PCNSE Core Concepts and Architecture Practice Question
A security administrator wants to block traffic from IP address 192.168.1.100 to the internet. The firewall has a security policy that allows all outbound traffic. Which action should be taken to most efficiently block this specific host?
⚠ Common exam trap
Many candidates think a Zone Protection profile or QoS policy can block a specific host, but these features are designed for different purposes (threat prevention and traffic shaping, respectively) and do not provide the precise, rule-based blocking that a security rule offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.
The most efficient way to block a specific host in a Palo Alto Networks firewall is to create a security rule with a source IP of 192.168.1.100 and action 'deny', placed before the existing allow rule. Security rules are evaluated in order from top to bottom, and the first matching rule determines the action; placing the deny rule first ensures the host's traffic is blocked without affecting other traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Zone Protection profile to block the IP.
Why it's wrong here
Zone Protection profiles deal with DoS attacks, not access control.
- ✓
Create a new security rule with source IP 192.168.1.100 and action 'deny', placed before the allow rule.
Why this is correct
A simple deny rule is the most efficient method.
- ✗
Apply a QoS policy to limit the bandwidth from that IP to zero.
Why it's wrong here
QoS limits bandwidth but does not block traffic cleanly.
- ✗
Add the IP to an External Dynamic List and reference it in a security rule.
Why it's wrong here
An External Dynamic List (EDL) is designed to update firewall rules dynamically from an external feed, but here the administrator needs to block a single, static IP address. Adding 192.168.1.100 to an EDL introduces unnecessary overhead of maintaining a list and a separate security rule, whereas a simple address object in a deny rule directly achieves the goal. This option is tempting because EDLs are ideal for blocking large, frequently changing sets of malicious IPs from threat intelligence feeds, making them the correct choice when the source list is externally managed and volatile.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.