PCNSA Device Management and Services Practice Question
A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?
⚠ Common exam trap
Watch out — candidates often assume a block must be due to a threat or misconfiguration, leading them to check Threat or Config logs, but the correct approach is to examine Traffic logs where the firewall records all session dispositions, including implicit denials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10
Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10
Why this is correct
Filtering Traffic logs by source 10.1.1.100 and destination 192.168.2.10 isolates the exact flow, revealing the implicit deny or policy match causing the block. Since no explicit deny rule exists, the session detail exposes which rule or default action dropped it.
- ✗
Search Threat logs for the destination IP
Why it's wrong here
Threat logs record sessions matching security profiles such as antivirus, vulnerability and spyware signatures; a policy-based deny without a threat match never appears there. They are tempting because blocked traffic suggests a security event, and would be correct when the drop is caused by a threat signature rather than rule or profile action.
- ✗
Search Config logs for any rule changes
Why it's wrong here
Config logs record administrator commits and rule changes, not the live session that dropped this flow, so they cannot identify which policy or profile blocked it. They are tempting because a recent edit could explain new blocking, and they would be correct when investigating an unexplained change in behaviour following an administrative commit.
- ✗
Search System logs for the user's IP
Why it's wrong here
System logs capture daemon, management-plane and hardware events, not per-session forwarding decisions, so they will not show why this flow was dropped. They are tempting because they record interface and routing faults, and would be correct when diagnosing a downed link, HA failover or management-plane problem rather than a blocked user session.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.