Free PCNSE Practice Test Questions and Answers (2026)

When a Palo Alto Networks firewall encounters a TLS session using an unsupported cipher suite or protocol version, and the Decryption Profile is configured to allow it, the firewall cannot decrypt the traffic. To maintain performance and avoid repeatedly attempting to decrypt sessions that are known to be undecryptable, the firewall bypasses decryption for the current session. It then adds the server's IP address and the Server Name Indication (SNI) to the SSL decryption exclusion cache. This ensures subsequent connections to the same server are not subjected to decryption attempts for a default period of 12 hours.

A: The firewall is designed to prevent protocol downgrade attacks, not to perform them as a function of its operation.

B: The firewall cannot continue decryption because the mode is unsupported. It allows the encrypted traffic to pass, but the decryption process is aborted for that session.

C: This is incorrect because the Decryption Profile is explicitly configured to allow unsupported modes, not block them. Blocking would be the action if the profile were set to "Block."

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section on Decryption Profiles

the behavior for unsupported parameters is detailed. For "Unsupported Cipher Suites

" it states: "If you select Decrypt

the firewall allows the connection but does not decrypt it. To prevent the firewall from attempting to decrypt future connections to the same site

it adds the site to the SSL decryption exclusion cache."

Source: Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0. "Objects > Decryption Profile > SSL Forward Proxy Tab".

2. Palo Alto Networks TechDocs - Troubleshoot SSL Decryption: This document explains the mechanisms for handling decryption failures. It clarifies that when a session cannot be decrypted due to an unsupported cipher and the policy allows it

the server is added to an exclusion cache to prevent future decryption attempts.

Source: Palo Alto Networks. (n.d.). Troubleshoot SSL Decryption. "SSL Decryption Not Working as Expected". Retrieved from the official Palo Alto Networks TechDocs portal.

3. Palo Alto Networks TechDocs - SSL Decryption for Advanced Users: This resource details the internal workings

including the exclusion cache. It confirms that servers using unsupported ciphers are added to this cache to optimize performance by bypassing future decryption attempts.

Source: Palo Alto Networks. (n.d.). SSL Decryption for Advanced Users - LIVEcommunity. "SSL Decryption Failure Handling".

The image displays the "Server Monitoring" panel on a Palo Alto Networks firewall. This interface is used to check the status of the integrated User-ID agent's connections to various servers for collecting user-to-IP address mappings. The single entry shows a Host named lab-client, which is identified by Type as a Domain Controller. The Status is Connected, confirming that the firewall's User-ID agent has successfully established a connection to the domain controller named lab-client to monitor its security event logs.

B. The host lab-client has been found by a domain controller. This is incorrect. The panel shows the firewall's User-ID agent monitoring the server; lab-client is the domain controller being monitored, not a host found by it.

C. The host lab-client has been found by the User-ID agent. This statement is too general. Option A is more precise by specifying that lab-client is a Domain Controller, a key detail shown in the Type column.

D. The User-ID agent is connected to the firewall labeled lab-client. This is factually wrong. The Type column explicitly identifies lab-client as a Domain Controller, not a firewall.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the chapter "User-ID

" the section "Configure the Integrated User-ID Agent to Monitor a Server" describes this functionality. The guide explains that the Server Monitoring table (Device > User Identification) shows the connection status between the firewall and the monitored servers

such as Domain Controllers. The Status column indicates if the connection is successful (Connected).

2. Palo Alto Networks PAN-OS® Administrator's Guide 11.0: The section "Monitor User-ID" states

"To verify that the firewall is successfully connecting to the servers you configured for monitoring

select Device > User Identification and

in the Server Monitoring section

view the Status for each server." This directly corresponds to the graphic

confirming it shows the firewall's connection status to a monitored server.

3. Palo Alto Networks

"User-ID™ Technology Overview" White Paper: This document explains that the firewall can be configured to directly monitor the security event logs of a Microsoft Domain Controller to map users to IP addresses. The Server Monitoring panel is the tool used to verify this connection.

According to Palo Alto Networks GlobalProtect documentation, split-tunnel exclusions can be defined by (1) destination domain names, (2) identified HTTP/HTTPS video-streaming applications, and (3) the local client application process name or executable. These methods allow traffic that matches any of those criteria to bypass the VPN tunnel while all other traffic remains in the secure tunnel. No mechanism exists to base split-tunneling on user/group, generic URL categories, or “source domain”.

