mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: A network administrator notices that traffic from…
A network administrator notices that traffic from the internal network to a specific external server is being blocked unexpectedly. The firewall policy allows any-to-any outbound traffic. The administrator checks the Unified Policy and sees a Security policy rule that permits the traffic, but the traffic is still blocked. What is the most likely cause?
⚠ Common exam trap
Many candidates confuse Zone Protection profiles (applied to zones) with DoS Protection profiles (applied to Security rules), leading them to incorrectly select Zone Protection as the cause of a per-rule traffic block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Security policy rule has a DoS Protection profile applied that is dropping traffic.
When a Security policy rule permits traffic but it is still blocked, the most likely cause is that a DoS Protection profile is applied to the rule. DoS Protection profiles can drop traffic based on session rate thresholds or other attack signatures, even when the base Security rule allows the session. This is a common misconfiguration because the profile operates as an additional enforcement layer above the permit action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Zone Protection profile is dropping the traffic.
Why it's wrong here
Zone Protection profiles apply at the zone level, and the admin checked only Security policy.
- ✓
The Security policy rule has a DoS Protection profile applied that is dropping traffic.
Why this is correct
DoS Protection profiles can drop traffic even if the rule permits it.
- ✗
A decryption policy is blocking the traffic.
Why it's wrong here
Decryption policies do not block traffic; they control decryption.
- ✗
The Security policy rule has a source zone mismatch.
Why it's wrong here
The rule allows any-to-any, so zone mismatch is unlikely.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.