PCNSA Device Management and Services Practice Question
A network security engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The syslog server is reachable only through the untrust zone via the ethernet1/2 interface, which is in the untrust zone and uses the default virtual router. The engineer wants to ensure that syslog traffic egresses via ethernet1/2 and uses the correct source IP address. Which configuration should the engineer perform?
⚠ Common exam trap
The trap here is assuming that security policy or routing changes affect firewall-generated traffic, when in fact management services like syslog require service route configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Syslog service route under Device > Setup > Services > Service Route Configuration, selecting the 'custom' option for Syslog and specifying the source interface as ethernet1/2.
Syslog is an outbound management service, and its source interface is controlled by service routes. By default, it uses the management interface. To send syslog via ethernet1/2, a custom service route must be configured for Syslog, specifying ethernet1/2 as the source interface. Security policies, NAT, and static routes do not affect firewall-generated syslog traffic, so they cannot fulfill the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Use management interface for all services' under Device > Setup > Management and add a policy-based forwarding rule for syslog traffic.
Why it's wrong here
Enabling 'Use management interface for all services' forces all outbound services to use the management interface, which is the opposite of the requirement. Policy-based forwarding (PBF) applies to dataplane traffic and cannot be used for firewall-generated syslog. This combination would not direct syslog through ethernet1/2 and would likely break connectivity to the syslog server.
- ✗
Configure a static route for the syslog server's IP address pointing to ethernet1/2 and set the source IP in the syslog server profile.
Why it's wrong here
A static route controls routing decisions but does not determine the source interface for outbound syslog. The syslog server profile specifies the server address and format, not the source interface. Without a service route, the firewall will still use the management interface for syslog, regardless of static routes or syslog server profile settings, so this approach fails to meet the requirement.
- ✗
Create a security policy rule allowing syslog traffic from the trust zone to the untrust zone and apply a NAT rule to translate the source IP to ethernet1/2.
Why it's wrong here
Security policy and NAT rules affect dataplane traffic, but syslog traffic generated by the firewall itself is management plane traffic and does not traverse security policy. NAT could translate the source IP, but it is not the correct method to control which interface the firewall uses to send syslog. The service route configuration is the proper way to direct outbound syslog traffic.
- ✓
Configure a Syslog service route under Device > Setup > Services > Service Route Configuration, selecting the 'custom' option for Syslog and specifying the source interface as ethernet1/2.
Why this is correct
Service routes determine the source interface and source IP address for outbound services like Syslog, SNMP, and email. By default, these services use the management interface. Configuring a custom service route for Syslog with ethernet1/2 as the source interface ensures that syslog packets are sent from that interface's IP address and routed via the associated virtual router, meeting the requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.