PCNSA Securing Traffic Practice Question
Which TWO of the following are valid methods to bypass URL filtering for internal users while still enforcing it on external traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security rule with a URL category set to 'internal-ip'.
The correct answers are B and E. Option B is valid because the 'internal-ip' URL category automatically applies to traffic from internal IP addresses, effectively bypassing URL filtering for internal users when used in a security rule with an allow action. Option E is valid because you can create a custom URL category listing internal websites that should be allowed, then use it in a security rule that allows traffic for internal users while applying strict filtering to external traffic. Option A is incorrect because URL Filtering profile override is not a standard feature; User-ID agent configuration does not provide such override. Option C is incorrect because setting the action to 'alert' only logs the traffic, it does not bypass the filtering (the traffic is still subject to the block action if matched). Option D is incorrect because there is no IP exemption list in URL filtering profiles; exemptions are based on URL categories, not IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable URL Filtering profile override on the user-id agent configuration.
Why it's wrong here
User-ID agents do not have a URL filtering override feature; this is not a valid method.
- ✓
Create a security rule with a URL category set to 'internal-ip'.
Why this is correct
The 'internal-ip' category is predefined to match traffic to internal IP addresses and bypasses URL filtering.
- ✗
Set the URL Filtering profile action to 'alert' instead of 'block'.
Why it's wrong here
'Alert' still evaluates the URL but logs instead of blocking; it does not bypass filtering.
- ✗
Add the user's IP address to an exemption list in the URL filtering profile.
Why it's wrong here
URL filtering profiles do not have IP exemption lists; exemptions are done via security rules.
- ✓
Use a custom URL category list that includes the allowed internal websites.
Why this is correct
Custom URL categories can be created and referenced in security rules to allow specific sites without URL filtering.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.