A. Destination user/group – Split-tunneling decisions are not user- or group-aware; they are packet attribute–based.

B. URL Category – Only the special “video-streaming” category is supported, not arbitrary URL categories.

E. Source Domain – Decisions use destination domain (FQDN) the client contacts, not any “source” domain concept.

1. Palo Alto Networks

PAN-OS 10.2 GlobalProtect Administrator’s Guide

“About GlobalProtect Split Tunneling

” Table 1: Split-Tunnel Traffic Match Criteria (destination domain

video-streaming apps

client app process).

2. Palo Alto Networks

PAN-OS 10.2 GlobalProtect Administrator’s Guide

“Configure Split Tunnel Based on Domains

Applications

and HTTP/HTTPS Video Streaming

” Steps 2–4 (pp. 438-441).

3. Palo Alto Networks TechDocs

“Split Tunnel for GlobalProtect VPN” (doc ID GP-ST-10.2)

sections “Exclude by Destination Domain”

“Exclude Video Streaming Traffic”

“Exclude by Client Application”.

To enable communication between virtual systems (vsys) that use separate virtual routers (VRs), three key configurations are required, in addition to security policies. First, the virtual systems must be configured to be "visible" to each other, which is a prerequisite for any inter-vsys interaction. Second, an "external" zone must be created in the source vsys, and the interface belonging to the destination vsys must be added to it. This logically connects the two systems. Third, a static route must be configured in the source VR with a next-hop type of next-vr, specifying the destination VR to which the traffic should be forwarded.

B: While the zones will be Layer 3, the specific type required for inter-vsys communication is an "external" zone. This option is not precise enough.

C: A next-hop of "none" is used for discard routes or for traffic destined for a directly connected network, not for routing between virtual routers.

1. Palo Alto Networks Documentation (PAN-OS® Administrator's Guide 10.2): The section "Configure Inter-VSYS Routing" outlines the precise steps.

Step 1: Make Virtual Systems Visible to One Another: "Before you can route traffic between virtual systems

you must make them visible to one another." This supports option E.

Step 2: Configure an External Zone and Add an Interface: "Create a zone of the type External... An external zone allows you to route traffic between virtual systems." This supports option A.

Step 3: Configure a Static Route with a Next Hop of next-vr: "Create a static route to forward traffic from the source virtual router... to the destination virtual router... For Next Hop

select next-vr and select the destination virtual router." This supports option D.

Source: Palo Alto Networks

"PAN-OS® Administrator's Guide 10.2

" Chapter: Virtual Systems

Section: Configure Inter-VSYS Routing.

2. Palo Alto Networks Documentation (PAN-OS® New Features Guide 8.1): The introduction of the next-vr option is detailed here

reinforcing its specific purpose.

"You can now configure a static route to direct traffic between two virtual routers (VRs) on the same firewall... To support this inter-VR routing

a new next hop type

next-vr

is available for IPv4 and IPv6 static routes." This directly validates the specific mechanism in option D.

Source: Palo Alto Networks

"PAN-OS® New Features Guide 8.1

" Chapter: Networking Features

Section: Static Route Next Hop for Inter-VR Routing.

The issue arises because the firewall does not trust the certificate authority (CA) that signed the certificate for https://www.very-important-website.com. Consequently, during SSL Forward Proxy, the firewall uses its configured "Forward Untrust Certificate" (Untrusted-CA) to re-sign the certificate, which the end-user's browser does not trust.

To resolve this, the firewall's trust store must be updated to recognize the website's CA (Well-Known-Root-CA) as trusted. By importing the root and intermediate CAs into the firewall and marking the root as a "Trusted Root CA," the firewall will correctly validate the website's certificate. It will then use its "Forward Trust Certificate" for re-signing, which clients are expected to trust, thus eliminating the warning for this specific site while still flagging genuinely untrusted sites.

A: The end-user systems already trust the Well-Known-Root-CA chain, as stated in the question. The problem is their lack of trust in the firewall's re-signing certificate (Untrusted-CA).

B: Clearing the "Forward Untrust Certificate" option in the decryption profile would cause the firewall to block, not just warn, users trying to access sites with untrusted certificates, failing to meet the requirement for the important website.

D: Device Certificates is the incorrect location. This area is for certificates that identify the firewall itself, not for the certificate authority trust store used to validate external servers.

1. Palo Alto Networks Documentation - Configure SSL Forward Proxy: "For the firewall to be able to decrypt and inspect the SSL/TLS traffic

you must set up a Forward Trust certificate and a Forward Untrust certificate... If the server certificate is signed by a CA that the firewall trusts

the firewall re-signs the server certificate with the Forward Trust certificate... If the server certificate is signed by a CA that the firewall does not trust

the firewall re-signs it with the Forward Untrust certificate." This explains the mechanism causing the issue.

