mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. show system info | match model vm-series show running security-policy set rulebase security rules "Allow-Web" from [ trust ] to [ untrust ] source [ 10.0.0.0/24 ] destination [ any ] application [ web-browsing ] service [ application-default ] action allow set rulebase security rules "Block-All" from [ any ] to [ any ] source [ any ] destination [ any ] application [ any ] service [ any ] action deny show running nat-policy set rulebase nat rules "NAT-Internet" from [ trust ] to [ untrust ] source [ 10.0.0.0/24 ] destination [ any ] service [ any ] to-interface [ ethernet1/2 ] snat-interface show session all filter source 10.0.0.5 session id 12345, application incomplete, source 10.0.0.5:50000, destination 203.0.113.1:80, nat source 10.0.0.5, nat destination 203.0.113.1, rule Allow-Web, nat rule NAT-Internet, state active, type flow
Refer to the exhibit. A user from the trust zone (10.0.0.5) is trying to access a web server at 203.0.113.1 on port 80. The firewall shows a session with application 'incomplete'. What is the most likely reason for this?
⚠ Common exam trap
Many exam-takers confuse 'incomplete' application state with a missing security rule or NAT issue, but the 'incomplete' state specifically indicates that the firewall has not yet identified the application, not that the traffic is blocked or unroutable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is not matching the application 'web-browsing'
The session shows application 'incomplete' because the firewall has not yet identified the application due to insufficient data or because the traffic does not match the expected application signature. In this case, the traffic is likely not matching the 'web-browsing' application, which is the application defined in the security rule 'Allow-Web'. The firewall requires the first few packets to complete application identification; if the traffic is not recognized as 'web-browsing' (e.g., due to non-standard HTTP headers or encrypted payloads), the session remains 'incomplete' and may be dropped or not allowed by the rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The traffic is not matching the application 'web-browsing'
Why this is correct
The session has application 'incomplete', indicating the firewall has not identified the application as 'web-browsing', so the traffic is denied by the implicit deny.
- ✗
The NAT rule is missing
Why it's wrong here
The session shows a NAT rule 'NAT-Internet' applied, so NAT is not missing.
- ✗
The destination IP is not in the destination zone
Why it's wrong here
The destination is 'any' in the rule, so zone matching is not an issue.
- ✗
The security rule 'Allow-Web' is configured after 'Block-All'
Why it's wrong here
The running config shows 'Allow-Web' first, so rule order is correct.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.