PCNSA Securing Traffic Practice Question
An administrator needs to allow DNS traffic from the Trust zone to the Untrust zone. The security policy rule uses the application 'dns' and service 'application-default'. Which port will be allowed by default?
⚠ Common exam trap
The trap here is assuming DNS only uses UDP; however, TCP port 53 is also included in the default service for the 'dns' application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP and UDP port 53
The 'dns' application in Palo Alto Networks firewalls uses both TCP and UDP port 53. When 'application-default' is selected, the firewall automatically allows these ports. This ensures that DNS queries, responses, and zone transfers function properly without manual service definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TCP port 53 only
Why it's wrong here
DNS uses TCP port 53 for specific functions like zone transfers, but standard queries use UDP port 53. The 'application-default' service for 'dns' includes both. Allowing only TCP would block most DNS queries. Hence, this option is incorrect.
- ✗
UDP port 53 only
Why it's wrong here
While DNS primarily uses UDP port 53 for queries, it also uses TCP port 53 for zone transfers and large responses. The 'application-default' service for 'dns' includes both TCP and UDP port 53. Restricting to UDP only would break certain DNS operations. Therefore, this option is incomplete and incorrect.
- ✗
TCP port 853
Why it's wrong here
TCP port 853 is used for DNS over TLS (DoT), which is a separate application and not the default for 'dns'. The 'dns' application uses port 53. Therefore, this option is incorrect for standard DNS traffic.
- ✓
TCP and UDP port 53
Why this is correct
The 'dns' application uses TCP and UDP port 53 by default. When 'application-default' is selected, the firewall automatically permits these ports. This is the correct answer because DNS primarily relies on port 53 for both TCP and UDP. Allowing this service ensures DNS queries and responses can pass.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.