Palo Alto Networks PCNSA Exam Questions 2025

D. It requires a valid URL Filtering license.

This is incorrect. DNS Security and URL Filtering are distinct, separately licensed services, although they can be used together for layered security.

E. It requires an active subscription to a third-party DNS Security service.

This is incorrect. The DNS Security service is a first-party solution developed and maintained by Palo Alto Networks, leveraging its own threat intelligence infrastructure.

---

1. Palo Alto Networks. (2021). DNS Security Datasheet.

Page 1, "Highlights" section: "Applies predictive analytics, machine learning, and automation to block attacks that use DNS." (Supports options A and C).

Page 1, "Prevent C2 and Data Theft" section: "Protections for DNS tunneling, DGA, and more..." (Supports option A).

Page 2, "Licensing Information" section: "The DNS Security subscription is available as a standalone subscription, as part of the Threat Prevention subscription..." While available standalone, its inclusion with Threat Prevention is a primary characteristic and common deployment model, making option B a valid characteristic of its licensing structure.

2. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide, Version 10.1.

Section: "DNS Security" > "DNS Security Concepts": "To use DNS Security, you must purchase and install a DNS Security license. The DNS Security license is included with the Threat Prevention (TP) license." (Directly supports option B).

Section: "DNS Security" > "DNS Security Analytics": "The DNS Security service uses machine learning and predictive analytics to provide real-time DNS request analysis..." (Supports option C).

3. Palo Alto Networks. (2023). PCNSA Study Guide.

Domain 2: "Deploy and Configure Security Components" > Objective 2.2: This section details the security subscriptions, clarifying that DNS Security is bundled with the Threat Prevention license and is distinct from the URL Filtering license. It also describes the service's use of ML, predictive analytics, and detection of DGA and DNS tunneling. (Supports A, B, C and refutes D).

B. an additional subscription free of charge: The service is not an "additional subscription." It is a feature available to all customers who have a valid, standard support account.

C. a firewall device running with a minimum version of PAN-OS 10.1: This statement is factually correct but incomplete. It omits Prisma Access, which is also a supported platform for the EDL Hosting Service.

D. an additional paid subscription: This is incorrect. The EDL Hosting Service is provided free of charge to customers with a valid support account.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "Objects > External Dynamic Lists > External Dynamic List Hosting Service". The guide states, "The EDL Hosting Service is available for all supported Palo Alto Networks firewalls and Prisma Access." It also clarifies, "The EDL Hosting Service is available free of charge to all Palo Alto Networks customers with a valid support account."

2. Palo Alto Networks. (2021). PAN-OS® New Features Guide Version 10.1. "Policy > External Dynamic List Hosting Service". This document confirms the feature's introduction: "The External Dynamic List (EDL) Hosting service is a new cloud-based solution...This feature is introduced in PAN-OS 10.1." This supports the fact that option C is a valid but incomplete requirement.

B. Reset both: While this action also preserves server resources, it sends a reset to the client as well. This notifies the source that a firewall is present, which is often undesirable from a security standpoint as it aids in network reconnaissance.

D. Deny: In the context of a configurable Security policy rule action, Deny and Drop are functionally identical; both silently discard the packet. However, Drop is the specific action name listed in the policy configuration, making it the more precise term.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2, "Security Policy Actions".

Page/Section: In the chapter on Security Policies, the section "Security Policy Actions" describes the different termination actions.

Quote/Content for 'Drop': "Silently drops the traffic; does not send a response to the host or server. Use a drop action to thwart network scanning attempts because it provides no indication of a live port." This supports Drop as a method to preserve resources by preventing engagement.

Quote/Content for 'Reset server': "Sends a TCP reset to the server-side of the connection. This option is useful for applications that do not gracefully handle a client-side reset." This confirms it is a distinct action focused on clearing the server's state.

2. Palo Alto Networks PAN-OS® Administrator's Guide 9.1, "Take Action on a Security Policy Rule".

Page/Section: In the chapter "Create and Manage Security Policy Rules", the section on actions details the behavior of each option.

Content: The guide explains that a drop action prevents the session from being established, thereby conserving server resources. It also describes the reset-server action as a method to terminate the session specifically on the server side, which directly addresses the goal of clearing server-side sockets.

