Courseiva
hardMultiple ChoiceObjective-mapped

PCNSA Practice Question: A security policy allows traffic from zone…

A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?

⚠ Common exam trap

Many exam-takers assume a security policy allowing HTTP/HTTPS guarantees session creation, but they overlook that a more specific deny rule higher in the policy order could match and drop the traffic before the allow rule is evaluated.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The traffic is being dropped due to a security policy rule that denies the traffic

If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The traffic is intra-zone, not inter-zone

    Why it's wrong here

    The stem specifies inter-zone traffic.

  • The firewall is using hardware offload for fast-path processing

    Why it's wrong here

    Hardware offload applies only to existing sessions, not the first packet.

  • The traffic is being dropped due to a security policy rule that denies the traffic

    Why this is correct

    If no matching rule allows the traffic, the packet is dropped and no session is created.

  • The packet is part of an existing session that has not timed out

    Why it's wrong here

    No session exists for the first packet.

About these practice questions

Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.