PCNSA Policy Evaluation and Management Practice Question
After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?
⚠ Common exam trap
The trap here is assuming a successful commit means the change is instantly effective for all traffic; PCNSA often tests the distinction between configuration commit and session-level policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The commit was successful but the changes are applied only to new sessions, not existing sessions.
In PAN-OS, committing a candidate configuration pushes the new policy into the running configuration, but security policy evaluation happens at session setup. Existing sessions continue to be evaluated against the policy that was in force when the session was created, so users with long-lived or already-established sessions keep the old behavior while users opening new sessions get the new rule. This explains why only some users report issues after the commit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The new rule has an incorrect source zone.
Why it's wrong here
An incorrect source zone would block traffic matching that zone entirely, producing consistent failures rather than the mixed connectivity reported. It tempts because zone errors are a common cause of dropped traffic, and checking rule placement is a sensible step once session-level explanations have been excluded.
- ✗
There is a mismatch between the virtual wire vs layer3 interface.
Why it's wrong here
Virtual wire versus Layer 3 interface is a design-time configuration choice, not something that changes per user after a commit, so it cannot explain why only some users lose connectivity. It tempts because interface mode errors do break traffic, but they break it uniformly for everything traversing that path.
- ✗
The committed configuration is still in candidate state.
Why it's wrong here
A commit moves the candidate configuration to running, so it cannot remain in candidate state afterwards; the partial, user-specific symptoms point to session or application dependence instead. It tempts because uncommitted changes do explain absent enforcement, but that would affect all users equally rather than only some.
- ✓
The commit was successful but the changes are applied only to new sessions, not existing sessions.
Why this is correct
PAN-OS commits apply policy to new sessions only; established sessions retain their original policy until they time out or are cleared. The mixed user experience described in the stem is the expected behaviour, so the administrator should verify existing sessions rather than suspect a failed commit.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.