PCNSE Core Concepts and Architecture Practice Question
A company has configured a security policy that allows HTTP traffic from the internal network 10.0.0.0/8 to the internet. However, users from subnet 10.2.0.0/24 are unable to access external websites. The firewall logs show that traffic from 10.2.0.100 to 203.0.113.1 on port 80 is being denied. Which action should the administrator take to resolve the issue?
⚠ Common exam trap
Many candidates assume modifying the existing allow rule or deleting the deny rule will fix the issue, but they overlook the fundamental principle of rule order in a first-match firewall, where a higher-priority deny rule will block traffic even if a lower-priority allow rule exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.
In a stateful firewall like Palo Alto Networks, security rules are evaluated in order from top to bottom, and the first matching rule is applied. If a deny rule exists above any allow rule for the 10.2.0.0/24 subnet, traffic from that subnet will be denied. Adding a new allow rule for 10.2.0.0/24 and placing it above the existing deny rule ensures that HTTP traffic from that subnet is permitted before reaching the deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the existing allow rule to include the entire 10.2.0.0/24 subnet in the source.
Why it's wrong here
Modifying the existing rule might not work if there is a deny rule above it still matching.
- ✗
Change the destination zone of the allow rule to 'any'.
Why it's wrong here
Changing the destination zone is not relevant; the issue is rule order.
- ✓
Add a new security rule allowing traffic from 10.2.0.0/24 and place it above the existing deny rule.
Why this is correct
A rule placed higher in the order matches first. Adding an allow rule above the deny rule will permit the traffic.
- ✗
Delete the deny rule that is blocking the traffic.
Why it's wrong here
Deleting the deny rule could expose other traffic that should be blocked.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.