2. Palo Alto Networks Documentation - Certificate Management: "The firewall uses certificates to secure communication and authenticate entities... To enable the firewall to validate the certificate chains of the servers it communicates with

you must load the CA certificates that sign those server certificates onto the firewall and configure them as trusted CAs." This directly supports the solution in option C. The section on "Import a Certificate" details the process of adding a CA to the trust store.

3. Palo Alto Networks Documentation - Decryption Concepts: "The firewall maintains its own list of trusted CAs... If the CA that signed the server certificate is not on the firewall’s trusted CA list

the firewall considers the server certificate untrusted." This confirms that the root cause is the firewall's trust store

which option C correctly addresses.

PAN-OS 11.0 (Nova) introduced the capability for a firewall to function as a DHCPv6 client with prefix delegation. This feature enables the firewall to request and obtain an IPv6 address and/or an entire IPv6 prefix from an upstream DHCPv6 server, such as one operated by an Internet Service Provider (ISP). The firewall can then use this delegated prefix to assign IPv6 addresses to clients on its internal networks, facilitating dynamic IPv6 address management in enterprise environments.

B. OSPF: OSPFv3, which supports IPv6, has been a feature in PAN-OS for many versions prior to 11.0 and is not a new addition.

C. DHCP Server: The firewall's ability to act as a DHCPv6 server was available in previous PAN-OS versions and is not a new feature in 11.0.

D. IKEv1: IKEv1 is an older VPN protocol. Its support for IPv6 transport is not a new feature introduced in PAN-OS 11.0.

1. Palo Alto Networks Documentation. (2022). PAN-OS® New Features Guide

Release 11.0. "Networking Features" section. The guide explicitly lists "DHCPv6 Client with Prefix Delegation" as a new feature. It states

"The firewall can now act as a DHCPv6 client to request and obtain an IPv6 address and/or an IPv6 prefix from a DHCPv6 server."

2. Palo Alto Networks Documentation. (2022). PAN-OS® Administrator's Guide

Release 11.0. "DHCP Overview" section. This guide details the configuration and functionality

confirming that DHCPv6 Client with Prefix Delegation is a new capability for obtaining prefixes from an ISP.

3. Palo Alto Networks Documentation. (2014). PAN-OS® Administrator's Guide

Release 6.0. "OSPF" section. This older documentation confirms that OSPFv3 for IPv6 was supported long before the PAN-OS 11.0 release

demonstrating it is not a new feature.

Panorama provides a centralized interface for managing dynamic updates across multiple firewalls. The primary deployment actions include: Schedules, which automate the download and installation of updates at specified times; Install, which allows an administrator to manually push a specific content version to managed devices on-demand; and Revert content, which provides a critical rollback mechanism to a previous version if a new update introduces issues. These three functions give administrators comprehensive control over the dynamic update deployment lifecycle, from automated rollouts to manual intervention and remediation.

A. Check dependencies: This is an automated background process that Panorama performs before an installation to ensure compatibility, not a user-selectable deployment option.

C. Verify: Integrity verification is an automatic part of the download process to ensure the file is not corrupt. It is not a manual deployment action.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section on managing updates from Panorama

the guide details the primary actions available.

Install: "To manually install a content update on a firewall

select Device Deployment > Dynamic Updates

locate the update

and click Install." (Paraphrased from the "Install Content Updates on a Firewall" section).

Schedules: "You can configure a recurring schedule for Panorama to retrieve and install new content updates on managed firewalls." (Referenced in the "Schedule Content Updates for a Firewall" section).

Revert content: "If a content update causes issues...you can revert to a previously installed version... In Panorama

select Device Deployment > Dynamic Updates... and for the device you want to revert

click Revert." (Referenced in the "Revert to a Previous Content Version" section).

2. Palo Alto Networks Panorama™ Administrator’s Guide 10.2: The "Deploy Updates to Firewalls and Log Collectors" section explicitly describes the workflow and options. It states

"From Panorama

you can deploy software and content updates to managed firewalls... You can install updates on-demand or create schedules for recurring updates." This section also details the "Revert" capability for content updates as a management action.

The purpose of the SSL Forward Untrust certificate is to handle sessions where the original server certificate is invalid or untrusted (e.g., expired, self-signed, wrong hostname). To ensure the end-user is alerted to this potential security risk, the firewall must present a certificate that the user's browser will not trust. A self-signed certificate generated on the firewall is inherently untrusted by client browsers unless it has been explicitly installed in their trust stores. Using this self-signed certificate for the Forward Untrust role correctly triggers a browser security warning, propagating the original trust issue to the user as required.

