PCNSA Device Management and Services Practice Question
A security administrator notices that a user's traffic is being blocked unexpectedly. The user's IP is 10.1.1.100, and the traffic is destined to a web server at 192.168.2.10. The administrator has already verified that there are no security rules explicitly denying the traffic. Which Log Viewer query should the administrator use to quickly identify the cause?
⚠ Common exam trap
Watch out — candidates often assume a block must be due to a threat or misconfiguration, leading them to check Threat or Config logs, but the correct approach is to examine Traffic logs where the firewall records all session dispositions, including implicit denials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10
Traffic logs capture every session that passes through the firewall, including allowed and denied connections. By filtering for the specific source IP (10.1.1.100) and destination IP (192.168.2.10), the administrator can quickly see the exact session details, including the action taken (e.g., deny, drop) and the reason (e.g., no matching rule, application override). This is the most direct method to identify why traffic is being blocked when no explicit deny rule exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Search Traffic logs with filters for source 10.1.1.100 and destination 192.168.2.10
Why this is correct
Traffic logs show the action (allow/deny/drop) for each session, and filtering by IPs narrows down the specific session.
- ✗
Search Threat logs for the destination IP
Why it's wrong here
Threat logs only show blocked threats, not all dropped traffic.
- ✗
Search Config logs for any rule changes
Why it's wrong here
Config logs show configuration changes, not traffic handling.
- ✗
Search System logs for the user's IP
Why it's wrong here
System logs are for administrative events, not traffic flows.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.