PCNSA Policy Evaluation and Management Practice Question
A security administrator is troubleshooting why a security rule that allows traffic from the 'Trust' zone to the 'DMZ' zone is not being matched. The administrator confirms that the source IP, destination IP, and application are correct. The rule is placed at the top of the rulebase. What is the most likely reason the rule is not being hit?
⚠ Common exam trap
The trap here is focusing on application or security profiles when the rule is not matched at all, overlooking the fundamental requirement that zones must be correctly assigned to interfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination zone is incorrectly configured on the firewall interface.
Security rules match on source and destination zones, which are determined by the interfaces the traffic enters and exits. If the DMZ interface is not assigned to the 'DMZ' zone, the destination zone in the rule will not match the actual zone of the egress interface. This prevents the rule from being hit. Checking zone assignments is a critical troubleshooting step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security profile attached to the rule is blocking the traffic.
Why it's wrong here
Security profiles are applied after a rule matches and allow the traffic. If a profile blocks traffic, the rule is still hit, but the session may be dropped. The issue here is that the rule is not being matched at all, so security profiles are not the cause. Profiles affect action, not rule matching.
- ✗
The application is not recognized by App-ID due to encryption.
Why it's wrong here
If the application is not recognized, the rule might not match, but the administrator confirmed the application is correct. Encryption can prevent App-ID from identifying the application, but if the application is known and correct, this is not the issue. Additionally, the rule not being hit suggests a zone or address mismatch, not application identification.
- ✓
The destination zone is incorrectly configured on the firewall interface.
Why this is correct
For a security rule to match, the source and destination zones must be correctly associated with the ingress and egress interfaces. If the DMZ interface is not assigned to the 'DMZ' zone, the traffic will not match the rule's destination zone. This is a common misconfiguration. Verifying zone assignments on interfaces is essential when troubleshooting rule matches.
- ✗
The rule is disabled.
Why it's wrong here
If the rule were disabled, it would not appear as enabled in the rulebase, and the administrator would likely notice. The scenario states the rule is at the top and the administrator is troubleshooting why it's not hit, implying the rule is enabled. While possible, it is less likely than a zone misconfiguration given the context.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.