PCNSE Core Concepts and Architecture Practice Question

Exhibit

admin@firewall> show running rulebase security
entry @name "Allow-Internal" {
    from "trust";
    to "untrust";
    source 10.0.0.0/24;
    destination any;
    application "web-browsing";
    service application-default;
    action allow;
    log-start yes;
}

Refer to the exhibit. A packet from 10.0.0.5 to 8.8.8.8 on TCP port 443 (HTTPS) arrives. Source zone is trust, destination zone is untrust. The packet is dropped. What is the most likely reason?

⚠ Common exam trap

Many exam-takers assume a port-based rule (TCP 443) will allow HTTPS traffic, but Palo Alto Networks firewalls require the application to match the rule's application object, not just the port, so a rule allowing 'web-browsing' will drop HTTPS traffic identified as 'ssl'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.

The security rule requires the application 'web-browsing' (HTTP), but the traffic is HTTPS (TCP 443), which is identified as 'ssl' by the Palo Alto Networks firewall. The firewall performs App-ID inspection, and if the application does not match the rule's application condition, the packet is dropped, even if the port matches.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The service 'application-default' does not allow TCP port 443.
Why it's wrong here
For 'web-browsing', the default service is HTTP/80, but for 'ssl' it would be 443; however, the rule expects 'web-browsing', so port 443 does not match the expected service.
✗
The packet is not logged properly.
Why it's wrong here
Logging setting does not cause drops.
✗
The destination IP is not routable in the virtual router.
Why it's wrong here
A no-route drop would show a different reason in logs.
✓
The rule requires application 'web-browsing', but the traffic is identified as 'ssl', causing a mismatch and drop.
Why this is correct
The firewall matches the application after identification; if it does not match the rule, the packet is dropped.

Go deeper

PCNSE Core Concepts and Architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question