PCNSA Policy Evaluation and Management Practice Question
An administrator is configuring a security rule that allows access from the Trust zone to the DMZ zone for a specific application. The administrator wants to ensure that the rule only allows the application on its default port and blocks the application if it attempts to use a non-standard port. Which setting should be used in the Service column of the security rule?
⚠ Common exam trap
The trap here is selecting a specific service like service-http or service-https, which may not cover all default ports for the application, or selecting any, which allows all ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
application-default
The application-default option in the Service column restricts the rule to the default ports for the selected application. This ensures that the application is only allowed on its standard ports, and any attempt to use a non-standard port will not match the rule, effectively blocking it. This is the correct way to enforce default port usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
application-default
Why this is correct
Application-default automatically restricts the service to the default ports defined for the selected application. If the application attempts to use a non-standard port, the rule will not match, and the traffic will be blocked by subsequent rules or the default deny. This precisely meets the requirement to allow only on default ports.
- ✗
any
Why it's wrong here
Setting the Service to any allows the application to use any port, including non-standard ports. This would not meet the requirement to block the application on non-standard ports. The administrator needs to restrict the service to the default port to enforce the desired behavior.
- ✗
service-http
Why it's wrong here
Service-http is a predefined service for HTTP on port 80. If the application is not HTTP, this service would not be appropriate. Even if it is HTTP, using a specific service instead of application-default may not align with the application's default ports if the application uses multiple ports. The requirement is to allow only on default ports for the specific application, which application-default handles dynamically.
- ✗
service-https
Why it's wrong here
Service-https is for HTTPS on port 443. Similar to service-http, it is specific to HTTPS and may not match the application's default ports if the application uses other ports. The administrator should use application-default to automatically use the default ports for the selected application, ensuring only those ports are allowed.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.