PCNSE Deploy and Configure Firewalls Practice Question
A security engineer is deploying a new PA-5220 firewall to replace an existing legacy firewall. The environment has complex routing with OSPF and BGP. The engineer configures the firewall with multiple virtual routers: one for the internal network, one for the DMZ, and one for the external connection to two ISPs. The firewall is placed in Layer 3 mode. After the cutover, users report that they can access the internet but internal traffic between two different subnets that are both in the internal virtual router fails to route properly. The engineer checks the routing table on the internal virtual router and sees correct OSPF learned routes. The security policies allow all traffic between those subnets. What is the most likely cause of the routing failure?
⚠ Common exam trap
Candidates often assume that security policies alone control traffic flow, forgetting that virtual routers create isolated routing domains, and that interfaces in different virtual routers cannot route to each other without explicit route leaking or redistribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The internal interfaces are assigned to different virtual routers
The most likely cause is that the internal interfaces are assigned to different virtual routers. In a Palo Alto Networks firewall, Layer 3 interfaces belong to a specific virtual router, and routing between subnets in different virtual routers requires either a route leak or a shared virtual router. Since the engineer placed both subnets in the same internal virtual router but the interfaces are in different virtual routers, the firewall cannot route traffic between them even if the routing table and security policies are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall does not have a loopback interface for OSPF router-id
Why it's wrong here
OSPF router-id can be set manually; loopback is not mandatory.
- ✗
The security policy is not correctly identifying the traffic due to asymmetric routing
Why it's wrong here
Asymmetric routing is possible but less likely; the issue is routing, not policy match.
- ✓
The internal interfaces are assigned to different virtual routers
Why this is correct
If the interfaces belong to different virtual routers, the firewall will not route between them by default without inter-VR route leaking or a shared VR.
- ✗
The OSPF metric is too high, causing route preference issues
Why it's wrong here
Routes are present in the routing table; OSPF metric affects path selection, not reachability.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.