← Back to Portal

PCNSA Study Material

Flashcards & Memory Anchors

Click any card to reveal the answer. Work through all 20 flashcards, review the 4 mnemonic anchors, then check the domain summary cards.

20 flashcards 4 mnemonics 5 domain summaries Click to flip

20 Flashcards — Click to Flip

D1 · Device Management

What is the factory default management IP and admin credential?

Click to flip

D1 · Device Management

IP: 192.168.1.1/24
Credentials: admin / admin
Change the password immediately on first login.

D1 · Device Management

What port does a managed firewall use to communicate with Panorama?

Click to flip

D1 · Device Management

TCP 3978
The firewall initiates outbound. Panorama listens on 3978. Also requires TCP 28 for log forwarding.

D1 · Device Management

What does 'Commit and Push' from Panorama do?

Click to flip

D1 · Device Management

Commit saves changes to Panorama's DB.
Push distributes to managed firewalls.
Commit alone does NOT change managed devices.

D2 · Networking

Which interface type passes traffic transparently with no IP address, no routing, and no MAC learning?

Click to flip

D2 · Networking

Virtual Wire — passes traffic between two interfaces transparently. Security policies still apply. Ideal for inline deployment with no network changes.

D2 · Networking

Virtual Router purpose in PAN-OS?

Click to flip

D2 · Networking

Maintains an independent routing table. All Layer 3 interfaces are assigned to a VR. Multiple VRs = isolated routing domains.

D2 · Networking

Routing priority for equal-prefix routes in PAN-OS (lowest admin distance wins). Order: static, eBGP, OSPF?

Click to flip

D2 · Networking

Static = 10
eBGP = 20
OSPF = 30
Connected = 0. Longest prefix always wins first.

D3 · App-ID/User-ID

What does App-ID = 'unknown-tcp' mean?

Click to flip

D3 · App-ID/User-ID

The application could NOT be identified using any signature, heuristic, or decoder. Could be proprietary or insufficient data. Create a custom App-ID to classify it.

D3 · App-ID/User-ID

Which zones should have User-ID enabled?

Click to flip

D3 · App-ID/User-ID

Only trusted internal zones (corp-wifi, trust, internal). NEVER enable on untrust — attackers can spoof user identities from outside.

D3 · App-ID/User-ID

Security Profile Group vs individual profiles — can you use both on the same rule?

Click to flip

D3 · App-ID/User-ID

No. A rule uses EITHER a Profile Group OR individual profiles. Adding an individual profile to a rule using a Group replaces the Group setting.

D4 · Policies

For OUTBOUND SNAT, what addresses does the security policy use?

Click to flip

D4 · Policies

Source: Pre-NAT (private IP e.g. 10.x.x.x)
Destination Zone: Post-NAT zone (untrust)
Destination IP: Pre-NAT destination

D4 · Policies

For INBOUND DNAT (public → private), what does the security policy use as destination?

Click to flip

D4 · Policies

Destination IP: Post-NAT private IP (e.g. 10.0.1.10)
Destination Zone: Post-NAT zone (trust)

D4 · Policies

What is the default action for intrazone traffic?

Click to flip

D4 · Policies

Allow — the default intrazone-default rule allows all traffic within the same zone. The default interzone-default rule denies all cross-zone traffic.

D5 · Network Protection

WildFire Analysis Profile vs Antivirus Profile — which controls forwarding and which controls blocking?

Click to flip

D5 · Network Protection

WildFire Analysis Profile = controls WHAT to forward for analysis.
Antivirus Profile = controls WHAT ACTION on WildFire verdicts (block/alert).

D5 · Network Protection

What is the prerequisite for SSL Forward Proxy to work without browser warnings?

Click to flip

D5 · Network Protection

The firewall's Forward Trust CA certificate must be distributed to all client devices and trusted in the browser/OS certificate store (e.g., via GPO).

D5 · Network Protection

GlobalProtect: what is the Portal vs Gateway role?

Click to flip

D5 · Network Protection

Portal: authenticates users, delivers gateway list & config.
Gateway: terminates VPN tunnels, enforces security policy.

D5 · Network Protection

IKE Phase 1 vs Phase 2 — what does each establish?

