PCNSA Securing Traffic Practice Question
A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?
⚠ Common exam trap
PCNSA often tests the precedence of custom URL categories over predefined categories; candidates pick the option that blocks both categories because they forget that custom allow rules override predefined block rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the social-networking category and allow a custom URL category containing LinkedIn URLs.
To block all social media except LinkedIn, you must block the social-networking URL category and allow a custom URL category containing LinkedIn URLs. URL filtering evaluates custom categories with higher priority than predefined categories, so the allow action for LinkedIn overrides the block for social-networking. This achieves the granular exception without unblocking the entire category.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block the social-networking category and allow a custom URL category containing LinkedIn URLs.
Why this is correct
Blocking the entire social-networking category denies all social media, then a custom URL category explicitly allowing LinkedIn URLs creates the permitted exception. URL filtering evaluates custom allow lists ahead of category blocks, so LinkedIn traffic passes while every other social-networking site remains blocked.
- ✗
Alert the social-networking category and block a custom URL category for LinkedIn.
Why it's wrong here
Alerting the social-networking category only logs matching traffic; it does not block it, so Facebook, X and Instagram remain reachable. A custom URL category for LinkedIn is the right mechanism for the exception, but alert alone cannot enforce the block. Alerting suits monitoring before enforcing a new policy.
- ✗
Block the social-networking category and block a custom URL category for LinkedIn.
Why it's wrong here
Blocking both categories denies LinkedIn along with the rest of social media, contradicting the stated exception. The custom URL category must be allowed, and URL filtering evaluates custom categories before predefined ones, so the allow entry overrides the block. Blocking both would be correct if no exception existed.
- ✗
Allow the social-networking category and block a custom URL category for LinkedIn.
Why it's wrong here
Allowing the social-networking category permits every social platform, so Facebook and X stay reachable despite the custom LinkedIn block. The predefined category must be blocked, with the custom URL category allowed as the exception. Allowing the category suits environments where social media is broadly permitted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.