The correct answer is to deploy the VM-Series with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall. This configuration is required because for VM-Series AWS VPC inter-subnet inspection, the firewall must physically reside on the traffic path between the subnets; a single ENI cannot inspect traffic that never leaves its own subnet. By placing one ENI in each subnet and setting the route table of each subnet to point to the other subnet’s traffic with the firewall’s corresponding ENI as the next hop, you force all packets to traverse the firewall for inspection. On the PCNSA exam, this scenario tests your understanding of AWS networking fundamentals combined with Palo Alto’s virtual firewall deployment model. A common trap is assuming a single ENI with a default route can inspect east-west traffic, but inter-subnet inspection requires two ENIs and explicit routing. Memory tip: think “two subnets, two ENIs, two route table entries” to ensure bidirectional inspection.
PCNSA Palo Alto Networks Platforms and Architecture Practice Question
This PCNSA practice question tests your understanding of palo alto networks platforms and architecture. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security team is deploying a Palo Alto Networks firewall in an AWS VPC using the VM-Series. They need to ensure that traffic between two subnets within the same VPC is inspected by the firewall. What is the required network configuration?
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
This allows the firewall to inspect traffic between the subnets.
B
Create a VPC peering connection between the two subnets and attach the firewall.
Why wrong: VPC peering is for different VPCs, not subnets within the same VPC.
C
Attach the firewall to a single subnet and use it as a default gateway for both subnets.
Why wrong: A single ENI cannot handle traffic between two subnets; each subnet needs an ENI on the firewall.
D
Configure AWS security groups to route traffic through the firewall.
Why wrong: Security groups do not route traffic; they act as stateful firewalls.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall.
Why this is correct
This allows the firewall to inspect traffic between the subnets.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a VPC peering connection between the two subnets and attach the firewall.
Why it's wrong here
VPC peering is for different VPCs, not subnets within the same VPC.
✗
Attach the firewall to a single subnet and use it as a default gateway for both subnets.
Why it's wrong here
A single ENI cannot handle traffic between two subnets; each subnet needs an ENI on the firewall.
✗
Configure AWS security groups to route traffic through the firewall.
Why it's wrong here
Security groups do not route traffic; they act as stateful firewalls.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume a single firewall interface can act as a default gateway for multiple subnets, failing to understand that AWS route tables require explicit next-hop entries for inter-subnet traffic and that the local VPC route cannot be removed.
Detailed technical explanation
How to think about this question
The VM-Series firewall in AWS uses a 'transparent' or 'virtual wire' mode via two ENIs to enforce policy on east-west traffic. Route tables must have a more specific route (e.g., 10.0.2.0/24 via the firewall's ENI in subnet A) than the local VPC route, which is a limitation of AWS routing where the local route is always present and cannot be overridden; thus, the firewall must be placed in a separate subnet (a 'transit' or 'firewall' subnet) and route tables must point to the firewall's ENI for inter-subnet traffic.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Palo Alto Networks Platforms and Architecture — This question tests Palo Alto Networks Platforms and Architecture — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Deploy the firewall with two elastic network interfaces, one in each subnet, and configure route tables to send inter-subnet traffic through the firewall. — Option A is correct because to inspect traffic between two subnets within the same VPC, the VM-Series firewall must be deployed with two elastic network interfaces (ENIs), one in each subnet. Route tables for both subnets must be configured to direct inter-subnet traffic to the firewall's ENI as the next hop, ensuring all packets traverse the firewall for inspection.
What should I do if I get this PCNSA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.