Why URL Filtering Overrides Application-Based Allow Rules
A user reports that they cannot access a specific website. Traffic matches a security policy rule that allows the application 'web-browsing' but the session is being dropped. Which of the following is the most likely cause?
Quick Answer
The correct answer is a URL Filtering profile blocking the site's category, because it illustrates an important layering concept in how Palo Alto Networks firewalls process a session: application identification and URL filtering are sequential, independent checks, not a single pass-or-fail decision. The security policy rule that allows 'web-browsing' only governs whether traffic matching that application is permitted to be evaluated further; it doesn't guarantee the session survives every subsequent inspection step. Once the application is confirmed, if a URL Filtering profile is attached to that same rule, the firewall separately evaluates the destination URL's category against that profile's rules, and a block action there terminates the session even though the application-layer decision was a clear allow. This is why an administrator can be confident a rule 'allows' the traffic and still see it dropped: the application and the content being carried over that application are graded independently, and either one can produce a block. Whenever a scenario describes traffic that matches an allow rule for a broad application like web-browsing but is still dropped, look at what security profiles, especially URL Filtering, are attached to that rule, since profile-based enforcement can override an application-level permit without changing the policy's stated action.
⚠ Common exam trap
It's easy for candidates to assume 'web-browsing' allowed means all web traffic is permitted, overlooking that URL Filtering profiles can block specific URLs or categories even when the application is allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A URL Filtering profile is applied to the rule and is blocking the website's URL category.
A URL Filtering profile applied to the security policy rule can block traffic based on the website's URL category, even when the application 'web-browsing' is allowed. The session is dropped by the URL Filtering engine after the application is identified, which overrides the application-based permit action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security policy rule does not have logging enabled at session end.
Why it's wrong here
Logging settings do not affect whether traffic is allowed or dropped; they only control log generation.
- ✗
SSL decryption is enabled but the website certificate is untrusted.
Why it's wrong here
While an untrusted certificate can cause a block page, it does not drop the session by default; it may present a warning but still allow access depending on policy.
- ✗
A DoS protection profile is configured on the zone and is rate-limiting the user's IP.
Why it's wrong here
DoS protection typically drops traffic when thresholds are exceeded, but for a single user accessing a website, it is less likely than a URL block.
- ✓
A URL Filtering profile is applied to the rule and is blocking the website's URL category.
Why this is correct
URL Filtering profiles can override application-level allowances by blocking specific URL categories, causing the session to be dropped.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that they cannot access a specific website. The firewall security policy allows web traffic. The administrator checks the traffic log and sees that the session is being denied due to a 'URL Filtering' block. What should the administrator do to allow access?
easy- A.Disable URL filtering on the existing security rule
- B.Check the user-ID mapping to ensure the user is authenticated
- C.Create a new security rule allowing the user's IP to any
- ✓ D.Add the URL to an allow list in the URL filtering profile
Why D: The traffic log explicitly indicates a 'URL Filtering' block, meaning the firewall's URL filtering profile is denying the request based on the URL category or specific URL. Adding the URL to an allow list within the URL filtering profile overrides the block, allowing access while keeping the security rule and other filtering policies intact. This approach preserves security controls for other traffic and avoids disabling URL filtering entirely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.