PCNSA Policy Evaluation and Management Practice Question
An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule1
The first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rule1
Why this is correct
Rule1 matches all traffic and is the first rule, so it processes the traffic.
- ✗
Rule3
Why it's wrong here
Rule3 is a deny rule, but traffic was allowed, so it did not match.
- ✗
Rule2
Why it's wrong here
Rule2 is more specific but comes after Rule1, so it is not evaluated because Rule1 matched.
- ✗
No rule matched
Why it's wrong here
Traffic was logged as allowed, so a rule matched.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?
hard- A.Add 10.10.1.12 to rule1's source address.
- B.Change rule2 to allow.
- ✓ C.Create a new rule above rule2 that allows the specific traffic with appropriate security profiles.
- D.Move rule2 above rule1.
Why C: Creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 with appropriate security profiles will permit the desired traffic without affecting other rules. Rule order matters in Palo Alto firewalls; a rule placed higher in the list is evaluated first. Option A would broaden rule1's source, potentially allowing unintended traffic. Option B would change rule2 to allow, which could permit traffic that should still be denied. Option D would move rule2 above rule1, but since rule2 is a deny rule, the traffic would still be denied. Thus, adding a new allow rule above the deny rule is the best approach.
Variation 2. A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?
easy- A.The source IP is negated in the rule.
- B.The rule is placed at the top of the rulebase and overridden by a later rule.
- ✓ C.The rule is positioned below an allow rule that matches the same traffic.
- D.The rule is disabled in the rulebase.
Why C: The Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.
Variation 3. An administrator has configured multiple security rules for a data center. There is a rule that allows SSH from the 'Management' zone to the 'Server' zone. Recently, the administrator added a new rule allowing SSH from a new 'Admin' zone to the 'Server' zone. The Admin rule is placed above the Management rule. Both rules specify the correct zones, application SSH, and action allow. After committing, SSH traffic from the Admin zone is being denied. What is the most likely issue?
medium- ✓ A.There is a deny rule placed above the new Admin rule that matches the Admin zone traffic.
- B.The Admin rule has a typo in the destination address, causing it to not match the server.
- C.The Management rule is shadowing the Admin rule due to overlapping conditions.
- D.The Admin zone is not associated with the correct virtual router.
Why A: The Admin rule is placed above the Management rule and both allow SSH, so traffic should be allowed by the Admin rule. The most likely reason for denial is that a deny rule exists above the Admin rule that matches the Admin zone traffic, thereby blocking SSH before the Admin rule is evaluated. Option A correctly identifies this.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.