A. A web server certificate signed by the organization's PKI: This would be trusted by internal clients, thus hiding the certificate warning from the user, which is contrary to the goal.

C. A subordinate Certificate Authority certificate signed by the organization's PKI: This is the best practice for the SSL Forward Trust certificate, not the Forward Untrust certificate. It is designed to be trusted.

D. A web server certificate signed by an external Certificate Authority: This would be trusted by all standard browsers, which would prevent the user from receiving the necessary warning about the untrusted site.

1. Palo Alto Networks Administrator's Guide - PAN-OS 10.2

"Configure SSL Forward Proxy": "For sites with untrusted certificates

the firewall uses the Forward Untrust Certificate to present to the client so that the user sees a block page. If you do not configure a Forward Untrust certificate

the firewall uses a self-signed certificate by default." This confirms that a self-signed certificate is the standard and default mechanism for this function.

2. Palo Alto Networks Administrator's Guide - PAN-OS 10.2

"Decrypt a Server Session with an Untrusted Certificate": "When the firewall detects an untrusted server certificate

it presents a copy of the Forward Untrust Certificate to the client to block the session and inform the user that the site is untrusted." This directly states the function is to inform the user of the untrusted status.

3. Palo Alto Networks Administrator's Guide - PAN-OS 10.2

"Certificates": This section describes a self-signed certificate as one that is signed by its own private key and not by a trusted CA. This inherent lack of external validation is why it serves the "untrust" function perfectly in this scenario.

For installing the Windows-based User-ID agent, the best practice is to use a dedicated service account. This approach adheres to the principle of least privilege, where the account is granted only the minimum permissions necessary to perform its functions—specifically, the ability to read security event logs from domain controllers and/or probe client systems via WMI. Using highly privileged accounts like Domain or Enterprise Administrator is strongly discouraged as it introduces unnecessary security risks. The dedicated account's scope of access is limited, minimizing the potential impact if the account credentials were to be compromised.

B. System Account: This is a local account and lacks the required network permissions to read event logs from remote domain controllers, which is a primary function of the User-ID agent.

C. Domain Administrator: This account has excessive privileges. Using it for a service violates the principle of least privilege and creates a significant security vulnerability.

D. Enterprise Administrator: This is the most privileged account in an AD forest. Using it for the User-ID agent is a severe security risk and is not required.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Configure a Service Account for the User-ID Agent". The documentation states

"For the User-ID agent to access the security logs on your domain controllers... you must configure a service account with the proper permissions." It then details the specific

limited permissions required

reinforcing the need for a dedicated

non-admin account.

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Install the Windows-Based User-ID Agent". In Step 4 of the installation procedure

it prompts for the username and password for the service

stating

"Enter the Username and Password for the service account that the User-ID agent will use to access servers." This implies a specific

pre-configured account.

Asymmetric routing causes the firewall to see only one direction of a traffic flow. This results in the firewall dropping packets for two main reasons: the initial packet it sees may not be a TCP SYN, and subsequent packets will not match an existing session.

To permanently allow this traffic, two actions can be taken:

1. Configure a Zone Protection Profile to apply to the affected zone(s). In this profile, setting Asymmetric Path to Bypass and Reject Non-syn-TCP to No instructs the firewall to permit asymmetrically routed traffic for that specific zone (Option A).

2. Globally disable the setting that rejects TCP sessions not initiated with a SYN packet. This is done using the configuration mode CLI command set deviceconfig setting session tcp-reject-non-syn no and then committing the change (Option D).

B: The > prompt indicates an operational mode command. This change is temporary and will not persist after a firewall reboot, failing the "permanently" requirement.

C: Setting the options to "Global" in a Zone Protection Profile instructs the firewall to use the system-wide default setting, which is to drop this traffic. This does not change the behavior to allow it.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Configure Zone Protection for Packet-Based Attack Protection": This section details the settings within a Zone Protection Profile. It states for "Reject Non-SYN TCP

" you can select "no to disable this protection." For "Asymmetric Path

" it states

"Select bypass to allow asymmetric routing." This validates the settings described in option A.

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Session Settings": This document describes the global session settings. It confirms that tcp-reject-non-syn is a global setting that is enabled by default to protect against TCP session spoofing attacks. Disabling it is a common solution for asymmetric routing issues.

