PCNSA Securing Traffic Practice Question
Traffic between two internal zones is being dropped due to a security policy rule that blocks any traffic. However, the administrator needs to allow specific inter-zone traffic for a critical application. The allowed traffic is sourced from a special IP range. How should the administrator configure the security policy to permit only this traffic while still blocking other traffic?
⚠ Common exam trap
The trap is thinking that a single rule can both allow and deny based on source, or that modifying the deny rule is acceptable; the key is rule order and specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a new allow rule above the deny rule that matches the specific traffic.
In Palo Alto Networks security policies, rules are evaluated top-down, and the first match is applied. To allow specific traffic while still blocking other traffic, the administrator should add a new allow rule above the existing deny rule that matches the specific source IP range and application. This ensures the specific traffic is permitted, while all other traffic continues to be blocked by the deny rule below.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a single rule with both allow and deny actions based on source.
Why it's wrong here
Palo Alto security policy rules carry one action each; a single rule cannot both allow and deny based on source. It is tempting because one rule looks tidy, but the correct approach is an allow rule for the special IP range placed above the existing deny rule.
- ✗
Place the specific servers in a different zone and create a new policy for that zone.
Why it's wrong here
Moving servers into a new zone changes network segmentation and requires interface and routing reconfiguration, which the scenario does not ask for. It is tempting when zones genuinely need isolation, but here a policy rule scoped to the special IP range above the deny rule suffices.
- ✓
Add a new allow rule above the deny rule that matches the specific traffic.
Why this is correct
PAN-OS evaluates security policy top-down, so a specific allow rule placed above the existing deny rule matches the special source range first and permits it. All other inter-zone traffic continues to hit the deny rule, preserving the block.
- ✗
Modify the existing deny rule to allow all traffic.
Why it's wrong here
Changing the deny rule to allow all traffic removes the block entirely, permitting every source rather than only the special IP range. It is tempting as a quick fix, but the requirement is to allow specific traffic while still blocking everything else, achieved with a scoped allow rule above the deny.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.