PCNSE Deploy and Configure Firewalls Practice Question
Exhibit
admin@PA-5050> show running security-policy
rulebase security rules {
"Permit-Web" {
from "trust"
to "untrust"
source "10.0.0.0/8"
destination "any"
application "web-browsing"
action "allow"
}
}Refer to the exhibit. A user in the 10.0.0.0/8 network is unable to access a web server at 172.16.1.10 which is in the DMZ zone. The firewall's security policy is shown: source zone trust, destination zone untrust, application web-browsing, action allow. What is the most likely reason for the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy specifies the 'untrust' zone instead of the 'dmz' zone.
The policy's destination zone is 'untrust', but the server is in the 'dmz' zone, so the traffic does not match this policy. Option A is incorrect because the source IP range 10.0.0.0/8 includes the user's IP, so it is not misconfigured. Option C is incorrect because the policy has an 'allow' action, so it is not missing a permit. Option D is incorrect because 'web-browsing' is the correct application for HTTP traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source IP range 10.0.0.0/8 is misconfigured.
Why it's wrong here
The source IP range 10.0.0.0/8 includes the user's IP, so this is not misconfigured. The failure is due to the destination zone mismatch.
- ✓
The policy specifies the 'untrust' zone instead of the 'dmz' zone.
Why this is correct
The policy's destination zone is 'untrust', but the web server is in the 'dmz' zone, so the traffic does not match this policy, causing the failure.
- ✗
The policy is missing a 'permit' action.
Why it's wrong here
The policy action is 'allow', so the policy is not missing a permit action.
- ✗
The application 'web-browsing' is not the correct application for the traffic.
Why it's wrong here
Web-browsing is the correct application for HTTP traffic, so this is not the cause of the failure.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.