PCNSA Device Management and Services Practice Question
An administrator manages a PA-3220 running PAN-OS 10.2 with two virtual routers: VR-A for the internal network and VR-B for the internet. The firewall must send SNMP traps, syslog, and email alerts to servers reachable only through VR-B. Which setting directly controls which virtual router the firewall uses to egress that management-plane traffic?
⚠ Common exam trap
The trap here is assuming that dataplane static routes or PBF rules steer the firewall's own management-plane services, when Service Route Configuration actually governs that egress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Service Route Configuration under Device > Setup > Services
Firewall-originated management services such as SNMP, syslog, and email do not follow dataplane routing by default; they are steered by Service Route Configuration. Binding each service to an interface in VR-B forces that egress path, which is exactly what the scenario requires. Other mechanisms either affect only transit traffic or the dedicated management port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A static route in VR-A pointing to the SNMP, syslog, and SMTP servers
Why it's wrong here
Adding static routes to VR-A would only help if the services were already egressing VR-A. The requirement is to use VR-B, and VR-A's routing table does not influence which virtual router a management service selects for its source.
- ✗
A Policy-Based Forwarding (PBF) rule matching the firewall's own management traffic
Why it's wrong here
Policy-Based Forwarding applies to transit traffic evaluated against security policy, not to firewall-originated management-plane traffic such as SNMP traps or syslog. PBF rules cannot intercept or redirect the firewall's own service traffic, so they do not meet this need.
- ✗
The Management Interface's default gateway under Device > Setup > Interfaces
Why it's wrong here
The management interface has its own dedicated routing table separate from dataplane virtual routers. Setting its default gateway only affects traffic originating from the MGT port itself and cannot steer service traffic out of a dataplane virtual router such as VR-B, so it fails here.
- ✓
The Service Route Configuration under Device > Setup > Services
Why this is correct
Service Route Configuration lets the administrator bind each management service (SNMP, Syslog, Email, HTTP, etc.) to a specific source interface and virtual router. Selecting VR-B's egress interface for these services ensures traps, logs, and alerts leave through VR-B, satisfying the requirement precisely.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.