PCNSA Securing Traffic Practice Question
A network security administrator is configuring a security policy rule to allow DNS traffic from the Trust zone to the Untrust zone. The rule uses application dns and service application-default. Users report that DNS queries to external servers are failing. The administrator notices that the firewall is allowing the DNS queries but the responses are being dropped. What is the most likely cause?
⚠ Common exam trap
The trap here is assuming that a security policy rule must explicitly allow return traffic, when in fact stateful inspection handles it—unless asymmetric routing breaks the session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS responses are being dropped due to asymmetric routing where the response takes a different path and the firewall does not see the return traffic.
Stateful firewalls require that return traffic for a session traverse the same firewall. If DNS responses take a different path (asymmetric routing), the firewall does not recognize them as part of an existing session and drops them. This is a frequent cause of DNS failures when multiple paths exist. Ensuring symmetric routing or using NAT can resolve the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The return traffic is being dropped because the security policy rule does not allow the dns application in the reverse direction.
Why it's wrong here
Security policy rules are unidirectional, but the firewall automatically allows return traffic for allowed sessions through stateful inspection. A separate rule for the reverse direction is not required for the same session. The drop is likely due to a different reason, such as asymmetric routing or session timeout.
- ✓
The DNS responses are being dropped due to asymmetric routing where the response takes a different path and the firewall does not see the return traffic.
Why this is correct
If the DNS response takes a different path and does not return through the same firewall, the firewall will not have a session for the response and will drop it. This is a common issue with asymmetric routing. The security policy allows the outbound query, but without the return path, the session cannot complete, causing DNS failures.
- ✗
The firewall is performing DNS sinkholing and dropping the responses.
Why it's wrong here
DNS sinkholing is a feature that redirects malicious DNS queries to a sinkhole IP, but it does not drop responses for legitimate queries. If sinkholing were configured, the queries would be redirected, not the responses dropped. The scenario describes allowed queries but dropped responses, which is not typical of sinkholing.
- ✗
The security policy rule does not allow the dns-base application.
Why it's wrong here
The dns-base application is a subset of dns and is used for basic DNS functionality. Allowing dns should inherently include dns-base. The issue is not a missing application but rather the asymmetric return path or session handling. The firewall typically allows responses for allowed sessions, so the problem lies elsewhere.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.