← PCNSE·Palo Alto Networks

Question 351 of 516

Deploy and Configure Firewalls →hardMultiple ChoiceObjective-mapped

Application Rule Allowing HTTP/HTTPS Still Blocks Traffic: Add Service Objects

This PCNSE practice question tests your understanding of deploy and configure firewalls. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: app-ID. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A network engineer is deploying a new firewall to inspect traffic between two VLANs. The requirement is to block all traffic except HTTP and HTTPS from the internal network to a specific web server in the DMZ. The engineer applies a security policy with the following configuration: source zone Internal, destination zone DMZ, source address internal_subnet, destination address web_server, application set to 'web-browsing' and 'ssl', and action set to 'allow'. However, users report that they cannot access the web server. Which change must be made to the policy to resolve the issue?

A
Add the service objects for HTTP (tcp/80) and HTTPS (tcp/443) to the rule
Why wrong: Adding service objects for HTTP and HTTPS is unnecessary because Palo Alto App-ID can identify these applications without relying on port numbers. The issue is not related to missing service objects.
B
Configure source NAT on the internal zone
Why wrong: Source NAT is used to translate internal IP addresses when traffic leaves the firewall, but this is not required for traffic between VLANs (internal to DMZ) unless specific address translation is needed. It does not address the access issue.
C
Create a separate rule for HTTP and another for HTTPS
Why wrong: Creating separate rules for HTTP and HTTPS is redundant. A single rule with both applications is valid and should work if the rule is evaluated properly.
D
Move the security policy rule to a higher priority in the rulebase
Moving the rule to a higher priority ensures it is evaluated before any other rules that might block the traffic. This is the correct fix if a blocking rule with higher priority is currently matching and denying the traffic.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Move the security policy rule to a higher priority in the rulebase

The security policy uses App-ID to identify web-browsing and ssl applications, which does not require explicit service objects. The most likely reason users cannot access the web server is that another rule with a higher priority (lower in the rulebase order) is blocking the traffic. Moving this allow rule to a higher priority ensures it is evaluated before any blocking rules, allowing the traffic to pass.

Key principle: App-ID

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add the service objects for HTTP (tcp/80) and HTTPS (tcp/443) to the rule
Why it's wrong here
Adding service objects for HTTP and HTTPS is unnecessary because Palo Alto App-ID can identify these applications without relying on port numbers. The issue is not related to missing service objects.
✗
Configure source NAT on the internal zone
Why it's wrong here
Source NAT is used to translate internal IP addresses when traffic leaves the firewall, but this is not required for traffic between VLANs (internal to DMZ) unless specific address translation is needed. It does not address the access issue.
✗
Create a separate rule for HTTP and another for HTTPS
Why it's wrong here
Creating separate rules for HTTP and HTTPS is redundant. A single rule with both applications is valid and should work if the rule is evaluated properly.
✓
Move the security policy rule to a higher priority in the rulebase
Why this is correct
Moving the rule to a higher priority ensures it is evaluated before any other rules that might block the traffic. This is the correct fix if a blocking rule with higher priority is currently matching and denying the traffic.
Related concept
App-ID

Common exam traps

Common exam trap: answer the scenario, not the keyword

Candidates often assume that App-ID requires service objects for layer 4 matching, but in Palo Alto firewalls, App-ID identifies applications independently of port. The real trap is forgetting that rule ordering (priority) determines which rule applies when multiple rules match.

Detailed technical explanation

How to think about this question

In Palo Alto Networks firewalls, application-based policies require the firewall to perform App-ID, which inspects traffic to identify the application. However, the service (TCP/UDP port) is a separate match criterion; if the service is not specified, the firewall may still block traffic if the default service (any) is not implicitly allowed. This is because the firewall enforces both application and service matches, and without explicit service objects, the traffic might be dropped by a default deny rule or misclassified. In real-world scenarios, always pair application objects with the corresponding service objects to ensure proper traffic flow, especially when using custom or non-standard ports.

KKey Concepts to Remember

App-ID
Security Policy Rule Priority
Service Objects

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

App-ID

Real-world example

How this comes up in practice

A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.

Visual reference

What to study next

Got this wrong? Here's your next step.

Review app-ID, then practise related PCNSE questions on the same topic to reinforce the concept.

Related PCNSE practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Manage, Monitor and Operate practice questions

Practise PCNSE questions linked to Manage, Monitor and Operate.

Securing Traffic and App-ID practice questions

Practise PCNSE questions linked to Securing Traffic and App-ID.

Securing Users and Applications with Authentication practice questions

Practise PCNSE questions linked to Securing Users and Applications with Authentication.

Decryption and SSL Inspection practice questions

Practise PCNSE questions linked to Decryption and SSL Inspection.

Managing Troubleshooting and High Availability practice questions

Practise PCNSE questions linked to Managing Troubleshooting and High Availability.

Deploy and Configure Firewalls practice questions

Practise PCNSE questions linked to Deploy and Configure Firewalls.

Core Concepts and Architecture practice questions

Practise PCNSE questions linked to Core Concepts and Architecture.

Secure Access and VPN practice questions

Practise PCNSE questions linked to Secure Access and VPN.

Troubleshoot practice questions

Practise PCNSE questions linked to Troubleshoot.

PCNSE fundamentals practice questions

Practise PCNSE questions linked to PCNSE fundamentals.

PCNSE scenario practice questions

Practise PCNSE questions linked to PCNSE scenario.

PCNSE troubleshooting practice questions

Practise PCNSE questions linked to PCNSE troubleshooting.

Practice this exam

Start a free PCNSE practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCNSE practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCNSE question test?

Deploy and Configure Firewalls — This question tests Deploy and Configure Firewalls — App-ID.

What is the correct answer to this question?

The correct answer is: Move the security policy rule to a higher priority in the rulebase — The security policy uses App-ID to identify web-browsing and ssl applications, which does not require explicit service objects. The most likely reason users cannot access the web server is that another rule with a higher priority (lower in the rulebase order) is blocking the traffic. Moving this allow rule to a higher priority ensures it is evaluated before any blocking rules, allowing the traffic to pass.

What should I do if I get this PCNSE question wrong?

Review app-ID, then practise related PCNSE questions on the same topic to reinforce the concept.

What is the key concept behind this question?

App-ID

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on PCNSE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

easy

✓ A.The application 'ssl' is not allowed in any security rule.
B.The session ended with TCP FIN, causing the firewall to deny.
C.The destination IP is blacklisted.
D.The security rule 'default-deny' explicitly blocks this traffic.

Why A: The traffic from 192.168.1.100 to 203.0.113.50 is denied because the application 'ssl' is not explicitly allowed in any security rule. Palo Alto Networks firewalls use App-ID to identify traffic by application, and if the application (e.g., SSL/TLS) is not permitted in a rule, the traffic is denied by default, even if the IP addresses and ports are otherwise allowed.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.