mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: A security team is deploying a Palo Alto Networks…
A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?
⚠ Common exam trap
Many exam-takers assume a single firewall interface can act as a default gateway for multiple subnets, failing to understand that AWS route tables require explicit next-hop entries for inter-subnet traffic and that the local VPC route cannot be removed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
To inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
Why this is correct
This allows the firewall to inspect traffic between the subnets.
- ✗
Create a VPC peering connection between the two subnets and attach the firewall.
Why it's wrong here
VPC peering is for different VPCs, not subnets within the same VPC.
- ✗
Attach the firewall to a single subnet and use it as a default gateway for both subnets.
Why it's wrong here
A single ENI cannot handle traffic between two subnets; each subnet needs an ENI on the firewall.
- ✗
Configure AWS security groups to route traffic through the firewall.
Why it's wrong here
Security groups do not route traffic; they act as stateful firewalls.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.