easyMultiple SelectObjective-mapped
PCNSA Practice Question: A network administrator is configuring a new Palo…
A network administrator is configuring a new Palo Alto Networks firewall for the first time. Which THREE initial configuration steps are required to allow basic outbound internet access from the internal network?
⚠ Common exam trap
Watch out — candidates often confuse optional features like DNS proxy or User-ID as mandatory steps, when in fact the core requirements are interface configuration, security policy, and NAT for outbound access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an IP address to the internal interface and set it as a Layer 3 interface.
The internal interface must be configured as a Layer 3 interface with an assigned IP address to route traffic. Without this, the firewall cannot forward packets from the internal network to the external network, as Layer 3 interfaces are required for IP routing and policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a DNS proxy to resolve domain names.
Why it's wrong here
DNS proxy is optional; clients can use external DNS.
- ✓
Assign an IP address to the internal interface and set it as a Layer 3 interface.
Why this is correct
Required for internal network connectivity.
- ✗
Enable User-ID to identify users on the network.
Why it's wrong here
User-ID is not needed for basic internet access.
- ✓
Create a Security policy rule that allows traffic from internal zone to external zone.
Why this is correct
Required to permit outbound traffic.
- ✓
Configure a source NAT policy to translate internal private IP addresses to the external public IP.
Why this is correct
Necessary for outbound internet access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.