hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: A company has a Palo Alto Networks firewall in a…
A company has a Palo Alto Networks firewall in a data center, connecting internal users (zone: Internal) to the internet (zone: Untrust). Recently, users report that they cannot access the corporate HR portal hosted on a server in the DMZ (zone: DMZ, IP 10.10.10.10) using HTTPS. The firewall has a security policy that allows traffic from Internal to DMZ with application web-browsing and service https-ssl. The policy is in place and committed. The administrator verifies that the web server is running and reachable from within the DMZ. From the firewall, a ping from the management interface to the server is successful. However, when a user tries to access https://10.10.10.10, the connection times out. Traffic logs show no sessions logged for that traffic. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is missing the source zone; the traffic is being blocked by an implicit deny rule before any policy match.
Since there are no sessions in the traffic log, the traffic is being dropped by the implicit deny rule, meaning no security policy matched. The most likely reason is that the policy's source zone is not set to Internal; if it were set to another zone (e.g., Untrust), the traffic from Internal would not match. Option B would likely produce sessions if matched by another policy. Option C would show sessions but no return traffic. Option D is incorrect because SSL decryption is not required for HTTPS to be allowed through the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy is missing the source zone; the traffic is being blocked by an implicit deny rule before any policy match.
Why this is correct
If the source zone is not correctly configured, the policy won't match, and the traffic will hit the implicit deny rule, resulting in no log entries.
- ✗
There is a routing issue preventing return traffic from reaching the firewall.
Why it's wrong here
A routing issue would typically cause sessions to be created but with no return traffic, resulting in partially logged sessions, not zero sessions.
- ✗
The policy has the wrong destination zone; the server is actually in the Internal zone.
Why it's wrong here
If the destination zone were wrong, the traffic might match a different policy, but the absence of any sessions suggests no policy match at all.
- ✗
The firewall is not configured to perform SSL decryption; thus HTTPS traffic is being blocked.
Why it's wrong here
SSL decryption is optional; the firewall can allow HTTPS traffic without decryption if the policy permits the application and service.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.