PCNSE Core Concepts and Architecture Practice Question
A company uses Panorama to manage multiple firewalls. They want to push a security policy that applies to all firewalls but with a specific exception for one firewall in a different region. Which Panorama method should be used?
⚠ Common exam trap
A common mix-up: candidates confuse rule override with rule addition, thinking that adding a pre-rule or post-rule can override a shared policy, when in fact only an explicit override within the same rule type (shared or device group) can replace a rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a shared policy and override the rule on the specific device group.
Panorama allows a shared policy to be pushed to all firewalls, and you can override a specific rule for a particular device group. By placing the exception rule in the device group that contains the firewall in the different region, you can override the shared policy for that firewall while the rest continue to use the shared policy. This maintains centralized management while accommodating regional exceptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a shared policy and override the rule on the specific device group.
Why this is correct
Panorama allows overriding rules at the device group level for exceptions.
- ✗
Use a post-rule in the device group.
Why it's wrong here
Post-rules apply after shared rules but also apply to all devices in the group.
- ✗
Use a device-specific pre-rule.
Why it's wrong here
Pre-rules are applied before shared rules but cannot easily create exceptions for a single device.
- ✗
Use a template variable.
Why it's wrong here
Template variables manage configurations, not security policy exceptions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.