A. A URL category matches traffic based on the website's URL, not the specific application (App-ID) being used for file sharing.

B. This is also a URL category. It is not a dynamic application-based object and would not automatically incorporate new file-sharing App-IDs.

C. An application group is a static list of specific applications. It would require manual updates to add new file-sharing App-IDs.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.2. "Objects > Application Objects > Create an Application Filter". The guide states, "An application filter dynamically groups applications based on application attributes... When a content update includes a new application that matches the attributes you defined for the filter, the new application is automatically added to the filter."

2. Palo Alto Networks. (2023). PCNSA Study Guide. "Chapter 4: Securing Traffic with Security Policies". This guide contrasts static application groups with dynamic application filters, explaining that filters are the appropriate tool when the goal is to create a policy that automatically adapts to new applications matching specific criteria, such as a subcategory.

3. Palo Alto Networks TechDocs. "Application Filter". This document explicitly details the dynamic nature of application filters: "Because an application filter is a dynamic object, you don’t have to update it when a content release includes new applications that match the filter criteria."

C. IS-IS: Intermediate System to Intermediate System (IS-IS) is a standardized routing protocol, but it is not supported by the PAN-OS virtual router.

D. EIGRP: Enhanced Interior Gateway Routing Protocol (EIGRP) is a Cisco-proprietary protocol and is therefore not supported on Palo Alto Networks firewalls.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.2. In the "Networking > Virtual Routers > Dynamic Routing Protocols" section, the document explicitly states, "The firewall supports the following dynamic routing protocols: BGP, OSPFv2, OSPFv3, RIPv1, and RIPv2."

2. Palo Alto Networks. (2021). Palo Alto Networks Certified Network Security Administrator (PCNSA) Study Guide 10.1. In "Module 3: Simplifying the Network with Routing > Virtual Routers," the guide lists the supported dynamic routing protocols as BGP, OSPF, and RIP.

A. It was blocked by the Vulnerability Protection profile action.

This is incorrect because the log "Type" is spyware. A block by a Vulnerability Protection profile would result in a log entry with the "Type" of vulnerability.

B. It was blocked by the Anti-Virus Security profile action.

This is incorrect because the log "Type" is spyware. A block by an Anti-Virus profile would result in a log entry with the "Type" of virus.

D. It was blocked by the Security policy action.

This is incorrect. The Security policy rule "Outbound-Traffic" permitted the session, which then triggered inspection by the attached Security Profiles. The block action was a result of the profile's threat detection, not the policy rule's primary action.

---

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.2.

Section: Monitor > Logs > Threat Log Fields.

Content: This section defines the fields in the Threat log. The "Type" field is described as the "Subtype of the threat log," with possible values including spyware, vulnerability, and virus, directly corresponding to the Security Profile that generated the log. This confirms that a spyware type log is generated by the Anti-Spyware profile.

2. Palo Alto Networks. (2023). Palo Alto Networks Certified Network Security Administrator (PCNSA) Study Guide.

Section: Chapter 5, "Decryption and Threat Prevention," sub-section "Anti-Spyware."

Content: The guide explains that the Anti-Spyware profile protects against malicious spyware and command-and-control (C2) traffic. It states that when the firewall detects a threat matching a signature in the profile, it takes the configured action (e.g., block) and generates a Threat log entry of the spyware type.

3. Palo Alto Networks. (2021). Firewall 10.2 Essentials: Configuration and Management (EDU-210) Student Guide.

Section: Module 8, "Denying Threats Using Security Profiles."

Content: This courseware details how Security Profiles are attached to Security policy rules to inspect allowed traffic. It clarifies that a Threat log is generated when a signature is matched within a profile (such as Anti-Spyware), and the action in the log reflects the profile's configuration, not the parent Security policy rule's action.

C. Tap: A Tap interface operates in a passive, listen-only mode. It receives a copy of traffic from a switch's SPAN port and cannot be used to block or modify the live traffic stream.

