Courseiva
← PCNSA
Full test
easyMultiple ChoiceObjective-mapped

PCNSA Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

```
> show running security-policy

Rule Name          Source Zone   Dest Zone   App         Action
----------------------------------------------------------------
1: Block-SSH        any           any         ssh          deny
2: Allow-SSH-Admin  trust         untrust     ssh          allow
3: Allow-Web        trust         untrust     web-browsing allow
```

Refer to the exhibit. An administrator notices that SSH traffic from the trust zone to the untrust zone is being blocked. The administrator expected it to be allowed by rule 2. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rule 1 matches the traffic and is evaluated before rule 2

Rule 1 matches any SSH traffic (source and destination zones 'any') and is evaluated before rule 2. Since rule 1's action is 'deny', it blocks the traffic before rule 2 can allow it. Option A is incorrect because the service setting does not affect rule matching priority; rule order determines evaluation. Option C is incorrect because the action of rule 1 is 'deny', not 'allow'. Option D is incorrect because even if rule 2's source zone is correct, rule 1 still matches first and blocks the traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Rule 2's application is set to 'ssh' but the service is not 'application-default'

    Why it's wrong here

    Even if the service is missing, the rule might not match, but the primary issue is rule 1.

  • ✓

    Rule 1 matches the traffic and is evaluated before rule 2

    Why this is correct

    Since rule 1 has 'any' zones and is higher priority, it blocks SSH before rule 2 is reached.

  • ✗

    Rule 1 is configured with action 'allow'

    Why it's wrong here

    The exhibit shows rule 1 action is deny.

  • ✗

    Rule 2's source zone is incorrectly set to 'dmz'

    Why it's wrong here

    The exhibit shows source zone 'trust' for rule 2.

About these practice questions

This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.