3. Palo Alto Networks CLI Reference Guide

"set deviceconfig setting session": This guide confirms that set deviceconfig setting session tcp-reject-non-syn no is the correct command syntax for permanently modifying the firewall's global session configuration. The # prompt signifies configuration mode

where changes can be committed and made permanent.

The provided images show a Log Forwarding Profile configuration. The "Alert - Threats" match list entry is configured to trigger on any threat log, as indicated by the filter (threat neq no). The action specified for this trigger is "Tagging". The details of the tagging action show that the "Source Address" of the traffic generating the log will be registered with the tag "BadGuys" for a "Timeout" of 180 minutes. This configuration does not block traffic directly; it applies a tag that can be used by a Dynamic Address Group in a separate security policy.

A. The source address of SMTP traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

The configured action is "Tagging," not "Block IP." Also, the filter is for any threat, not specifically for SMTP traffic.

B. The source address of traffic that matches a threat is automatically blocked as BadGuys for 180 minutes.

The action is "Tagging," which registers an IP address with a tag. It is not a "Block IP" action, which would actively block the source.

D. The source address of SMTP traffic that matches a threat is automatically tagged as BadGuys for 180 minutes.

This is less precise. The filter (threat neq no) applies to any traffic that generates a threat log, not just SMTP traffic.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: "Objects > Log Forwarding". This section details the creation of Log Forwarding profiles and their components. It states that you can create match lists that use filters to trigger actions based on log attributes.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: "Use Dynamic Address Groups to Enforce Policy on Traffic from Tagged IP Addresses > Register IP Addresses and Tags Dynamically". This section describes the "Tagging" action within a Log Forwarding profile. It explains: "Select Tagging and then Add a tag to register IP addresses with a tag that you can then use as a match criterion in a Dynamic Address Group... For each tag

you can set a Timeout (in minutes) after which the tag expires." This confirms the action is tagging

not blocking.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: "Monitor > Log Viewer > Log Types > Threat". This section describes the Threat log

which is generated when traffic matches a security profile (Antivirus

Anti-Spyware

etc.). The filter (threat neq no) specifically targets these logs.

In a Palo Alto Networks Active/Passive High Availability (HA) configuration, the HA2 link is the dedicated data link for synchronizing runtime state information. This ensures a stateful failover if the active firewall fails. For IPsec tunnels, the active firewall synchronizes the established Phase 2 Security Associations (SAs) with the passive firewall over this HA2 link. The Phase 1 (IKE) SA is not synchronized because the IKE process is managed on the control plane, which is not part of the runtime state synchronization. Upon failover, the new active firewall can immediately use the synchronized Phase 2 SAs to process traffic.

A: Phase 1 SAs are not synchronized, and the HA3 link is used for packet forwarding in Active/Active mode, not for state synchronization.

C: Phase 1 SAs are not synchronized. Only Phase 2 SAs, which are part of the data plane's session state, are synchronized.

D: The HA1 link is the control link used for heartbeats and configuration synchronization, not for runtime state like SAs.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section on High Availability

it specifies the function of the HA links.

Reference: "HA Concepts > HA Links and Backup Links"

Content: "The HA2 link is a Layer 2 link that is used to synchronize sessions

forwarding tables

ARP tables

and IPsec SAs between the firewalls in an HA pair." This confirms the use of the HA2 link for SA synchronization.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: The guide explicitly details which SAs are synchronized for stateful failover.

Reference: "High Availability > Set Up Active/Passive HA > Stateful Failover for IPsec Tunnels"

Content: "For stateful failover of IPsec tunnels

the firewall synchronizes only the Phase 2 SAs. The IKE (Phase 1) SA is not synchronized." This directly supports that only Phase 2 SAs are synchronized.

The "Log at Session Start" option is primarily a troubleshooting tool. It generates a log entry as soon as the firewall receives the first packet of a session, providing immediate feedback on whether traffic is matching a security rule. This is invaluable for diagnosing connectivity issues in real-time. However, enabling this feature permanently, especially on high-traffic rules, generates two logs per session (one at the start, one at the end), which can significantly increase log volume and consume system resources on both the firewall and the log collector. Therefore, the best practice is to use it temporarily for specific diagnostic purposes.

B: Deny actions are typically stateless and log immediately upon packet drop, making the "session start" concept less relevant than for stateful "allow" rules.

C: Enabling this on all "allow" rules is not a best practice as it would cause excessive logging and performance degradation on the firewall and log collectors.