E. HA: High Availability (HA) is a feature for firewall redundancy, not an interface deployment method for inspecting transit traffic. Dedicated HA interfaces are used for synchronization and state-sharing between firewalls.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

Virtual Wire: "A virtual wire deployment simplifies installation because you can insert the firewall into an existing topology... You can apply Security, DoS Protection, and QoS policies on the virtual wire to control traffic and protect your network." (Reference: Chapter: Plan Your Network Deployment > Firewall Interface Deployment Methods > Virtual Wire Deployment)

Layer 2: "In a Layer 2 deployment, the firewall is installed transparently on a network segment... You can enable traffic inspection by configuring Security, DoS Protection, and QoS policies..." (Reference: Chapter: Plan Your Network Deployment > Firewall Interface Deployment Methods > Layer 2 Deployment)

Layer 3: "In a Layer 3 deployment, the firewall routes traffic between multiple ports... The firewall protects the network by inspecting all traffic that it routes and applying Security, DoS Protection, and QoS policies." (Reference: Chapter: Plan Your Network Deployment > Firewall Interface Deployment Methods > Layer 3 Deployment)

Tap: "In tap mode, the firewall monitors traffic flowing across a network... Because the firewall is not in-line with traffic, a tap deployment is for monitoring only; you cannot use it to control traffic." (Reference: Chapter: Plan Your Network Deployment > Firewall Interface Deployment Methods > Tap Deployment)

A. This describes the "drop" action, which silently discards packets without sending any notification to the client or server.

B. The App-ID database is used for application identification, not for defining default deny actions within a specific Security policy rule.

C. This describes the "reset-both" action, which sends a TCP reset packet to both the client and the server, not just the client.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.1. "Objects > Security Policy > Actions". In this section, the guide specifies the behavior for the "Deny" action: "For TCP, the firewall sends a TCP reset to the client-side of the connection... The Deny action is a 'graceful' close to the session because a notification is sent to the client."

2. Palo Alto Networks. (2020). Palo Alto Networks Certified Network Security Administrator (PCNSA) Study Guide. Module 4: "Securing Traffic with Security Policies". The guide states, "Deny: For TCP traffic, this action sends a TCP reset to the client. For UDP traffic, it sends an ICMP Port Unreachable message to the client." This confirms that "deny" is a client-side notification action.

A. HIP profile: A Host Information Profile (HIP) is used to assess the security posture of an endpoint, not to group or control applications based on their function or category.

B. Application group: An Application Group is a static list of manually selected applications. While it could be used, it is not dynamic and would require manual updates if new office-program applications are added.

C. URL category: A URL Category is used for web filtering to control access to websites based on their URLs. It does not group applications identified by App-ID.

---

1. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "Objects > Application Filters": "Create an Application Filter to dynamically group applications based on application attributes that you define: Category, Subcategory, Technology, Risk, and Characteristic. The firewall dynamically populates an application filter with applications that match the attributes you define. When Palo Alto Networks adds new applications with attributes that match your filter, the firewall automatically adds the new applications to your filter and to any policy that uses the filter." (This directly supports the use of Application Filters for subcategories).

2. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "Objects > Application Groups": "An application group is a static list of applications that you can use in policies." (This confirms Application Groups are static, making them less suitable than dynamic filters).

3. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "Objects > Security Profiles > URL Filtering": "URL Filtering enables you to safely enable web access and control the sites users can access." (This clarifies that URL categories are for web access, not application control).

4. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "GlobalProtect > Host Information": "A Host Information Profile (HIP) is a report of the security status of an end-user’s computer... You can use this information in a HIP object and then attach the object to a security policy to enforce access privileges based on the security of the endpoint." (This confirms HIP profiles are for endpoint posture assessment).

A. Application groups: These are collections of applications identified by App-ID, not just port numbers. They provide a more granular, Layer 7 classification.

C. Address groups: These are used to group IP addresses, subnets, or FQDNs, which relate to the source or destination of traffic, not the port.

D. Custom objects: This is too general. While you create custom service objects, the specific container for grouping them is a "Service Group."

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide, Release 10.1.

Section: Objects > Services

Content: "A service is a combination of a protocol and port that you can use in policies and other firewall functions... A service group is a collection of services that you can use to simplify rule creation and management." This directly states that services (port-based objects) are collected in service groups.

2. Palo Alto Networks. (2021). PCNSA Study Guide.

Section: Module 3: Security and NAT Policies

Content: The guide explains the components of a security policy rule, explicitly defining the "Service" column as representing TCP/UDP ports. It further details that "Service Groups" are used to combine multiple service objects into a single entity for use in these rules.