Courseiva
← PCNSA
Full test
mediumMultiple ChoiceObjective-mapped

PCNSA Practice Question: A network administrator is configuring a new…

A network administrator is configuring a new security policy to allow specific inbound traffic to a web server. The policy must be as specific as possible to minimize risk. Which configuration approach is correct?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a security policy with source zone Untrust, destination zone DMZ, and service application-default.

Using 'service application-default' restricts traffic to the default port for the application identified by App-ID, providing both application and port specificity. This approach minimizes risk by ensuring only the intended application's default port is allowed. Options B and D use broad port-based services that permit any application on that port, increasing risk. Option C uses App-ID but only for web-browsing (HTTP), omitting ssl for HTTPS, thus blocking secure web traffic—a critical oversight for a web server serving HTTPS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Create a security policy with source zone Untrust, destination zone DMZ, and service application-default.

    Why this is correct

    Incorrect. service application-default is not a standard service object; it is vague and not specific. Also, it does not restrict traffic to a specific application.

  • ✗

    Create a security policy with source any, destination DMZ, and service http.

    Why it's wrong here

    Incorrect. Using source any is too broad and increases risk. The source zone should be specified as Untrust to limit inbound traffic from external sources.

  • ✗

    Create a security policy with source zone Untrust, destination zone DMZ, and application web-browsing.

    Why it's wrong here

    Correct. Using application web-browsing with App-ID ensures only web browsing traffic is allowed, regardless of port, providing the most specific control.

  • ✗

    Create a security policy with source zone Untrust, destination zone DMZ, and service http.

    Why it's wrong here

    Incorrect. Using service http restricts to port 80, but other applications could use that port, reducing specificity compared to App-ID.

About these practice questions

This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.