PCNSA Device Management and Services Practice Question
A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates confuse a 403 Forbidden error with a certificate or connectivity problem, when in fact it indicates the firewall is actively rejecting the HTTP request due to a management profile permission being revoked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Management profile HTTP permission revoked
The management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP certificate expired
Why it's wrong here
HTTPS works, so certificate is not the issue.
- ✗
HTTP is disabled by default after upgrade
Why it's wrong here
While HTTP may be disabled by default, the specific error 403 indicates a permissions issue.
- ✓
Management profile HTTP permission revoked
Why this is correct
The management profile controls access; HTTP access may have been disabled during the upgrade.
- ✗
Browser caching issue
Why it's wrong here
Unlikely to cause 403 on multiple browsers.
- ✗
HTTP port conflict
Why it's wrong here
No evidence of port conflict; HTTPS works.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.