PCNSA Policy Evaluation and Management Practice Question
Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)
⚠ Common exam trap
Candidates often confuse operational features like logging or decryption with the core policy evaluation logic, assuming they influence rule matching, when in fact only rule order, rule state, and correct object definitions determine whether a deny rule blocks traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The position of the deny rule in the rulebase relative to allow rules.
The firewall evaluates rules in top-down order, and a deny rule placed above an allow rule for the same traffic will match first and block the traffic, even if a subsequent allow rule would have permitted it. This is a fundamental aspect of policy evaluation in Palo Alto Networks firewalls, where the first matching rule is applied and no further rule processing occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The position of the deny rule in the rulebase relative to allow rules.
Why this is correct
A higher-priority allow rule might match before the deny rule.
- ✓
Whether the deny rule is disabled.
Why this is correct
A disabled rule does not affect traffic.
- ✓
Whether the source/destination zones or addresses are correctly defined.
Why this is correct
Misconfigured match criteria can cause unexpected blocking.
- ✗
Whether logging is enabled on the rule.
Why it's wrong here
Logging is for visibility, not for blocking decision.
- ✗
Whether SSL decryption is enabled for the traffic.
Why it's wrong here
Decryption is for inspection, not a direct cause of blocking.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.