D: "Log at Session Start" is an independent setting; it can be enabled without "Log at Session End" and is often used alone during troubleshooting.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Security Policy Rule Actions": In the section describing policy rule actions

the guide states

"Select Log at Session Start to generate a log entry at the start of a session. This option is useful for troubleshooting." It also warns

"...it can cause a significant increase in the volume of logs." This directly supports its use for troubleshooting (A) and advises against broad application (C).

2. Palo Alto Networks

"Best Practice Assessment (BPA) Checks - PAN-OS 10.2"

Document Version 20220620: The BPA check security-policy-log-start explicitly states

"Enabling 'Log at Session Start' is a useful troubleshooting tool

but it can have a significant performance impact on the firewall and any downstream log collectors. It is recommended to only enable this setting for troubleshooting purposes." This reinforces that the primary

recommended use case is troubleshooting.

3. Palo Alto Networks Knowledge Base

Article #2136

"How to Troubleshoot Traffic Not Passing the Firewall": This article recommends as a troubleshooting step to "Enable 'Log at Session Start' on the security policy rule that should be matching the traffic." This demonstrates its practical application as a diagnostic tool.

The show system setting ssl-decrypt certificate command is the designated PAN-OS CLI command to view the configured certificates for SSL Decryption. This command displays the specific certificates assigned to the roles of Forward Trust, Forward Untrust, and SSL Inbound Inspection. It is the standard operational command for verifying which certificates are actively configured for these decryption functions, which is a primary step in troubleshooting SSL Decryption issues related to certificate trust.

B: The command syntax is incorrect. The correct keyword is the singular certificate, not the plural certs.

C: This is a debug command used for advanced, real-time dataplane troubleshooting, not for viewing the static certificate configuration.

D: This command displays the cache of certificates that the firewall has dynamically signed, not the primary configured certificates like Forward Trust.

1. Palo Alto Networks. (2021). PAN-OS® CLI Quick Reference 10.2. Page 121. Retrieved from Palo Alto Networks Technical Documentation. The guide lists show system setting ssl-decrypt certificate with the description "Display SSL Decryption certificate settings."

2. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Troubleshoot SSL Forward Proxy" section

initial verification steps involve checking the configured certificates. The show system setting ssl-decrypt certificate command directly provides this required information from the CLI.

3. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Configure SSL Forward Proxy" section

after configuring the Forward Trust and Forward Untrust certificates

this show command is the CLI method to verify the configuration has been applied correctly.

To enable split-tunneling by access route, destination domain, or application, the GlobalProtect gateway must be configured in Tunnel Mode. This mode establishes a secure VPN tunnel between the client and the gateway. Once Tunnel Mode is enabled on the gateway, you can then configure the specific split-tunneling rules in the GlobalProtect agent configuration. These rules dictate which traffic is sent through the VPN tunnel to the gateway for inspection and which traffic is excluded and sent directly to its destination. Without Tunnel Mode, the gateway cannot establish the necessary VPN connection to enforce these advanced traffic-steering policies.

A. No Direct Access to local networks: This is a client-side security setting that prevents access to the user's local LAN; it does not enable split-tunneling on the gateway.

C. IPsec mode: IPsec is a protocol choice for the tunnel, but the fundamental operational mode that enables tunneling is "Tunnel Mode." Split-tunneling works with both IPsec and SSL.

D. Satellite mode: This is not a standard GlobalProtect gateway configuration mode for enabling split-tunneling on a next-generation firewall.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on configuring a GlobalProtect gateway

the first step under the "General" tab is to enable Tunnel Mode. The documentation states

"To enable the gateway to establish a VPN tunnel

select Tunnel Mode." This is the prerequisite for all tunneling features. (Reference: PAN-OS Administrator's Guide 10.2 > GlobalProtect > Set Up the GlobalProtect Infrastructure > Configure the GlobalProtect Gateway > General Tab)

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: The section on split-tunneling explains the configuration for including or excluding traffic by domain

application

and route. This entire feature set is predicated on the existence of a VPN tunnel

which is established by the gateway operating in Tunnel Mode. (Reference: PAN-OS Administrator's Guide 10.2 > GlobalProtect > Configure Split Tunneling for GlobalProtect)

3. Palo Alto Networks GlobalProtect™ Administrator's Guide 6.1: This guide explicitly links Tunnel Mode to subsequent configurations. "After you enable tunnel mode

you can configure tunnel settings..." The guide then details how to configure the agent

which includes the split-tunnel settings. (Reference: GlobalProtect Administrator's Guide 6.1 > Set Up the GlobalProtect Infrastructure > Configure the GlobalProtect Gateway)

To enable management services, such as the XML API (which uses HTTPS), on a data-plane interface, an Interface Management profile must be used. This profile is created to permit specific services (e.g., HTTPS, Ping, SSH) and is then applied to the Layer 3 sub-interface. This allows the firewall's management plane to process requests sent to the sub-interface's IP address from the specified network segment. This approach correctly provides the required access without modifying the configuration of the dedicated management interface, fulfilling all constraints of the request.

