PCNSE Core Concepts and Architecture Practice Question
A firewall has two virtual routers: VR1 (for internal networks) and VR2 (for DMZ). An internal server in VR1 needs to reach a DMZ server in VR2. Both virtual routers have routes to each other's subnets via a shared inter-connect. The firewall is receiving traffic but is dropping packets between the virtual routers. What configuration is missing?
⚠ Common exam trap
It's easy for candidates to confuse routing (Layer 3) with security policy (Layer 4-7), assuming that if routes exist, traffic will flow, but Palo Alto firewalls enforce zone-based policies independently of routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security policy allowing traffic between the zones associated with the virtual routers
In Palo Alto Networks firewalls, virtual routers handle routing decisions independently, but traffic between zones (e.g., internal and DMZ) must be explicitly allowed by a security policy. Even if routes exist between VR1 and VR2, the firewall will drop inter-zone traffic without a policy that permits the session. This is a fundamental security enforcement mechanism that separates routing from access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Redistribution of routes between the virtual routers
Why it's wrong here
Redistribution handles route sharing, but if routes are already known, traffic may still be blocked by security policy.
- ✗
Enabling packet forwarding on the virtual router interfaces
Why it's wrong here
Forwarding is enabled by default; no additional setting is needed.
- ✓
A security policy allowing traffic between the zones associated with the virtual routers
Why this is correct
Traffic between VRs may involve different zones; without an allow policy, packets are dropped.
- ✗
A static route on both virtual routers pointing to each other's subnets
Why it's wrong here
Routes already exist as stated; this would not resolve drop issue.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.