PCNSE Deploy and Configure Firewalls Practice Question
A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)
⚠ Common exam trap
Many candidates confuse 'web-browsing' (HTTP) with 'ssl' (HTTPS) or rely on port-based rules (service tcp/443) instead of application-based rules, which Palo Alto emphasizes for proper security policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.
It uses the 'ssl' application to match HTTPS traffic, which is the proper application-based method for allowing outbound HTTPS. This rule specifies the source as 'internal-users' and destination as 'any', with the action 'allow', meeting requirement (1) without over-permitting. Option C is correct because it creates a rule from 'external' to 'internal', targeting the mail server IP with application 'smtp' and service 'application-default', which blocks all inbound traffic except SMTP to that specific server, satisfying requirement (2).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.
Why it's wrong here
Using service instead of application may allow non-HTTPS traffic on port 443.
- ✓
Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.
Why this is correct
Correctly allows HTTPS with application-based control.
- ✓
Rule: from external to internal, source any, destination mail-server-ip, application smtp, service application-default, action allow.
Why this is correct
Correctly allows inbound SMTP only to the mail server.
- ✗
Rule: from internal to external, source any, destination any, application any, service any, action allow.
Why it's wrong here
Overly permissive; allows all outbound traffic.
- ✗
Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.
Why it's wrong here
Allows all web-browsing including HTTP, but requirement is only HTTPS.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.