A: A data-plane sub-interface cannot be designated as the primary management interface in the Device > Setup > Interfaces section; this area is for the dedicated MGT port.

B: The "Permitted IP Addresses" list restricts access to the dedicated management interface, which the scenario explicitly states cannot be accessed or modified.

D: Service routes define the egress interface for traffic originating from the firewall (e.g., log forwarding, updates), not for inbound management access to the firewall.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Use a Data Port for Management Access

" it states

"To use a data port for management access to the firewall

you must attach an interface management profile to the interface... An interface management profile controls which services are available on a firewall data port." This directly supports enabling HTTPS on the sub-interface via a profile. (Reference: Network > Network Profiles > Interface Mgmt)

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The "Service Route Configuration" section explains

"A service route is a static route for traffic that originates from the firewall... By default

the firewall uses the management (MGT) interface to connect to these services." This confirms service routes are for outbound

not inbound

traffic

invalidating option D. (Reference: Device > Setup > Services > Service Route Configuration)

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The "Management Interface Settings" section describes the "Permitted IP Addresses" feature as a way to restrict access to the management port. This confirms the feature applies only to the MGT port

making option B incorrect for a data-plane interface scenario. (Reference: Device > Setup > Management > Management Interface Settings)

A transparent proxy intercepts traffic from a client to a web server without requiring any configuration on the client's browser. The PAN-OS firewall uses a Policy-Based Forwarding (PBF) rule to identify and redirect the web traffic to its internal proxy engine. The client remains unaware of this interception. The question's description of traffic being "redirected to the proxy" while containing the web server's destination IP address directly aligns with the operational mechanism of a transparent proxy.

A. DNS proxy: This feature intercepts and forwards DNS queries to a specified DNS server. It does not handle HTTP or SSL web traffic redirection.

B. Explicit proxy: This method requires the client browser to be explicitly configured to send all web traffic directly to the firewall's proxy IP address and port.

C. SSL forward proxy: This is a decryption policy type used to decrypt and inspect SSL/TLS traffic. It is not a method for directing traffic to the proxy itself.

1. Palo Alto Networks PAN-OS® Administrator's Guide 11.0 (Nova): In the section on Web Proxy

the guide distinguishes between the two primary methods.

For Transparent Proxy: "In a transparent proxy deployment

you must configure a Policy-Based Forwarding (PBF) rule to redirect web traffic from the client to the firewall. The client is unaware that a proxy is intercepting its web traffic..." This directly supports the use of the term "redirected" for this mode.

For Explicit Proxy: "In an explicit proxy deployment

you must configure the client’s browser to direct web traffic to the firewall." This highlights the requirement for client-side configuration

which differs from the scenario.

Reference Location: PAN-OS® Administrator's Guide 11.0 > Web Proxy > Configure Web Proxy.

2. Palo Alto Networks PAN-OS® Administrator's Guide 11.0 (Nova): The guide for Policy-Based Forwarding confirms its role in redirection.

For PBF: "Policy-Based Forwarding (PBF) allows you to create forwarding policies that redirect traffic based on specific parameters..." This reinforces that PBF is the mechanism for redirection in a transparent proxy setup.

Reference Location: PAN-OS® Administrator's Guide 11.0 > Network > Policy-Based Forwarding.

GlobalProtect provides the most explicit and reliable method for IP address-to-user mapping in a high-security context. When a user connects via the GlobalProtect agent, they must actively authenticate. This process directly provides the firewall with a verified mapping of the user's identity to their specific IP address for the duration of the session. This active, authentication-based approach ensures that all mappings are explicitly known and validated, which is a fundamental requirement for high-security environments, unlike passive methods which can have gaps or delays.

A. PAN-OS integrated User-ID agent: This primarily uses passive methods like security log scraping, which may not capture every mapping event in real-time, making it less explicit than required.

C. Windows-based User-ID agent: Similar to the integrated agent, this relies on passive monitoring of server logs (e.g., domain controller logs), which is not as definitive as direct user authentication.

D. LDAP Server Profile configuration: An LDAP Server Profile is used to query a directory for user authentication and group membership; it does not, by itself, create an IP-to-user mapping.

