hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit.
```
> show security-rule rule1
rule "rule1" {
from untrust;
to trust;
source [10.1.1.0/24];
negate-source yes;
destination any;
application any;
service any;
action allow;
}
```Refer to the exhibit. A user at IP 10.1.1.5 on the untrust zone is trying to access a server on the trust zone. The traffic is being blocked by a default deny rule instead of being allowed by rule1. What is the most likely reason?
⚠ Common exam trap
Test-takers frequently confuse negation with a simple 'not' operator, thinking it will allow all traffic except the specified IP, but they overlook that the negated address itself is excluded from matching, causing traffic from that IP to hit the default deny rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule uses negation on the source address.
When a rule uses negation on the source address (e.g., 'not 10.1.1.5'), the firewall treats the source as 'any IP except 10.1.1.5'. This means traffic from 10.1.1.5 will not match the rule, causing it to fall through to the default deny rule. Negation in Palo Alto Networks policies explicitly excludes the specified address from matching, which is a common misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule's destination is set to 'any' which is too broad.
Why it's wrong here
A destination of 'any' does not cause a no-match; it matches all destinations.
- ✗
The rule does not specify any application or service.
Why it's wrong here
The service is set to 'any', so it matches all services. Application 'any' also matches.
- ✓
The rule uses negation on the source address.
Why this is correct
The 'negate-source yes' directive means the rule applies to all sources except the specified range 10.1.1.0/24. Since 10.1.1.5 falls in that range, the rule does not match, and traffic hits the default deny rule.
- ✗
The rule has not been committed.
Why it's wrong here
The rule appears in the running configuration via 'show security-rule', indicating it is committed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.