PCNSA Device Management and Services Practice Question
Exhibit
Refer to the exhibit.
admin@PA-3020> show running security-policy
rulebase security rules
rule 1 name "Allow-Sales"
source [ 10.1.1.0/24 ]
destination [ 192.168.1.0/24 ]
application [ ms-sql ]
service [ tcp-1433 ]
action allow
log-start no
rule 2 name "Allow-HR"
source [ 10.1.2.0/24 ]
destination [ 192.168.2.0/24 ]
application [ web-browsing ]
service [ application-default ]
action allow
log-start yes
admin@PA-3020> show session id 12345
Source IP: 10.1.1.50
Destination IP: 192.168.1.100
Application: ssl
Service: tcp-443
admin@PA-3020> show log traffic | match 10.1.1.50
... no results ...Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?
⚠ Common exam trap
Palo Alto Networks often tests the misconception that a missing log entry means the traffic is dropped by the default rule, but the trap here is that the traffic is actually matched and allowed by an earlier rule (Rule 1) that may have logging disabled, so no log entry appears.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule 1 (Allow-Sales)
(Rule 1 – Allow-Sales) is correct. The source 10.1.1.50 belongs to the Sales zone, and the destination 192.168.1.100 belongs to the Servers zone. This is interzone traffic. Rule 1 explicitly permits traffic from Sales to Servers on TCP port 443, so it matches this traffic. The traffic log shows no entries because logging is disabled on Rule 1. The user's inability to connect is likely due to a server-side issue (e.g., the server not listening on port 443) or a routing problem, not because the firewall is dropping the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interzone-default
Why it's wrong here
The Interzone-default rule denies interzone traffic by default, but it is not matched because a more specific rule (Rule 1) matches first.
- ✗
Intrazone-default
Why it's wrong here
The Intrazone-default rule applies only to traffic within the same zone, but the source and destination are in different zones.
- ✗
Rule 2 (Allow-HR)
Why it's wrong here
Rule 2 permits traffic from the HR zone, but the source (10.1.1.50) belongs to the Sales zone, so it does not match.
- ✓
Rule 1 (Allow-Sales)
Why this is correct
Rule 1 permits traffic from Sales to Servers on TCP port 443, so it matches this traffic. The lack of log entries is due to logging being disabled on this rule.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.