PCNSE Manage, Monitor and Operate Practice Question
A company has a PA-3260 firewall configured with multiple virtual routers for segmentation. A new subnet 192.168.30.0/24 is added behind a layer3 interface that is part of virtual router 'VR-A'. The administrator adds a static route on the firewall to reach the subnet via next-hop 10.0.0.1. However, hosts in another virtual router 'VR-B' cannot reach the new subnet. The route is present in VR-A's routing table. What should the administrator do to resolve the issue?
⚠ Common exam trap
A common mix-up: candidates assume security policies are the only barrier between virtual routers, forgetting that virtual routers are isolated routing domains and a route must exist in the source virtual router's table before any policy can be applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.
Virtual routers in Palo Alto Networks firewalls are isolated routing tables. A route in VR-A is not visible to VR-B unless explicitly shared. Adding a static route in VR-B with the next-hop pointing to the interface IP of VR-A's interface (the gateway between the two virtual routers) allows VR-B to forward traffic for 192.168.30.0/24 to VR-A, which then routes it to the correct subnet. This is the standard method for inter-virtual-router routing without dynamic redistribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a security policy rule allowing the traffic between the zones.
Why it's wrong here
Security policy is necessary but does not solve the routing issue.
- ✓
Add a static route in VR-B pointing to the new subnet with next-hop as the interface IP of VR-A's interface.
Why this is correct
This gives VR-B the necessary routing information to reach the subnet via VR-A.
- ✗
Configure route redistribution between VR-A and VR-B using a routing protocol.
Why it's wrong here
Route redistribution requires a dynamic routing protocol such as OSPF or BGP to exchange routes between virtual routers, but the stem specifies that a static route was added to reach 192.168.30.0/24. Since VR-A contains only a static route and no dynamic protocol is configured, redistribution has no source protocol from which to advertise the route into VR-B. This option is tempting because redistribution is the standard method for sharing routes between virtual routers when both sides run a routing protocol; it would be correct if VR-A learned the subnet via OSPF or BGP and the administrator needed to propagate it into VR-B.
- ✗
Place all interfaces in the same virtual router.
Why it's wrong here
This would break the segmentation that the company wants.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.