hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: A firewall is configured with multiple virtual…
A firewall is configured with multiple virtual routers. Traffic from a host in Vsys A needs to reach a server in Vsys B. Both virtual routers have direct routes to their respective subnets. What additional configuration is required?
⚠ Common exam trap
Candidates often assume security rules alone are sufficient for inter-Vsys traffic, overlooking the fundamental requirement for a Layer 3 path between the virtual routers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.
Virtual routers in different virtual systems (Vsys) are isolated by default. To enable inter-Vsys routing, you must configure either a virtual wire (which bridges the two Vsys at Layer 2) or route redistribution (which allows routes from one virtual router to be shared with the other). This provides the necessary Layer 3 connectivity between the Vsys A and Vsys B subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a virtual wire or route redistribution between the virtual routers of Vsys A and Vsys B.
Why this is correct
Inter-vsys routing requires a path between the virtual routers, such as a virtual wire or route leak.
- ✗
Create a security rule that allows traffic from the source zone in Vsys A to the destination zone in Vsys B.
Why it's wrong here
Security rules cannot span vsys; they operate within a single vsys.
- ✗
Ensure both virtual routers are in the same virtual system.
Why it's wrong here
They are in different vsys; merging them defeats the purpose of segmentation.
- ✗
Configure a NAT policy to translate the source IP to an IP in Vsys B's subnet.
Why it's wrong here
NAT does not enable routing between different virtual routers.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.