PCNSA Policy Evaluation and Management Practice Question
A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?
⚠ Common exam trap
Many exam-takers assume firewalls use a 'most restrictive wins' model (like some ACL implementations) rather than the first-match model used by Palo Alto Networks, leading them to incorrectly select Option E.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic will be allowed because Rule1 matches before Rule2.
Palo Alto Networks firewalls use first-match policy evaluation: the first rule that matches the traffic's source zone, destination zone, source/destination IP, application, and user determines the action. Since Rule1 (allow) appears before Rule2 (deny), traffic from Engineering to Servers matches Rule1 first and is allowed, regardless of later deny rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The traffic will be allowed because Rule1 matches before Rule2.
Why this is correct
First-match logic: Rule1 matches first, so the action is allow; Rule2 is not evaluated.
- ✗
To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.
Why it's wrong here
There is no 'Negate' option for zones; you must reorder rules or use different criteria.
- ✗
Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.
Why it's wrong here
Moving Rule2 after Rule3 would still not match if Rule1 allows first; the order among the first two is critical.
- ✓
The administrator should move Rule2 above Rule1 to block the traffic.
Why this is correct
Placing the deny rule before the allow rule ensures the deny matches first.
- ✗
The firewall evaluates all rules and applies the most restrictive action (deny).
Why it's wrong here
Palo Alto firewalls use first-match, not most restrictive; they stop at the first matching rule.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.