Core Concepts for Palo Alto Networks Certified Network Security Engineer (PCNSE)

Sample Practice Questions

1. Question 1

   Which two virtualization platforms officially support the deployment of Palo Alto Networks VM-Series firewalls? (Choose two.)
   1. A. Red Hat Enterprise Virtualization (RHEV)
   2. B. Kernel Virtualization Module (KVM)
   3. C. Boot Strap Virtualization Module (BSVM)
   4. D. Microsoft Hyper-V
   Explanation

   The correct answers are: B. Kernel Virtualization Module (KVM), D. Microsoft Hyper-V.

   KVM and Microsoft Hyper-V are both officially supported hypervisors for the VM-Series, alongside VMware ESXi and the major public clouds, and each has its own deployment guide covering the image format and interface presentation the firewall expects. Red Hat Enterprise Virtualization is not on the supported list even though it is built on KVM, and that distinction is practical rather than pedantic: support is granted against a specific management and virtualisation stack, not merely against the underlying kernel technology, so a KVM host managed by RHEV falls outside what has been validated. Boot Strap Virtualization Module is not a product at all. The name borrows the genuine concept of bootstrapping, which is the method used to supply a VM-Series with its initial configuration at first boot, and attaches it to a hypervisor that does not exist. Answering correctly comes down to recognising which names correspond to real, separately documented deployment targets.

2. Question 2

   An administrator logs in to the Palo Alto Networks NGFW and reports that the WebUI is missing the Policies tab. Which profile is the cause of the missing Policies tab?
   1. A. Admin Role
   2. B. WebUI
   3. C. Authentication
   4. D. Authorization
   Explanation

   The correct answer is: A. Admin Role.

   An Admin Role profile defines which parts of the web interface an administrator can see and what they may do there, tab by tab, so a missing Policies tab means the role assigned to that account has it disabled. This is the intended mechanism for building read-only auditors, monitoring-only operators or staff who manage objects but not rules, and the effect is precisely what was reported: the tab is absent rather than present and refusing changes. There is no WebUI profile in PAN-OS; web interface access is governed by the Admin Role profile together with the management interface and Interface Management profile settings that decide whether the service answers at all. An authentication profile establishes how the administrator's credentials are checked, locally or against an external service, and has no influence over what appears once the session is open. Authorization is not a profile type in its own right either, because the authorisation decision is expressed through the admin role, whether that role is defined locally or returned by RADIUS, TACACS+ or SAML.

3. Question 3

   An administrator has left a firewall to use the default port for all management services. Which three functions are performed by the dataplane? (Choose three.)
   1. A. WildFire updates
   2. B. NAT
   3. C. NTP
   4. D. antivirus
   5. E. file blocking
   Explanation

   The correct answers are: B. NAT, D. antivirus, E. file blocking.

   PAN-OS splits work between a management plane and a data plane, and that division is what this question tests. NAT, antivirus scanning and file blocking are all data plane functions because they act on traffic passing through the firewall: address translation rewrites headers in the forwarding path, while antivirus and file blocking are content inspection applied by the single-pass engine once App-ID has identified the session. WildFire updates and NTP belong to the management plane, which handles the firewall's own housekeeping rather than transiting traffic. Downloading a content update is an outbound request the firewall makes on its own behalf, and synchronising the clock is a system service; both use the management interface by default, or a data interface where a service route redirects them, but neither inspects a passing session. Keeping the split clear is what lets an administrator reason about performance, because heavy logging and reporting load the management plane while decryption and content inspection load the data plane.

4. Question 4

   What are the differences between using a service versus using an application for Security Policy match?
   1. A. Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an "application" allows the firewall to take immediate action if the port being used is a member of the application standard port list.
   2. B. There are no differences between "service" or "application". Use of an "application" simplifies configuration by allowing use of a friendly application name instead of port numbers.
   3. C. Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an "application" allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used
   4. D. Use of a "service" enables the firewall to take action after enough packets allow for App-ID identification
   Explanation

   The correct answer is: C. Use of a "service" enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an "application" allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used.

   The distinction is when the firewall can act and on what evidence. A service entry is a port definition, so the firewall can match and enforce on the very first packet using nothing more than the TCP or UDP port numbers in the header. An application entry relies on App-ID, which needs enough of the conversation to run its decoders, signatures and heuristics, so enforcement begins a few packets in but is then independent of the port the traffic actually uses. That independence is the whole value of App-ID: an application moved to a non-standard port is still recognised, and an open port no longer implies the application it was intended to carry. The option claiming there is no practical difference and that applications are merely friendlier names for ports misses this completely, since the two match on different evidence at different points in the flow. The remaining options swap the two behaviours around, having services wait for App-ID identification or having applications act immediately on membership of a standard port list.

5. Question 5

   Which Palo Alto Networks VM-Series firewall is valid?
   1. A. VM-25
   2. B. VM-800
   3. C. VM-50
   4. D. VM-400
   Explanation

   The correct answer is: C. VM-50.

   The VM-Series models are numbered VM-50, VM-100, VM-200, VM-300, VM-500 and VM-700, with the VM-50 at the entry point of the range and aimed at branch or small-scale virtualised deployments. The numbering reflects capacity in sessions, throughput, rule counts and supported interfaces, all enforced by the license applied to the instance rather than by the image, which is identical across models. VM-25, VM-400 and VM-800 look plausible precisely because they follow the same naming pattern, but none corresponds to a real model and there is no way to derive them from the licensed tiers. This matters beyond memorisation, because sizing a VM-Series deployment means matching a real model's published capacity to the expected load, and a license applied to an undersized instance caps sessions and throughput no matter how much CPU and memory the hypervisor has been asked to provide.

Other Palo Alto Networks Certified Network Security Engineer (PCNSE) domains

• Deploy and Configure Core Components (48 questions)
• Deploy and Configure Features and Subscriptions (88 questions)
• Deploy and Configure Firewalls Using Panorama (39 questions)
• Manage and Operate (39 questions)
• Troubleshooting (33 questions)