PCNSA Securing Traffic Practice Question

Exhibit

Refer to the exhibit.
Exhibit: Config snippet:

```
set shared application-tunnel time-to-live 30
set shared application-tunnel policy "Block_Tor" action deny
set shared application-tunnel policy "Allow_SSH" action allow tunnel detection none
```

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy "Allow_SSH" has tunnel detection set to none, so it does not match.

The Allow_SSH policy has tunnel detection set to 'none', which means the firewall will not detect SSH tunnels, so the policy does not match. The other options are incorrect: Option B is wrong because the Block_Tor policy only blocks Tor tunnels, not all tunnels. Option C is wrong because TTL is not related to SSH tunnel detection. Option D is wrong because the default action for application tunnels is not necessarily deny; it depends on the policy configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy "Allow_SSH" has tunnel detection set to none, so it does not match.
Why this is correct
Without tunnel detection, the firewall cannot identify SSH tunnels, so the Allow_SSH policy never applies, and tunnels are likely blocked by the default or other rules.
✗
The application tunnel policy "Block_Tor" is blocking all tunnels.
Why it's wrong here
Block_Tor specifically blocks Tor tunnels, not SSH.
✗
The time-to-live setting prevents SSH tunnel detection.
Why it's wrong here
TTL is not related to detection; it's for session timeouts.
✗
The default action for application tunnels is deny.
Why it's wrong here
The exhibit shows explicit policies; default action is not shown and typically is allow? Actually, for application tunnels, if no policy matches, the default is to allow? But the issue is that SSH tunnel is not being detected, not that it's denied by default.

Go deeper

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

PCNSA Practice Exam 3 — 20 Questions→PCNSA Practice Exam 4 — 20 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Securing Traffic Policy Evaluation and Management Decryption and Monitoring

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Securing Traffic practice questions PCNSA troubleshooting practice questions Decryption and Monitoring practice questions

Continue studying

Palo Alto Networks Certified Network Security Administrator PCNSA exam guide PCNSA practice test All Palo Alto Networks practice questions

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.

PCNSA Securing Traffic Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question