PCNSE Practice Question: Managing Troubleshooting and High Availability
A network engineer needs to troubleshoot why a specific user cannot access a web application through a Palo Alto Networks firewall. The engineer has verified that the user's traffic reaches the firewall and that no security policy explicitly blocks the traffic. Which CLI command should be used to check if the traffic is being matched by a hidden or implicit rule?
⚠ Common exam trap
Candidates often assume 'show running security-policy' or 'show session all' can reveal implicit rule matches, but they only show explicit configurations or active sessions, respectively, missing the hidden default rules that are evaluated by the firewall's policy engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
test security-policy-match source <ip> destination <ip> destination-port <port> protocol <tcp>
'test security-policy-match', is the correct command because it simulates a packet against the firewall's security policy rulebase, including any hidden or implicit rules (such as the default intra-zone allow or inter-zone deny rules). This allows the engineer to see exactly which rule the traffic matches, even if no explicit policy is configured, which is essential for troubleshooting implicit rule behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
show session all
Why it's wrong here
This shows current sessions but does not indicate which policy matched.
- ✗
debug dataplane packet-diag
Why it's wrong here
`debug dataplane packet-diag` captures raw packet-level diagnostics for dataplane forwarding issues, but it does not inspect rule-matching against hidden or implicit policies. The correct command, `show running security-policy match`, evaluates traffic against the entire rulebase including default deny rules. This option is tempting because packet-diag is useful for verifying packet drops or NAT transformations in the dataplane, but it cannot reveal which policy rule, implicit or explicit, the traffic matches.
- ✓
test security-policy-match source <ip> destination <ip> destination-port <port> protocol <tcp>
Why this is correct
This command tests traffic against the security policy and shows the matching rule, including implicit denies.
- ✗
show running security-policy
Why it's wrong here
This shows configured policies but does not test which rule matches specific traffic.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.