PCNSE Deploy and Configure Firewalls Practice Question
A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?
⚠ Common exam trap
Many exam-takers assume a subnet like 10.1.0.0/16 is not part of 10.0.0.0/8, but in CIDR notation, 10.1.0.0/16 is indeed a subset of 10.0.0.0/8, so the issue is rule order, not address mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Another rule earlier in the policy matches the traffic and allows it before reaching this rule.
In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Another rule earlier in the policy matches the traffic and allows it before reaching this rule.
Why this is correct
PAN-OS evaluates rules top-down and stops at the first match, so an earlier allow rule for 10.1.0.0/16 permits the traffic before the logging rule is reached. Only the matched rule's log setting applies, hence no log entry appears.
- ✗
The firewall is configured to not log interzone traffic.
Why it's wrong here
Interzone traffic between Trust and Untrust is logged normally on Palo Alto Networks firewalls; no global setting suppresses it, so this cannot explain the missing entries. It is tempting because implicit interzone and intrazone defaults do govern some traffic handling, which is the correct cause when intrazone logging is absent.
- ✗
The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.
Why it's wrong here
10.1.0.0/16 sits inside 10.0.0.0/8, so the source address matches the rule and traffic is permitted; the premise is arithmetically false. It is tempting because a subnet outside the rule's source range genuinely would bypass it, which is the correct diagnosis when the unmatched prefix truly falls outside 10.0.0.0/8.
- ✗
The logging profile is not applied to the rule.
Why it's wrong here
Palo Alto Networks security rules log via the action's log-setting field, and 'log at rule end' is configured, so a separate logging profile is not the mechanism gating this traffic. It is tempting because logging profiles do control threat, URL and WildFire logging, which is the right answer when those log types are missing.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.