hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: Is deploying a Palo Alto Networks firewall in a…
An organization is deploying a Palo Alto Networks firewall in a data center with multiple virtual routers. The network team wants to ensure that traffic between two different virtual routers can be inspected by the firewall. Which configuration is required?
⚠ Common exam trap
Test-takers frequently confuse routing configuration (static or default routes) with security policy, assuming that if traffic can be routed, it will be allowed, but Palo Alto firewalls require an explicit Security rule to permit traffic between virtual routers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Security policy rule that allows traffic between the virtual routers.
Traffic between virtual routers must be explicitly permitted by a Security policy rule. Even though virtual routers provide separate routing tables, the firewall still enforces policy enforcement points; without a Security rule allowing the traffic, it will be denied by default. This ensures that inter-virtual-router traffic is inspected and controlled by the firewall's security engine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a virtual wire between the virtual routers.
Why it's wrong here
Virtual wires are for transparent mode, not inter-VR routing.
- ✗
Add static routes for the remote subnets in each virtual router.
Why it's wrong here
Static routes enable routing but not inspection; policy is still needed.
- ✗
Configure a default route in each virtual router pointing to the other.
Why it's wrong here
Only one default route per virtual router is allowed, and this does not enable inspection.
- ✓
Create a Security policy rule that allows traffic between the virtual routers.
Why this is correct
Inter-virtual-router traffic must be permitted by Security policy to be inspected.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.