PCNSA Policy Evaluation and Management Practice Question
Exhibit
Refer to the exhibit.
admin@PA-5020> show running security-policy
Set application-default
rule id name from to source destination application service action
--- --- --------------------------- ----------- ------------ ------------- ------------ ------------ ---------- -------
1 Allow-Sales-to-App Sales App-Servers 10.10.1.0/24 10.20.1.100 any tcp/80 allow
2 Allow-Any-Web any any any any web-browsing tcp/80 allow
3 Block-Restricted-Apps any any any any bittorrent any deny
4 Allow-DNS any any any any dns udp/53 allowRefer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?
⚠ Common exam trap
Palo Alto Networks often tests the first-match rule evaluation order, where candidates mistakenly think a more specific source rule (like Rule 1 for Sales) will always match, but they overlook that the destination must also match, causing them to pick the wrong rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule 2 (Allow-Any-Web)
Rule 2 (Allow-Any-Web) is correct because it is a broad rule that permits HTTP (port 80) traffic from any source to any destination, which matches the user's attempt to browse to an external website. The traffic originates from the Sales subnet (10.10.1.50) and targets IP 203.0.113.50 on port 80, and since no more specific rule (like Rule 1) matches the destination, Rule 2 applies as the first general web access rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rule 4 (Allow-DNS)
Why it's wrong here
Rule 4 matches DNS traffic on udp/53, not HTTP on tcp/80.
- ✗
Rule 3 (Block-Restricted-Apps)
Why it's wrong here
Rule 3 denies bittorrent, which is not the application used.
- ✓
Rule 2 (Allow-Any-Web)
Why this is correct
Rule 2 matches any source and destination, with application web-browsing and service tcp/80, so it matches this HTTP traffic.
- ✗
Rule 1 (Allow-Sales-to-App)
Why it's wrong here
Rule 1's destination is 10.20.1.100, not the external IP 203.0.113.50, so it does not match.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?
easy- A.No rule will match
- B.rule 3 (deny-all)
- ✓ C.rule 2 (allow-dns)
- D.rule 1 (allow-http)
Why C: Rule 2 (allow-dns) specifically allows DNS application from trust zone to untrust zone. Option A is incorrect because rule 2 does match. Option B (deny-all) would only match if no prior rule matches, but rule 2 matches first. Option D (allow-http) only allows web-browsing, not DNS.
Variation 2. Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?
hard- A.The firewall will continue to the next rule
- B.Allow
- ✓ C.Deny
- D.Allow only if no security profile blocks it
Why C: The firewall first checks Rule 1, which only matches traffic with application 'ms-office365'. Since the traffic uses 'ssl', it does not match. The firewall then checks Rule 2, which denies all traffic from Sales to Finance zone. Therefore, the firewall takes the action Deny. Option A is incorrect because while the firewall does evaluate the next rule, the action taken is Deny, not 'continue to the next rule'. Option B is incorrect because the traffic is not allowed. Option D is incorrect because there is no security profile involved; the deny rule blocks it without any profile.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.