PCNSA Policy Evaluation and Management Practice Question
An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?
⚠ Common exam trap
The trap is assuming that the more specific Rule2 would process HTTP traffic, but candidates must remember that firewall rules are evaluated in order and the first match wins, regardless of specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule1
Rule1 allows any to any with logging at session start, so it matches the traffic first and permits it, generating a log entry. Since Rule1 is evaluated before Rule2 and Rule3, the traffic is processed by Rule1 and never reaches the subsequent rules. The log confirms that the session was allowed, consistent with Rule1's action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rule1
Why this is correct
Rule1 sits first and matches any-to-any, so it processes the traffic before Rule2's HTTP-specific match is ever evaluated. Palo Alto firewalls evaluate rules top-down and stop at the first match, and its log-at-session-start setting produces the allowed entry observed.
- ✗
Rule3
Why it's wrong here
Rule3 denies any traffic not matched earlier, so it would drop the session and log it as denied, contradicting the allowed log entry. It is tempting because the deny rule is the catch-all final rule, and would legitimately process traffic that matched neither Rule1 nor Rule2.
- ✗
Rule2
Why it's wrong here
Rule1 precedes Rule2 and permits any-to-any with logging at session start, so it matches the HTTP flow first and generates the allow log; Rule2 is never evaluated. It is tempting because Rule2 names HTTP specifically, but first-match ordering means the broader earlier rule wins.
- ✗
No rule matched
Why it's wrong here
Rule1 matches first and logs at session start, so the traffic is reported as allowed; a packet reaching the implicit deny would be dropped and logged as denied, not allowed. "No rule matched" describes traffic hitting the default interzone deny, which is tempting when no explicit rule appears to fit.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?
hard- A.Add 10.10.1.12 to rule1's source address.
- B.Change rule2 to allow.
- ✓ C.Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.
- D.Move rule2 above rule1.
Why C: Creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 with appropriate security profiles will permit the desired traffic without affecting other rules. Rule order matters in Palo Alto firewalls; a rule placed higher in the list is evaluated first. Option A would broaden rule1's source, potentially allowing unintended traffic. Option B would change rule2 to allow, which could permit traffic that should still be denied. Option D would move rule2 above rule1, but since rule2 is a deny rule, the traffic would still be denied. Thus, adding a new allow rule above the deny rule is the best approach.
Variation 2. A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?
easy- A.The source IP is negated in the rule.
- B.The rule is placed at the top of the rulebase and overridden by a later rule.
- ✓ C.The rule is positioned below an allow rule that matches the same traffic.
- D.The rule is disabled in the rulebase.
Why C: The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.
Variation 3. An administrator has configured multiple security rules for a data center. There is a rule that allows SSH from the 'Management' zone to the 'Server' zone. Recently, the administrator added a new rule allowing SSH from a new 'Admin' zone to the 'Server' zone. The Admin rule is placed above the Management rule. Both rules specify the correct zones, application SSH, and action allow. After committing, SSH traffic from the Admin zone is being denied. What is the most likely issue?
medium- ✓ A.There is a deny rule placed above the new Admin rule that matches the Admin zone traffic.
- B.The Admin rule has a typo in the destination address, causing it to not match the server.
- C.The Management rule is shadowing the Admin rule due to overlapping conditions.
- D.The Admin zone is not associated with the correct virtual router.
Why A: Palo Alto Networks firewalls evaluate security rules top-down and stop at the first match, so a deny rule positioned above the new Admin-to-Server SSH allow rule will match the Admin zone traffic first and drop it before the allow rule is ever evaluated. Since the Admin rule itself is correctly configured (zones, application SSH, action allow), the only explanation consistent with the symptom is a higher-priority deny rule intercepting the traffic. This is a classic rule-order/shadowing problem in PAN-OS policy evaluation.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.