PCNSE Troubleshoot Practice Question
A security policy rule is configured to deny traffic, but no logs are generated when the traffic is denied. Which of the following is the most likely reason?
⚠ Common exam trap
A common mix-up: candidates assume 'log at session end' will always generate a log for deny actions, not realizing that deny actions never create a session, so the session end event never occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.
When a security policy rule is configured with a deny action and logging is set to 'log at session end', the firewall will not generate a log entry because the session is denied immediately and never reaches a normal session end. In Palo Alto Networks firewalls, session end logging requires the session to be established and then terminate naturally; a denied session is dropped before any session state is created, so no log is generated. To capture logs for denied traffic, logging must be explicitly enabled at session start or the rule must be configured to log at session start.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall's system log rate is exceeded and logs are dropped.
Why it's wrong here
System log rate limits affect system logs, not security logs.
- ✗
The rule has logging disabled for the 'deny' action.
Why it's wrong here
Logging can be configured per rule, but the default for deny actions may still log; the issue is often that logging at session start is not enabled.
- ✗
The rule is not being matched because a previous rule allows the traffic.
Why it's wrong here
If another rule allows the traffic, the session would be allowed, not denied, and logs would appear for that rule.
- ✓
The rule is configured to log at session end, but the session ends immediately upon denial, so no log is generated.
Why this is correct
Denied sessions are not established; they end immediately. Logging at session end does not trigger for sessions that never start. To log denied traffic, enable logging at session start.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.