PCNSA Policy Evaluation and Management Practice Question
A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.
The most likely cause is that the new subnet 10.10.20.0/24 is routed through a different virtual router (VR) than the VR used by the Internal zone's interface. In Palo Alto firewalls, security rules are zone-based, and the zone is determined by the ingress interface. If the traffic from the new subnet enters via an interface in a different VR, the zone may not be 'Internal', so the rule allowing SSH from Internal to DMZ does not apply. Option C correctly identifies this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application is not correctly identified because the SSH server uses a non-standard port.
Why it's wrong here
Incorrect. The problem is zone/VR-related, not application identification.
- ✗
There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.
Why it's wrong here
Incorrect. While possible, the question states other subnets in Internal work, so a deny rule specific to the new subnet is unlikely.
- ✓
The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.
Why this is correct
Correct. If the subnet's traffic enters via a different VR and zone, the security policy rule (which expects the Internal zone) will not match.
- ✗
The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.
Why it's wrong here
Incorrect. The subnet 10.10.20.0/24 is within 10.0.0.0/8, so the object includes it.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.