PCNSE Deploy and Configure Firewalls Practice Question
A firewall is configured with multiple virtual wire interfaces. Traffic passes through but the firewall cannot enforce security policies based on source/destination IP addresses. What is the reason?
⚠ Common exam trap
It's easy for candidates to assume virtual wire mode still allows IP-based policies because the firewall can see IP packets, but they forget that the firewall does not process Layer 3 headers in this mode, making IP-based policy enforcement impossible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual wire mode does not support IP-based policies
In virtual wire mode, the firewall operates as a transparent Layer 2 bridge, forwarding frames based on MAC addresses without performing any IP routing or inspection of Layer 3 headers. Because the firewall does not see the source or destination IP addresses in the traffic, it cannot enforce security policies that rely on IP-based criteria. Option D correctly identifies that virtual wire mode inherently does not support IP-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The virtual wire is not configured with zones
Why it's wrong here
Zones are required but even with zones, IP-based policies are not available in virtual wire mode.
- ✗
The virtual wire requires a VLAN tag
Why it's wrong here
VLAN tagging is optional and does not enable IP-based policies.
- ✗
The security policy is in layer 3 mode
Why it's wrong here
Layer 3 mode is for routed interfaces; virtual wire is Layer 2.
- ✓
Virtual wire mode does not support IP-based policies
Why this is correct
In virtual wire mode, the firewall acts as a transparent bridge and cannot inspect IP addresses for policy matching.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.