series deployments, enabling repeatable and

scalable deployments across CSPs, aligning with modern DevOps practices. Options A (Panorama), C

(Public Cloud Manager [PCM] tenant), and D (Docker Swarm) are incorrect. Panorama (Option A) is a

management platform, not an automation tool for initial deployment; it manages configurations and

policies post-deployment but does not automate the provisioning of VMs in public clouds. Public Cloud

Manager (PCM) is not a recognized Palo Alto Networks tool in this context; Strata Cloud Manager

(SCM) or Panorama are used, but PCM is not referenced for VM-Series automation. Docker Swarm

(Option D) is a container orchestration platform, not suited for deploying VM-Series firewalls, which are

virtual machines, not containers (CN-Series uses Kubernetes, not Docker Swarm, for containerized

deployments).

Reference: Palo Alto Networks Systems Engineer Professional - Software Firewall, Section: VM-Series

Deployment Automation, Terraform Integration Documentation, GitHub Repository for Palo Alto

Networks.

Advanced CDSS subscriptions offer enhanced threat prevention capabilities: A . To improve firewall throughput by inspecting hashes of advanced packet headers: While some security features use hashing, this is not the primary advantage of advanced CDSS. B . To download and install new threat-related signature databases in real-time: Both standard and advanced CDSS subscriptions receive regular threat updates. C . To use cloud-scale machine learning inline for detection of highly evasive and zero-day threats: This is a key differentiator of advanced CDSS. It leverages cloud-based machine learning to detect sophisticated threats that traditional signature-based methods might miss. D . To use external dynamic lists for blocking known malicious threat sources and destinations: Both standard and advanced CDSS can use external dynamic lists. Reference: Information about the specific features of advanced CDSS, such as inline machine learning, can be found on the Palo Alto Networks website and in datasheets comparing different CDSS subscription levels.

66/103

Memory scaling in PAN-OS 10.2 and later enhances capacity for certain functions.

Why B, C, and E are correct:

B . Increased maximum sessions with additional memory: More memory allows the firewall to maintain

state for a larger number of concurrent sessions.

C . Increased maximum number of Dynamic Address Groups with additional memory: DAGs consume

memory, so scaling memory allows for more DAGs.

E . Increased maximum security rule count with additional memory: More memory allows the firewall to

store and process a larger number of security rules.

Why A and D are incorrect:

A . Increased maximum throughput with additional memory: Throughput is primarily related to CPU and

network interface performance, not memory.

D . Increased number of tags per IP address with additional memory: The number of tags per IP is not

directly tied to the memory scaling feature.

Palo Alto Networks Reference:

PAN-OS Release Notes for 10.2 and later: The release notes for PAN-OS versions introducing memory

scaling explain the benefits in detail.

PAN-OS Administrator's Guide: The guide may also contain information about resource limits and the

impact of memory scaling.

The release notes specifically mention the increased capacity for sessions, DAGs, and security rules as

key benefits of memory scaling.

The VM-Series plugin supports integration with multiple public cloud platforms, including: Amazon Web Services (AWS): The VM-Series firewalls can be deployed in AWS to provide comprehensive security for cloud applications and data, leveraging AWS's native services and integration capabilities. Azure: The VM-Series firewalls also integrate with Microsoft Azure, offering advanced security features and policies for applications and data hosted in Azure's cloud environment. Reference: Palo Alto Networks VM-Series on AWS: VM-Series on AWS Palo Alto Networks VM-Series on Azure: VM-Series on Azure

Panorama plugins extend its functionality. Why B, C, and E are correct:

B . Supports other Palo Alto Networks products and configurations with NGFWs: Plugins enable

Panorama to manage and integrate with other Palo Alto Networks products (e.g., VM-Series, Prisma

Access) and specific configurations.

C . May be installed on Panorama from the Palo Alto Networks customer support portal: Plugins are

downloaded from the support portal and installed on Panorama.

E . Expands capabilities of hardware and software NGFWs: Plugins add new features and functionalities

to the managed firewalls through Panorama.

Why A and D are incorrect:

A . Limited to one plugin installation on Panorama: Panorama supports the installation of multiple

plugins to extend its functionality in various ways.

D . Complies with third-party product/platform integration and configuration with NGFWs: While some

plugins might facilitate integration with third-party tools, the primary focus of Panorama plugins is on

Palo Alto Networks products and features. Direct third-party product integration is not a core function of

plugins.

Palo Alto Networks Reference: The Panorama Administrator's Guide contains information about plugin

management, installation, and their purpose in extending Panorama's capabilities.

68/103