PCNSA Device Management and Services Practice Question
A network security administrator is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable only via a specific interface in the 'untrust' zone. The administrator creates a syslog server profile and a log forwarding profile. Which additional configuration is required to ensure that syslog messages are sent from the firewall's interface in the 'untrust' zone?
⚠ Common exam trap
The trap here is thinking that zones or security policies can control the source interface of management-plane traffic like syslog.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a service route for syslog that uses the specific source interface.
Syslog is a management-plane service. By default, it sources from the management interface. To send syslog from a dataplane interface, you must configure a service route for syslog that specifies the desired source interface. This ensures the syslog server receives traffic from the correct IP and that return traffic is routed properly. Other options do not control the source interface for syslog.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a policy-based forwarding rule that redirects syslog traffic to the 'untrust' interface.
Why it's wrong here
Policy-based forwarding (PBF) is used to override the routing table for specific traffic based on policy. While PBF can influence egress interface, it is not the correct mechanism for syslog source interface selection. Service routes are specifically designed for management-plane services like syslog, SNMP, and email. PBF would not apply to management-plane generated traffic.
- ✗
Enable 'Use Management Interface for Syslog' under Device > Setup > Services.
Why it's wrong here
There is no such option to enable or disable management interface for syslog. By default, syslog uses the management interface, but you cannot simply toggle it off. To use a dataplane interface, you must configure a service route. This option does not exist, and the correct method is service routes.
- ✗
Assign the syslog server profile to the 'untrust' zone under Network > Zones.
Why it's wrong here
Zones do not have syslog server profile assignments. Zones are used for security policy and interface grouping. Log forwarding profiles are applied to security policies, not zones. Assigning a syslog server profile to a zone is not a valid configuration and would not affect the source interface of syslog messages.
- ✓
Configure a service route for syslog that uses the specific source interface.
Why this is correct
Service routes allow you to specify the source interface and IP address for outbound services like syslog. By default, syslog uses the management interface. To force syslog traffic out of a specific dataplane interface, you must configure a service route for syslog with the desired source interface. This ensures the syslog server sees traffic from the correct IP and that routing is correct.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.