PCNSE Core Concepts and Architecture Practice Question
A company uses Policy-Based Forwarding (PBF) to route specific traffic from internal users to a partner network through an MPLS connection. The PBF rule is configured to match source addresses 10.1.1.0/24 and forward to a next-hop of 10.2.1.1. The administrator verifies that the MPLS router is reachable from the firewall. Traffic from the 10.1.1.0/24 network does not go through the MPLS link; instead, it takes the default route out the internet connection. Logs show that the traffic hits the PBF rule. What is the most likely issue?
⚠ Common exam trap
Watch out — candidates often assume specifying only the next-hop IP is sufficient for PBF, similar to a static route, but PAN-OS requires both the next-hop and the egress interface for policy-based forwarding to function correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The PBF rule is missing the egress interface configuration; it only specifies the next-hop IP.
A PBF rule in PAN-OS requires both a next-hop IP and an egress interface to be explicitly configured. Without the egress interface, the firewall cannot determine which physical or logical interface to use for forwarding the matched traffic, so it falls back to the default route. Even though the traffic hits the PBF rule, the missing interface configuration prevents the policy-based forwarding from taking effect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The PBF rule is missing the egress interface configuration; it only specifies the next-hop IP.
Why this is correct
PBF requires the next-hop and interface; if only IP is set, the firewall may not know which interface to use, defaulting to routing table.
- ✗
The PBF rule's source zone is misconfigured.
Why it's wrong here
If logs show PBF hit, source zone is likely correct.
- ✗
The firewall's routing table does not have a route to the partner network via the MPLS router.
Why it's wrong here
PBF forwards based on policy, not routing table, so route may not be needed if next-hop is specified.
- ✗
The PBF rule does not include a security policy to allow the traffic.
Why it's wrong here
Security policy still applies; PBF does not bypass security policy.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.