PCNSE Deploy and Configure Firewalls Practice Question
A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?
⚠ Common exam trap
Many exam-takers assume a subnet like 10.1.0.0/16 is not part of 10.0.0.0/8, but in CIDR notation, 10.1.0.0/16 is indeed a subset of 10.0.0.0/8, so the issue is rule order, not address mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Another rule earlier in the policy matches the traffic and allows it before reaching this rule.
In a Palo Alto Networks firewall, security rules are evaluated from top to bottom, and the first matching rule is applied. If an earlier rule in the policy matches the traffic from 10.1.0.0/16 and allows it, the rule with logging at rule end will never be evaluated, and thus no log entry is generated for that traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Another rule earlier in the policy matches the traffic and allows it before reaching this rule.
Why this is correct
If an earlier rule allows the traffic, this rule is never evaluated, and logging is not triggered.
- ✗
The firewall is configured to not log interzone traffic.
Why it's wrong here
Interzone traffic is logged by default if a rule has logging enabled.
- ✗
The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.
Why it's wrong here
10.1.0.0/16 is indeed within 10.0.0.0/8.
- ✗
The logging profile is not applied to the rule.
Why it's wrong here
Logging is enabled at rule end; no separate profile is needed for basic logging.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.