PCNSA Device Management and Services Practice Question
A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?
⚠ Common exam trap
Watch out — candidates often assume IP addresses or zones are the issue, but Palo Alto Networks firewalls prioritize application identification over port numbers, so a rule with 'web-browsing' will not match HTTPS traffic even if all other conditions are satisfied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the application specified in the rule and the actual traffic
The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure that logging is enabled on the rule
Why it's wrong here
Logging does not affect rule matching.
- ✓
Review the application specified in the rule and the actual traffic
Why this is correct
The rule uses 'web-browsing' but traffic is HTTPS (ssl), so the rule does not match.
- ✗
Check the zone configuration for the destination
Why it's wrong here
Zone mismatch could cause rule not to match, but the log shows another rule matched.
- ✗
Verify that the source and destination IP ranges are correct
Why it's wrong here
The IPs are within the specified subnets.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.