hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: A security policy allows traffic from zone…
A security policy allows traffic from zone 'Trust' to zone 'Untrust' for HTTP and HTTPS. The administrator notices that the traffic is being processed by the firewall but no session is created in the session table for the first packet of a new connection. What is the most likely reason?
⚠ Common exam trap
Many exam-takers assume a security policy allowing HTTP/HTTPS guarantees session creation, but they overlook that a more specific deny rule higher in the policy order could match and drop the traffic before the allow rule is evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is being dropped due to a security policy rule that denies the traffic
If a security policy rule explicitly denies the traffic, the firewall will process the first packet, evaluate it against the policy, and then drop it without creating a session entry. The session table only records sessions for allowed traffic; denied packets are discarded immediately after the policy lookup, leaving no session in the table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is intra-zone, not inter-zone
Why it's wrong here
The stem specifies inter-zone traffic.
- ✗
The firewall is using hardware offload for fast-path processing
Why it's wrong here
Hardware offload applies only to existing sessions, not the first packet.
- ✓
The traffic is being dropped due to a security policy rule that denies the traffic
Why this is correct
If no matching rule allows the traffic, the packet is dropped and no session is created.
- ✗
The packet is part of an existing session that has not timed out
Why it's wrong here
No session exists for the first packet.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.