easyMultiple ChoiceObjective-mapped
PCNSA Practice Question: Is a best practice when creating security policy…
Which of the following is a best practice when creating security policy rules on a Palo Alto Networks firewall?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create rules with the most specific conditions first
Best practice is to create security policy rules with the most specific conditions first. This ensures that specific traffic is matched before more general rules, reducing the risk of unintended matches. Option A is incorrect because using 'any' for source and destination zones is not a best practice; it should be avoided to maintain granularity. Option C is incorrect because mixing inbound and outbound rules in the same rulebase section can lead to confusion and is not recommended; rules should be grouped logically. Option D is incorrect because specific rules should be placed above general rules, not the other way around.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use 'any' for source and destination zones to save time
Why it's wrong here
Using 'any' for source and destination zones is not a best practice because it reduces visibility and granularity. It is better to specify the exact zones involved.
- ✓
Create rules with the most specific conditions first
Why this is correct
Creating rules with the most specific conditions first is a best practice because it ensures that the intended traffic is matched before broader rules, minimizing unintended matches.
- ✗
Mix inbound and outbound rules in the same rulebase section
Why it's wrong here
Mixing inbound and outbound rules in the same rulebase section is not recommended; they should be grouped separately by zone to maintain clarity and order.
- ✗
Place general rules above specific rules
Why it's wrong here
General rules should be placed below specific rules, not above, to allow specific traffic to be matched first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.