PCNSA Policy Evaluation and Management Practice Question
An administrator has configured a security rule that allows traffic from the 'Guest' zone to the 'Internet' zone for web-browsing and ssl applications. The rule is placed at the top of the rulebase. Users in the Guest zone report that they can access websites but cannot use other applications like SSH or FTP. Which statement explains this behavior?
⚠ Common exam trap
The trap here is thinking that a rule at the top allows all traffic, but the rule's application match criteria restrict it to only the specified applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule allows only web-browsing and ssl, so other applications are implicitly denied by the default deny rule at the bottom.
The security rule only allows web-browsing and ssl applications. Traffic for SSH and FTP does not match this rule and is therefore evaluated against subsequent rules. Since there is no explicit allow rule for those applications, they are denied by the default deny rule at the bottom of the rulebase. This is the expected behavior of a default-deny security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule is at the top, so it allows all traffic, but the applications are not properly defined.
Why it's wrong here
Placing a rule at the top does not mean it allows all traffic; the rule's match criteria determine what is allowed. The applications are properly defined as web-browsing and ssl, so only those are allowed. Other applications are not allowed by this rule.
- ✗
The rule is missing a security profile, which is required to allow non-web applications.
Why it's wrong here
Security profiles are not required to allow applications; they are used for inspection. The absence of a security profile does not prevent SSH or FTP from being allowed if the rule permitted them. The issue is that the rule does not include those applications.
- ✓
The rule allows only web-browsing and ssl, so other applications are implicitly denied by the default deny rule at the bottom.
Why this is correct
The security rule explicitly allows only web-browsing and ssl applications. Any traffic that does not match these applications will continue down the rulebase and eventually hit the default deny rule (interzone-default or intrazone-default), which denies all traffic not explicitly allowed. Therefore, SSH and FTP are denied.
- ✗
The firewall is configured to block SSH and FTP by default, regardless of rule configuration.
Why it's wrong here
Palo Alto Networks firewalls do not block specific applications by default; they deny all traffic that is not explicitly allowed by a rule. SSH and FTP are not inherently blocked; they would be allowed if a rule permitted them. The behavior is due to the absence of an allow rule for those applications.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.