PCNSE Deploy and Configure Firewalls Practice Question
A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?
⚠ Common exam trap
Candidates often assume the issue is with the User-ID agent's configuration or status, but the question specifies that some users are affected, pointing to a per-user mapping gap rather than a global agent failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's IP is not in the User-ID mapping table
When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security policy order is incorrect
Why it's wrong here
Policy ordering affects which rule matches first, but a user in the correct group would still match a permit rule placed above a deny; ordering does not explain group members failing. It is tempting because misordered rules do cause unexpected blocks, and would be correct if a broader deny rule preceded the user-based permit.
- ✗
The firewall is not configured to use the User-ID agent
Why it's wrong here
User-ID mapping is already working, since users are recognised and placed in groups; the agent configuration governs whether mappings are generated at all, not whether an existing mapping matches policy. It is tempting because a missing agent does break User-ID, and would be correct if no users were being mapped.
- ✗
The User-ID agent is not running
Why it's wrong here
Without the agent running, no user-to-IP mappings reach the firewall, so user-based policy conditions match nothing and traffic is blocked. It is tempting because the agent is genuinely required for User-ID, but the stem says some users map correctly, so the agent is running; the fault lies in group mapping or timeouts.
- ✓
The user's IP is not in the User-ID mapping table
Why this is correct
User-ID policy enforcement depends on a valid IP-to-user mapping. If the source IP is absent from the mapping table, the firewall cannot resolve the user, so user-based rules fail to match and traffic is blocked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.