Courseiva
mediumMultiple ChoiceObjective-mapped

PCNSA Practice Question: A network administrator notices that traffic from…

A network administrator notices that traffic from the internal zone to the external zone is being denied, even though a security policy allowing all outbound traffic exists. The internal zone is configured with a zone protection profile that has Flood Protection enabled. What is the most likely cause of the denial?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.

The zone protection profile with Flood Protection can drop traffic that exceeds configured thresholds. If the thresholds are set too low, legitimate traffic may be mistaken for a flood and denied, even though a security policy allows it. This is the most likely cause of the denial. Option A is incorrect because the security policy allowing all outbound traffic overrides the implicit deny rule when a match occurs. Option C is incorrect because logging profiles do not affect traffic flow; they only control logging. Option D is incorrect because if a schedule were restricting access, the policy would not be active at the current time, but the question states the policy allows all outbound traffic, implying no schedule restriction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The security policy is set to deny due to an implicit deny rule.

    Why it's wrong here

    Since an explicit allow rule is configured, it overrides the implicit deny. The issue is not the policy itself but the zone protection profile.

  • The zone protection profile has Flood Protection thresholds set too low, causing legitimate traffic to be dropped.

    Why this is correct

    Flood Protection thresholds can drop traffic that exceeds defined limits, even if the traffic is legitimate.

  • The security policy has a logging profile attached that is blocking traffic.

    Why it's wrong here

    Logging profiles only specify how to log traffic, not whether to block or allow it.

  • The security policy has a schedule configured that is currently outside the allowed time.

    Why it's wrong here

    If a schedule were configured, it would be visible in the policy and would only deny traffic during off-hours, but the policy is set to allow always.

About these practice questions

One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.