PCNSA Policy Evaluation and Management Practice Question
Exhibit
set security policies policy-name Allow-Sales-to-Finance from Sales to Finance source any destination 10.10.10.0/24 application ms-office365 action allow log-start yes set security policies policy-name Deny-Other from Sales to Finance source any destination any application any action deny log-end yes
Refer to the exhibit. Traffic from Sales zone to Finance zone reaches destination 10.10.10.10 using application 'ssl'. What action does the firewall take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The firewall first checks Rule 1, which only matches traffic with application 'ms-office365'. Since the traffic uses 'ssl', it does not match. The firewall then checks Rule 2, which denies all traffic from Sales to Finance zone. Therefore, the firewall takes the action Deny. Option A is incorrect because while the firewall does evaluate the next rule, the action taken is Deny, not 'continue to the next rule'. Option B is incorrect because the traffic is not allowed. Option D is incorrect because there is no security profile involved; the deny rule blocks it without any profile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall will continue to the next rule
Why it's wrong here
There is no next rule; the second rule is the last and matches any application.
- ✗
Allow
Why it's wrong here
The first rule only allows ms-office365, not ssl.
- ✓
Deny
Why this is correct
Traffic does not match the first rule (application mismatch), so it matches the second rule and is denied.
- ✗
Allow only if no security profile blocks it
Why it's wrong here
The deny rule will block regardless of security profiles.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.