PCNSA Device Management and Services Practice Question
Exhibit
> show system info hostname: PA-5250 model: PA-5250 sw-version: 10.1.3 app-version: 8340-5987 threat-version: 8340-5987 > show running ip-route destination: 0.0.0.0/0 nexthop: 10.0.0.1 interface: ethernet1/1 > show interface ethernet1/1 interface: ethernet1/1 state: up ip address: 10.0.0.2/24 zone: external > show interface ethernet1/2 interface: ethernet1/2 state: down ip address: 192.168.1.1/24 zone: internal
Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often overlook the interface administrative state and instead focus on routing or security policy misconfigurations, assuming that a configured IP and zone guarantee traffic flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The internal interface (ethernet1/2) is administratively down
The exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The internal interface has no IP address assigned
Why it's wrong here
The IP address 192.168.1.1/24 is assigned.
- ✗
The internal zone is not configured
Why it's wrong here
The interface shows zone: internal, so it is configured.
- ✗
The default route is missing
Why it's wrong here
The show running ip-route shows a default route to 10.0.0.1.
- ✓
The internal interface (ethernet1/2) is administratively down
Why this is correct
The interface must be up for traffic to pass.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.