PCNSE Troubleshoot Practice Question
A user reports that they cannot access a website. The firewall logs show the session was denied with 'No rule matched'. The security policy has a rule that should match the traffic. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on rule order or IP addresses, overlooking that zone misconfiguration is the primary reason a rule is skipped entirely, as Palo Alto Networks firewalls enforce zone-based policy matching before any other rule attributes are checked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source and destination zones are misconfigured
When a firewall logs 'No rule matched' despite a security policy rule existing, the most common cause is a zone mismatch. In Palo Alto Networks firewalls, security rules are evaluated based on source and destination zones; if the rule specifies different zones than the traffic's ingress and egress zones, the rule will not apply, resulting in a deny. Misconfigured zones prevent the rule from being considered, even if all other attributes (IP, port, application) match.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The source and destination zones are misconfigured
Why this is correct
If the rule's source or destination zone does not match the traffic zones, it won't match.
- ✗
The rule is disabled
Why it's wrong here
A disabled rule would be ignored, but the log would still show 'no rule matched' if no other rule matches.
- ✗
The user's IP is in a block list
Why it's wrong here
Block lists are applied after rule matching, not before.
- ✗
The firewall is in transparent mode
Why it's wrong here
Transparent mode still uses zones and policies; it wouldn't cause 'no rule matched'.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.