1. Palo Alto Networks Documentation (PAN-OS 10.2)

"User-ID Concepts > User Mapping": This section details the various methods for mapping users to IP addresses. It describes GlobalProtect as a method where the agent

upon successful user authentication

provides the user and group information to the User-ID agent on the gateway. This direct submission of authenticated user data makes it an explicit mapping source.

2. Palo Alto Networks Documentation (PAN-OS 10.2)

"GlobalProtect": The GlobalProtect documentation explains that its core function is to authenticate users to establish secure connectivity. This authentication event is the source of the user-to-IP mapping

making it a highly reliable and explicit source of User-ID information.

3. Palo Alto Networks Documentation (PAN-OS 10.2)

"Configure the PAN-OS Integrated User-ID Agent to Monitor a Server": This document describes the server monitoring method used by the integrated and Windows-based agents. It states

"The firewall monitors the security event logs...for user login and logout events." This confirms the passive nature of the agent-based methods

which is less suitable for environments where mappings must always be explicitly known.

Panorama itself never queries LDAP. To populate the user- and group-objects that you reference in Device-Group policy, Panorama must learn them from one firewall in the group. Designating that firewall as the Master Device enables Panorama to pull its existing User-ID (LDAP) mappings and present the group list for rule creation and enforcement. Without a Master Device, Panorama cannot retrieve or validate LDAP group information for the rules. (≤130 words)

A. Service route to LDAP server – Panorama does not connect to LDAP; the firewalls (User-ID) do, so no Panorama service route is required.

C. Authentication Portal – Provides web-based user authentication, not group mapping data for policy creation.

D. User-ID agent on the LDAP server – May collect mappings, but Panorama still needs a Master Device to import them; agent alone is insufficient.

1. Palo Alto Networks

Panorama Administrator’s Guide 10.2

“Configure a Master Device in a Device Group

” steps 1-3 (docs.paloaltonetworks.com) – explains that a master device supplies user/group mapping to Panorama for policy.

2. Palo Alto Networks

PAN-OS Administrator’s Guide 10.2

“User-ID Overview

” section “How User-ID Works with Panorama” (docs.paloaltonetworks.com) – states Panorama relies on a designated firewall for user and group information.

3. Palo Alto Networks LIVEcommunity

TechDocs Article ID 3621

“Using Group Mapping on Panorama Requires a Master Device” (paragraph 2).

The IPSec Crypto profile defines the set of security protocols and algorithms used to protect data traffic in an IPSec VPN tunnel, which corresponds to Phase 2 of the IKE/IPSec negotiation. This profile includes parameters such as the protocol (ESP or AH), encryption and authentication algorithms, Diffie-Hellman (DH) group for Perfect Forward Secrecy (PFS), and the Security Association (SA) lifetime. A mismatch in the Phase 2 lifetime between peers is a common cause of tunnel negotiation failure, and this value is configured directly within the IPSec Crypto profile on a Palo Alto Networks firewall.

A. IPSec Tunnel settings: This configuration object binds the IKE Gateway and IPSec Crypto profile to a tunnel interface but does not contain the lifetime parameter itself.

B. IKE Crypto profile: This profile defines the parameters for IKE Phase 1, such as the IKE SA lifetime, not the IPSec SA (Phase 2) lifetime.

D. IKE Gateway profile: This defines the peer's identity and connection parameters for establishing Phase 1, linking to the IKE Crypto profile, not Phase 2 settings.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section describing how to set up an IPSec VPN

the configuration of the IPSec Crypto profile is detailed. It explicitly lists "Lifetime" as a configurable parameter for the Phase 2 Security Association.

Reference: Network > Network Profiles > IPSec Crypto > Add IPSec Crypto Profile. The dialog box shows fields for "IPSec Protocol

" "Encryption

" "Authentication

" "DH Group

" and "Lifetime." This directly confirms the lifetime is a Phase 2 parameter set in this profile.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The guide explains the role of each component in an IPSec VPN. It differentiates the IKE Crypto profile (Phase 1) from the IPSec Crypto profile (Phase 2).

Reference: Section "Set Up an IPSec VPN

" Step 5: "Add an IPSec Crypto profile to specify the protocols and algorithms for authenticating and encrypting traffic in the IPSec security association (Phase 2)."

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The guide clarifies the function of the IKE Crypto profile

confirming it is for Phase 1.

Reference: Section "Set Up an IPSec VPN

" Step 4: "Add an IKE Crypto profile to specify the protocols and algorithms for authentication

encryption

and key exchange in the IKE security association (Phase 1)."