Courseiva
← PCNSE
Full test
Troubleshoot →hardMultiple ChoiceObjective-mapped

PCNSE Troubleshoot Practice Question

Exhibit

config shared
security-rulebase
 security-rules
  rule "Allow-SSL"
   from [ "Trust-L3" ]
   to [ "Untrust-L3" ]
   source [ "10.0.0.0/8" ]
   destination [ "any" ]
   application [ "ssl" ]
   service [ "application-default" ]
   action allow
   log-start no
   log-end yes
   log-setting "Profile1"
 end-rule
  rule "Block-HTTP"
   from [ "Trust-L3" ]
   to [ "Untrust-L3" ]
   source [ "10.0.0.0/8" ]
   destination [ "any" ]
   application [ "web-browsing" ]
   service [ "application-default" ]
   action deny
   log-start no
   log-end yes
 end-rule
end
config shared
 application-group "Web-Apps"
  members [ "ssl" "web-browsing" ]
 end-application-group
end

Refer to the exhibit. A user at 10.1.1.10 attempts to access https://www.example.com (port 443). The firewall correctly identifies the application as 'ssl' and matches the rule 'Allow-SSL'. However, the session is still being denied. What is the most likely reason?

⚠ Common exam trap

Many exam-takers assume a more specific allow rule will automatically override a broader deny rule, but PAN-OS uses first-match logic, so rule order determines the outcome, not specificity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.

The firewall evaluates security rules in top-down order, and if a rule using the application-group 'Web-Apps' with a deny action appears before the 'Allow-SSL' rule, traffic matching that group (which includes SSL) will be denied before reaching the allow rule. The session is denied despite matching 'Allow-SSL' because the earlier deny rule takes precedence.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The service 'application-default' does not match port 443; a custom service must be used.

    Why it's wrong here

    Application-default automatically uses the default port for the application, which for SSL is 443.

  • ✓

    The application-group 'Web-Apps' is being used in a policy rule that is evaluated before 'Allow-SSL' and has a deny action.

    Why this is correct

    Although not shown here, if an application-group containing 'ssl' is in a deny rule higher in the order, it would deny the traffic.

  • ✗

    The rule 'Allow-SSL' has logging disabled at session start, so it appears as though the traffic is denied because no log is generated.

    Why it's wrong here

    Logging settings do not affect the action; the session would still be allowed.

  • ✗

    SSL decryption is required for the firewall to correctly identify the application; without it, the application may be misidentified as web-browsing.

    Why it's wrong here

    SSL identification does not require decryption; the firewall can identify SSL by the handshake even without decryption.

About these practice questions

Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.