PCNSE Manage, Monitor and Operate Practice Question
A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?
⚠ Common exam trap
Many exam-takers assume a 'CLOSE' state means the firewall is actively dropping traffic due to a policy or resource issue, but the correct interpretation is that the session was properly terminated and the firewall is simply enforcing that closure by dropping subsequent packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server is sending a FIN/RST prematurely due to application layer issues.
When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The server is sending a FIN/RST prematurely due to application layer issues.
Why this is correct
A CLOSE state indicates a normal termination, often due to FIN or RST from one side.
- ✗
A deny all security policy is blocking the traffic.
Why it's wrong here
A deny policy would log as a deny action, not just a CLOSE state.
- ✗
Asymmetric routing is causing the session to be torn down.
Why it's wrong here
Asymmetric routing typically shows sessions stuck in SYN_SENT or SYN_RECV states.
- ✗
Packet buffer exhaustion on the firewall is causing drops.
Why it's wrong here
Buffer exhaustion would cause global drops, not a specific session state.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.