hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. admin@PA-3220> show routing route table default IPv4 Route Table for virtual-router default (0 entries) No routes admin@PA-3220> show routing route destination nexthop metric flags interface 0.0.0.0/0 10.1.1.1 10 A ethernet1/1 10.1.1.0/24 0.0.0.0 0 C ethernet1/1 192.168.1.0/24 0.0.0.0 0 C ethernet1/2
Refer to the exhibit. The firewall cannot reach the Internet. Based on the routing table, what is the most likely cause?
⚠ Common exam trap
The trap here is that candidates see a default route in the routing table and assume it is active, overlooking the critical detail that the interface is down, which prevents the route from being used for forwarding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The default route is not active because the interface ethernet1/1 is down
The routing table shows a default route (0.0.0.0/0) configured with a next hop of 10.1.1.1 via interface ethernet1/1, but the route is not active (no 'C' flag for candidate). In Palo Alto Networks firewalls, a static route is only installed into the forwarding table if the specified egress interface is administratively up and operationally active. Since ethernet1/1 is down, the route cannot be used, and the firewall has no path to the Internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The default route is not active because the interface ethernet1/1 is down
Why this is correct
The route flags show 'A' (active), but the table indicates 0 routes, so the route might be inactive; interface down is a common cause.
- ✗
The next hop 10.1.1.1 is not reachable
Why it's wrong here
While possible, the more direct cause from the exhibit is the routing table showing 0 entries, suggesting the route is not installed.
- ✗
There is no default route configured
Why it's wrong here
The route to 0.0.0.0/0 is present.
- ✗
The route table is empty because the virtual-router is misconfigured
Why it's wrong here
The virtual-router exists but shows 0 entries, indicating the routes are not active, likely due to interface state.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.