PCNSE Troubleshoot Practice Question
A healthcare organization recently replaced their primary internet circuit and changed the next-hop IP for the default route from 203.0.113.1 to 198.51.100.1. After the change, all internet traffic is failing. The firewall is a PA-220 running PAN-OS 9.1. The administrator verifies that the new default route is present in the virtual router and that the security policies are unchanged. The IP address configuration on the ethernet interface is correct and the link is up. When pinging 8.8.8.8 from the firewall's management interface, it succeeds. But traffic from internal hosts fails. The traffic log shows 'drop' with reason 'route - no route to host'. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a default route in any virtual router applies globally, but PAN-OS enforces strict virtual router isolation per zone, so the route must be in the same virtual router as the source zone's interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The default route is not in the same virtual router as the internal zones.
The traffic log shows 'route - no route to host', which indicates the firewall cannot find a valid path for the traffic. Even though the default route is present in the virtual router, if the internal zones (e.g., trust zone) are in a different virtual router than the one containing the default route, the firewall will not use that default route for traffic from those zones. Each virtual router maintains its own routing table, and inter-virtual-router routing requires explicit route leaking or redistribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The default route is not in the same virtual router as the internal zones.
Why this is correct
If internal zones are in a different VR, traffic from them cannot use the default route, resulting in no route to host.
- ✗
The new internet circuit does not allow ICMP.
Why it's wrong here
ICMP blocking would not cause 'no route to host'; it would cause timeouts or unreachable messages.
- ✗
The internal hosts have incorrect DNS settings.
Why it's wrong here
Incorrect DNS settings would cause name resolution failures, not route drops.
- ✗
The ARP table for the gateway is stale.
Why it's wrong here
A stale ARP entry would cause intermittent issues, but the error would be 'no ARP' not 'no route to host'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.