PCNSE Manage, Monitor and Operate Practice Question
A firewall is dropping traffic that should be allowed. The security policy appears correct. An administrator checks the session table and notices the session state is 'CLOSE'. What is the most likely cause of the traffic being dropped?
⚠ Common exam trap
Many exam-takers assume a 'CLOSE' state means the firewall is actively dropping traffic due to a policy or resource issue, but the correct interpretation is that the session was properly terminated and the firewall is simply enforcing that closure by dropping subsequent packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server is sending a FIN/RST prematurely due to application layer issues.
When a firewall sees a session state of 'CLOSE', it indicates that the session has been terminated via a proper TCP FIN or RST exchange. If the server is sending a FIN or RST prematurely due to application-layer issues (e.g., a misconfigured application, a bug causing early connection closure, or a load balancer sending a reset), the firewall will close the session and drop subsequent packets that belong to that flow, even if the security policy allows the traffic. This is because the firewall's session table no longer has an active session for the traffic, so the packets are treated as unsolicited and dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The server is sending a FIN/RST prematurely due to application layer issues.
Why this is correct
A session in CLOSE state means a FIN or RST was already exchanged, so the firewall treats the flow as terminating and drops subsequent packets. A premature FIN/RST from the server, caused by application-layer issues, produces this state despite a correct security policy.
- ✗
A deny all security policy is blocking the traffic.
Why it's wrong here
A CLOSE session state indicates the firewall has already torn down the flow, typically after a timeout or RST, not that policy denied it. A deny-all rule would prevent session creation entirely, so no session would appear. Deny-all policies are the right tool for default-deny hardening, not for diagnosing an existing CLOSE state.
- ✗
Asymmetric routing is causing the session to be torn down.
Why it's wrong here
A CLOSE session state indicates normal session teardown after completion or timeout, not asymmetric routing, which typically produces discard or asymmetric-path states. It would be correct where return traffic traverses a different firewall, leaving sessions without matching flows.
- ✗
Packet buffer exhaustion on the firewall is causing drops.
Why it's wrong here
Packet buffer exhaustion manifests as discard counters and dropped packets, not a session reaching the CLOSE state, which reflects session teardown. It would be correct when interface or global buffer counters show sustained exhaustion causing drops under heavy load.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.