PCNSA Policy Evaluation and Management Practice Question
A security administrator is reviewing the security policy on a PA-220 firewall. The administrator notices that a rule allowing DNS from the 'Trust' zone to the 'Untrust' zone is being shadowed by a rule above it that denies all traffic from 'Trust' to 'Untrust'. What is the term for this situation?
⚠ Common exam trap
The trap here is using a general term like 'rule conflict' when the specific phenomenon of a rule being completely obscured by a preceding rule is called shadowing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule shadowing
Rule shadowing in PAN-OS occurs when a rule is placed below another rule that matches the same traffic and takes a different action, causing the lower rule to never be evaluated. In this case, the deny rule above the DNS allow rule shadows it, effectively disabling the allow rule. This is a critical policy management issue that can be identified using the firewall's rule analysis tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rule duplication
Why it's wrong here
Rule duplication refers to having multiple rules with identical or very similar criteria, which can cause confusion and inefficiency. In this scenario, the rules are not duplicates; one is a specific allow and the other a general deny. The issue is that the allow rule is obscured by the deny rule, which is shadowing, not duplication.
- ✓
Rule shadowing
Why this is correct
Rule shadowing occurs when a rule is never matched because a preceding rule matches the same traffic and takes action. In this case, the deny rule above prevents the DNS allow rule from ever being evaluated. This is a common policy misconfiguration that can lead to unintended denial of legitimate traffic. Administrators should regularly audit rule order to avoid shadowing.
- ✗
Rule overlap
Why it's wrong here
Rule overlap refers to rules that have some common criteria but not necessarily identical. It does not specifically describe a rule being completely obscured by another. The scenario describes a rule that is entirely shadowed, meaning it will never be matched. Therefore, 'rule overlap' is not the correct term for this situation.
- ✗
Rule conflict
Why it's wrong here
Rule conflict is a broad term that could describe any situation where rules have overlapping criteria with different actions. However, the specific term for a rule that is never hit because a preceding rule matches first is shadowing. Conflict might imply that both rules are evaluated, but in PAN-OS, only the first match is applied, so shadowing is more precise.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.