easyMultiple ChoiceObjective-mapped
PCNSA Practice Question: A security team notices that traffic from a…
A security team notices that traffic from a specific internal subnet is not being inspected by the firewall. They have configured a security policy rule that matches the subnet and allows the traffic, but the traffic is still not being logged or inspected. What is the most likely cause?
⚠ Common exam trap
Candidates often assume a rule is automatically enforced once created, overlooking the explicit 'enabled' checkbox in the rule configuration, which is a common misconfiguration in real-world deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule is disabled in the rulebase.
If a security policy rule is disabled in the rulebase, it will not be evaluated or enforced, even if it matches the traffic. The firewall will skip the rule entirely, meaning no logging or inspection occurs for traffic that would have matched it. This directly explains why the traffic is not being inspected or logged despite the rule appearing to be configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule is placed below an earlier rule that also matches the traffic.
Why it's wrong here
This could cause the earlier rule to be matched first, but the question states the traffic is not inspected at all, not that it matches a different rule.
- ✗
The firewall's license for the threat prevention subscription has expired.
Why it's wrong here
License expiry would affect inspection capabilities, but the firewall would still apply security rules; it would just not perform threat inspection.
- ✗
The firewall is in an active/passive HA pair and the passive unit is handling traffic.
Why it's wrong here
HA state does not affect rule evaluation; the active unit handles traffic and applies rules.
- ✓
The rule is disabled in the rulebase.
Why this is correct
A disabled rule is not evaluated, so traffic matching that rule will not be inspected.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.