mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: A network administrator notices that traffic from…
A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.
The zone protection profile with Flood Protection can drop traffic that exceeds configured thresholds. If the thresholds are set too low, legitimate traffic may be mistaken for a flood and denied, even though a security policy allows it. This is the most likely cause of the denial. Option A is incorrect because the security policy allowing all outbound traffic overrides the implicit deny rule when a match occurs. Option C is incorrect because logging profiles do not affect traffic flow; they only control logging. Option D is incorrect because if a schedule were restricting access, the policy would not be active at the current time, but the question states the policy allows all outbound traffic, implying no schedule restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security policy is set to deny due to an implicit deny rule.
Why it's wrong here
Since an explicit allow rule is configured, it overrides the implicit deny. The issue is not the policy itself but the zone protection profile.
- ✓
The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.
Why this is correct
Flood Protection thresholds can drop traffic that exceeds defined limits, even if the traffic is legitimate.
- ✗
The security policy has a logging profile attached that is blocking traffic.
Why it's wrong here
Logging profiles only specify how to log traffic, not whether to block or allow it.
- ✗
The security policy has a schedule configured that is currently outside the allowed time.
Why it's wrong here
If a schedule were configured, it would be visible in the policy and would only deny traffic during off-hours, but the policy is set to allow always.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.