PCNSE Manage, Monitor and Operate Practice Question
A network administrator is reviewing the firewall's logs and notices that many sessions are being denied by the security policy. The administrator wants to quickly identify the top source IP addresses that are being denied. Which feature in the PAN-OS web interface should the administrator use to accomplish this?
⚠ Common exam trap
Test-takers frequently confuse the Threat log with the Traffic log; denied sessions by policy are not threats and are only in the Traffic log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Traffic log with a filter for denied sessions and then sorting by source IP.
The Traffic log records all sessions, including those denied by security policy. By applying a filter for denied actions and then using the log viewer's aggregation or sorting capabilities, the administrator can quickly identify the top source IP addresses. This is a standard operational task in PAN-OS. Other logs or tools do not provide the same direct access to denied session data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Application Command Center (ACC) with a filter for denied traffic.
Why it's wrong here
The ACC provides visual summaries of network activity, including denied sessions, but it is more focused on application and threat trends rather than top source IP addresses. While it can show top sources, it is not the most direct tool for quickly identifying top denied source IPs; the log viewer with filtering and sorting is more efficient for this specific task.
- ✓
The Traffic log with a filter for denied sessions and then sorting by source IP.
Why this is correct
The Traffic log displays all session details. By filtering for denied sessions (e.g., action eq deny) and then sorting or using the log viewer's aggregation feature to group by source IP, the administrator can quickly see the top source IP addresses. This is the most direct and efficient method to identify top denied sources from the log data.
- ✗
The Threat log with a filter for denied traffic.
Why it's wrong here
The Threat log contains threat events, not security policy denies. Denied sessions due to security policy are logged in the Traffic log, not the Threat log. The Threat log is for antivirus, anti-spyware, vulnerability, and other threat signatures. Using it to find denied source IPs would yield incorrect or no results.
- ✗
The Session Browser with a filter for denied sessions.
Why it's wrong here
The Session Browser shows current active sessions, not historical denied sessions. Denied sessions are not active; they are logged and terminated. Therefore, the Session Browser would not show denied traffic. It is used for real-time troubleshooting of active sessions, not for analyzing historical deny logs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.