PCNSE Manage, Monitor and Operate Practice Question
A network administrator notices that traffic from a specific IP address is being blocked unexpectedly. The traffic is allowed in the security policy. What is the most likely cause?
⚠ Common exam trap
Candidates often assume a security policy 'allow' rule is absolute, but they forget that security profiles (including EDL-based block lists) can override the policy action, leading them to incorrectly choose profile settings (Option C) instead of recognizing the specific IP-based blocking mechanism of an EDL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IP address is on a block list in the External Dynamic List (EDL).
The most likely cause is that the IP address is on a block list in an External Dynamic List (EDL). Even if a security policy explicitly allows traffic from that IP, a block list configured in an EDL overrides the policy because the firewall evaluates threat prevention and URL filtering profiles, including EDL-based block lists, before or in parallel with security policy rules. This is a common troubleshooting scenario where traffic is allowed by policy but still blocked due to a higher-priority security profile action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source zone is incorrectly assigned.
Why it's wrong here
Incorrect zone would likely cause a different rule match, not an unexpected block.
- ✗
The application override is misconfigured.
Why it's wrong here
Application override affects application identification, not blocking.
- ✗
The profile settings for the security policy are blocking the traffic.
Why it's wrong here
Profile settings like antivirus or vulnerability protection can block, but the question states the traffic is allowed in the security policy, meaning profiles are applied after the rule matches.
- ✓
The IP address is on a block list in the External Dynamic List (EDL).
Why this is correct
An EDL block list overrides security policy rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.