PCNSE Deploy and Configure Firewalls Practice Question
In a Panorama-managed deployment, the device group has a rule called 'Allow-Web' that allows 'web-browsing'. The local firewall also has a rule with the same name and content. After Panorama pushes the device group configuration, what happens to the local rule?
⚠ Common exam trap
A common mix-up: candidates assume Panorama overwrites or merges local rules with device group rules, but in reality, Panorama preserves local rules and simply does not install them when a name conflict exists, testing the understanding of Panorama's non-destructive configuration management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both rules are present; the device group rule takes precedence and the local rule is not installed.
In a Panorama-managed deployment, when a device group rule and a local firewall rule share the same name, Panorama does not overwrite or delete the local rule. Instead, the device group rule is installed and takes precedence, while the local rule remains on the firewall but is not active in the rulebase. This is because Panorama manages the device group configuration as a separate administrative domain, and local rules are preserved to allow for local override scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Both rules are present; the device group rule takes precedence and the local rule is not installed.
Why this is correct
Device group rules have higher priority and replace local rules at the same position.
- ✗
The local rule is overwritten by the device group rule.
Why it's wrong here
It is not overwritten; the device group rule supersedes it.
- ✗
The local rule is deleted.
Why it's wrong here
The local rule remains in the configuration but is not active.
- ✗
The rules are merged into a single rule.
Why it's wrong here
There is no merge; only the device group rule is active.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.