Courseiva
← PCNSA
Full test
Policy Evaluation and Management →easyMultiple ChoiceObjective-mapped

PCNSA Policy Evaluation and Management Practice Question

Exhibit

> show running security-policy

rule 1: name: allow-http, source: trust, dest: untrust, application: web-browsing, action: allow
rule 2: name: allow-dns, source: trust, dest: untrust, application: dns, action: allow
rule 3: name: deny-all, source: any, dest: any, application: any, action: deny

Refer to the exhibit. An internal DNS server in the trust zone communicates with an external DNS server in the untrust zone. Which rule will match the DNS traffic?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

rule 2 (allow-dns)

Rule 2 (allow-dns) specifically allows DNS application from trust zone to untrust zone. Option A is incorrect because rule 2 does match. Option B (deny-all) would only match if no prior rule matches, but rule 2 matches first. Option D (allow-http) only allows web-browsing, not DNS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    No rule will match

    Why it's wrong here

    Rule 2 matches the traffic.

  • ✗

    rule 3 (deny-all)

    Why it's wrong here

    This rule would match only if DNS is not allowed by a prior rule.

  • ✓

    rule 2 (allow-dns)

    Why this is correct

    This rule matches DNS traffic from trust to untrust.

  • ✗

    rule 1 (allow-http)

    Why it's wrong here

    This rule allows web-browsing, not DNS.

About these practice questions

This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.