PCNSA Policy Evaluation and Management Practice Question
A network administrator is tasked with implementing a policy that allows traffic from the 'Sales' zone to the 'Internet' zone only for web-browsing (application: web-browsing) and blocks all other traffic. The administrator creates a rule at the top of the security policy with source zone Sales, destination zone Internet, application web-browsing, action allow. Below that, a rule with source zone Sales, destination zone Internet, application any, action deny. After committing, users in Sales can browse the web normally. However, the administrator discovers that some users are able to use applications like YouTube and Facebook which use web-browsing as part of their app-id. The administrator wants to ensure that only HTTP/HTTPS traffic for general web browsing is allowed, not other web-based applications. What should the administrator do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use URL filtering to block the social networking and streaming media categories.
Using URL filtering to block social media categories is effective and does not interfere with general web browsing. Changing the allow rule's application to HTTP/HTTPS would still allow Facebook and YouTube because they use HTTPS. Custom application filters or deny rules are less precise or affect allowed traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the allow rule's application to include only HTTP and HTTPS.
Why it's wrong here
Incorrect. Facebook and YouTube use HTTPS, so they would still be allowed.
- ✓
Use URL filtering to block the social networking and streaming media categories.
Why this is correct
Correct. URL filtering by category allows general web browsing while blocking specific types of sites like social media and video streaming.
- ✗
Add a custom application filter to block social media applications.
Why it's wrong here
Adding a custom application filter for social media applications fails because it addresses the symptom, not the root cause. This feature groups existing App-IDs for simplified policy management, but it does not redefine or narrow the broad 'web-browsing' application ID, which is the source of the problem. The administrator needs to permit only general HTTP/HTTPS traffic, not block specific applications that fall under the existing 'web-browsing' definition. This option is tempting as it directly relates to blocking unwanted applications, and would be correct if the goal was simply to consolidate multiple deny rules for specific social media applications into a single, more manageable policy.
- ✗
Change the deny rule to block social media applications.
Why it's wrong here
Incorrect. Denying social media apps would only work if they are identified as separate apps; many use web-browsing app-id.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.