PCNSA Securing Traffic Practice Question
Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?
⚠ Common exam trap
It's easy for candidates to confuse 'Log at Session Start' with 'Log at Session End', thinking that logging at the start is sufficient for full traffic logging, but in reality, session-end logs provide the complete session metadata needed for security analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rule action to 'allow'.
Setting the rule action to 'allow' permits the traffic from the corporate network to the internet, which is the primary requirement. To also log the traffic, you must enable logging; 'Log at Session End' (Option E) is the standard method to capture session details after the connection completes. Together, these two settings achieve both allowing and logging the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the rule action to 'reset-both'.
Why it's wrong here
Reset-both terminates the session and sends TCP resets.
- ✓
Set the rule action to 'allow'.
Why this is correct
Allow permits traffic through the firewall.
- ✗
Set the rule action to 'deny'.
Why it's wrong here
Deny blocks traffic.
- ✗
Enable 'Log at Session Start' in the rule.
Why it's wrong here
Logging at session start is optional and not required for logging; session end provides standard logging.
- ✓
Enable 'Log at Session End' in the rule.
Why this is correct
This logs the session after it completes, providing a record of allowed traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.