PCNSE Core Concepts and Architecture Practice Question
A network engineer is configuring a new PA-220 firewall. They need to allow HTTP traffic from the 'trust' zone to the 'untrust' zone. However, the traffic is being dropped. A packet capture shows that the SYN packet is received but no SYN-ACK is sent. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume a missing security policy or NAT rule is the cause when a SYN packet is received but no SYN-ACK is sent, but the correct diagnostic is to check routing and destination reachability first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination IP is not reachable from the firewall.
The packet capture shows the SYN packet is received by the firewall but no SYN-ACK is sent. This indicates the firewall is not completing the TCP three-way handshake. The most common cause is that the destination IP is not reachable from the firewall, meaning the firewall cannot route the SYN packet to the next hop or the destination host is down. In this scenario, the firewall drops the SYN packet silently without generating a SYN-ACK because it cannot establish a session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
There is no NAT policy to translate the source IP.
Why it's wrong here
Without NAT, the packet would still be forwarded.
- ✓
The destination IP is not reachable from the firewall.
Why this is correct
If the firewall cannot route to the destination, it will drop the SYN.
- ✗
The firewall is not configured to inspect HTTP traffic.
Why it's wrong here
Inspection occurs after the session is established.
- ✗
The security policy does not have an allow rule for HTTP.
Why it's wrong here
If no allow rule, the SYN would be dropped with a deny reason.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.