Click to flip

D5 · Network Protection

Phase 1 = ISAKMP SA (management/control channel), peer auth.
Phase 2 = IPsec SA (data channel), encryption for actual traffic.

D5 · Network Protection

Anti-Spyware 'Sinkhole' action — what does it do?

Click to flip

D5 · Network Protection

Redirects DNS queries for known C2 domains to a sinkhole IP. Infected hosts connecting to the sinkhole IP are identified in logs. Combine with a block rule for sinkhole IP to prevent C2.

D1 · Device Management

What is the HA2 link used for?

Click to flip

D1 · Device Management

HA2 = data sync: session tables, IPsec SA, routing state.
HA1 = heartbeat + configuration sync (control plane).

D4 · Policies

URL category action 'Continue' — what happens?

Click to flip

D4 · Policies

User sees a warning page explaining the category, can click to proceed. Access is logged. Used for awareness-without-blocking.

D3 · App-ID/User-ID

When is an App-ID reclassification (session shift) dangerous?

Click to flip

D3 · App-ID/User-ID

When a rule allows 'ssl' but the session shifts to 'google-drive-web', if no rule allows the new app, the session is blocked mid-session. Always include dependent applications.

4 Memory Anchors

NAT + Policy Order
RNSP
R Route lookup (determines egress)
N NAT lookup (determines post-NAT zone)
S Security Policy check (pre-NAT addr, post-NAT zone)
P Packet modification (NAT applied) then egress
Security Profile Rules
AAVUF
A Antivirus — known malware files
A Anti-Spyware — C2, DNS sinkhole
V Vulnerability Protection — CVE exploits (IPS)
U URL Filtering — web categories
F File Blocking / WildFire — unknown files
Interface Types
L3-L2-VW-TAP
L3 Routed, IP address, full policy
L2 Switch-like, MAC forwarding, no IP
VW Transparent pass-through, no IP, no routing
TAP Passive SPAN monitor, no blocking possible
IKE VPN Two Phases
P1=CTRL, P2=DATA
P1 ISAKMP SA — control channel, peer auth, DH key exchange
P2 IPsec SA — data encryption/auth for actual traffic
! ALL Phase 1 params must match exactly on both peers

5 Domain Summary Cards

D1

Device Management & Initial Config

~15–16% of exam

  • Default IP: 192.168.1.1, credentials: admin/admin
  • HA: HA1=control, HA2=session sync, Group ID=virtual MAC
  • Panorama: Templates (device config) vs Device Groups (policies)
  • Commit required for all changes; Validate Commit before production
  • Sequential major version upgrades only

D2

Networking

~18% of exam

  • Layer 3 = routed; Layer 2 = switch; VWire = transparent; Tap = passive
  • Virtual Router = routing table; must assign all L3 interfaces
  • Admin distance: connected=0, static=10, eBGP=20, OSPF=30
  • Zone Protection: Flood protection + Reconnaisance + Packet-based

D3

App-ID, User-ID & Security Profiles

~14% of exam

  • App-ID: DPI signatures, not port-based; unknown-tcp = unidentified
  • User-ID: only on trusted zones; Event log IDs 4624/4634
  • Profiles only work on Allow rules; profile groups OR individual profiles
  • WildFire: Analysis Profile = forward; Antivirus Profile = block on verdict

D4

Security & NAT Policies

~24% of exam

  • Top-to-bottom evaluation; first match wins
  • Outbound SNAT: policy = pre-NAT source, post-NAT dest zone
  • Inbound DNAT: policy = post-NAT dest IP, post-NAT dest zone
  • U-Turn: both DNAT + SNAT required for return path
  • URL category 'Continue' = warn + log, not block

D5

Network Protection

~28–29% of exam

  • SSL FP: forward-trust CA must be deployed to clients via GPO
  • No-Decrypt rule ABOVE Decrypt rule in decryption policy
  • GP: Portal=config/auth, Gateway=VPN termination/policy
  • IPsec Phase 1 = ISAKMP SA; Phase 2 = IPsec SA (data)
  • ALL Phase 1 params must match exactly; one mismatch = full failure