PCNSA Policy Evaluation and Management Practice Question

An administrator is configuring a security policy on a PA-3260 firewall. The administrator wants to ensure that a rule allowing SSH from the 'Management' zone to the 'Internal' zone is only active during business hours (9 AM to 5 PM) on weekdays. The administrator creates a schedule object named 'BusinessHours' and attaches it to the rule. However, after applying the policy, SSH access is allowed at all times. What is the most likely reason?

⚠ Common exam trap

The trap here is assuming that attaching a schedule to a rule is sufficient, without considering rule order and shadowing by a more general rule.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Another rule above the scheduled rule allows SSH from Management to Internal without a schedule.

In PAN-OS, schedule objects are used to define time-based rules. If a rule with a schedule is placed below another rule that matches the same traffic without a schedule, the first rule will match and allow traffic at all times. The scheduled rule will never be evaluated. To enforce time-based access, the scheduled rule must be placed above any broader rules that could match the same traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The schedule object was not applied to the correct rule.
Why it's wrong here
If the schedule object was not applied to the correct rule, the rule would have no schedule and would be active at all times. However, the administrator states they attached it to the rule. The issue is more likely that the schedule is not being enforced due to another configuration. This option is less likely than the possibility that the schedule is not properly defined or that another rule allows the traffic.
✗
The schedule object 'BusinessHours' is not committed to the firewall.
Why it's wrong here
If the schedule object was not committed, the rule might not have a valid schedule and could default to always active. However, the administrator would likely see a commit error or the rule would show as invalid. The more likely cause is that another rule above is allowing the traffic, bypassing the scheduled rule entirely. This is a rule order issue.
✗
The schedule object 'BusinessHours' is defined with the wrong time zone.
Why it's wrong here
If the schedule object uses a different time zone than the firewall's local time, the active hours would be offset, potentially allowing access outside business hours. However, this would not cause access at all times; it would shift the window. The symptom of all-time access suggests the schedule is not being enforced at all, rather than a time zone mismatch.
✓
Another rule above the scheduled rule allows SSH from Management to Internal without a schedule.
Why this is correct
If a more general rule above allows SSH without a schedule, it will match first and permit access at all times, rendering the scheduled rule ineffective. This is a common rule order issue. The scheduled rule is shadowed by the broader rule. The administrator must ensure the scheduled rule is above any other rules that might match the same traffic.

Go deeper

PCNSA Policy Evaluation and Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question