PCNSE Troubleshoot Practice Question
A network engineer notices that traffic from a specific subnet is being dropped by the firewall. The traffic log shows 'drop' with reason 'policy deny'. The engineer checks the security policy and confirms there is an allow rule for that subnet. What should be checked next?
⚠ Common exam trap
The common mistake is assuming that if an allow rule exists for the subnet, it will always be applied, ignoring that Palo Alto firewalls evaluate rules top-down and a higher-priority deny rule can preempt the allow rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the rule order and ensure the allow rule is above any deny rules.
When a traffic log shows 'policy deny' despite an existing allow rule, the most common cause is rule order: Palo Alto firewalls evaluate security rules from top to bottom, and the first matching rule is applied. If a deny rule appears above the allow rule for the same subnet, the deny rule will match first and drop the traffic, making it essential to verify the rule sequence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the application override.
Why it's wrong here
Application override policies sit above security rules and can force traffic to a different rulebase, but the log's 'policy deny' indicates the matched rule explicitly denied it, so the allow rule was never reached. Application override suits cases where traffic is unexpectedly classified or matched to the wrong application.
- ✗
Check the QoS policy.
Why it's wrong here
QoS policies shape bandwidth and prioritisation; they do not generate 'policy deny' drops, which originate solely from security rule evaluation. Checking QoS suits troubleshooting latency, jitter or throughput degradation after traffic is already permitted, not diagnosing why a firewall rejected a session outright.
- ✓
Check the rule order and ensure the allow rule is above any deny rules.
Why this is correct
PAN-OS evaluates security rules top-down and stops at the first match. A deny rule positioned above the allow rule for that subnet matches first, producing the 'policy deny' drop despite the allow rule existing lower in the policy.
- ✗
Check the NAT policy for the traffic.
Why it's wrong here
NAT policy is evaluated before security policy, so a misapplied translation could redirect traffic to a different zone or rule than the engineer expects, yet the log already shows 'policy deny' rather than a NAT failure. Checking NAT suits diagnosing connectivity or routing symptoms, not an explicit policy-deny verdict.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.