PCNSE Deploy and Configure Firewalls Practice Question
Exhibit
admin@PA-500> show running security-policy 1. rule1 (src: trust; dst: untrust; app: web-browsing; action: allow) 2. rule2 (src: trust; dst: untrust; user: anyone; app: ssl; action: allow) 3. rule3 (src: trust; dst: untrust; user: user1; app: any; action: deny) 4. rule4 (src: trust; dst: untrust; user: anyone; app: any; action: deny)
Refer to the exhibit. A user in the trust zone attempts to access HTTPS to an external server. Which rule will match?
⚠ Common exam trap
Palo Alto Networks often tests the first-match rule evaluation order, where candidates mistakenly think a deny rule later in the policy (rule4) will block traffic, forgetting that a preceding permit rule (rule2) already matched and allowed the session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
rule2
Rule2 is correct because it is the first rule in the security policy that matches the traffic from the trust zone (source zone trust) to the external server (destination zone untrust) for HTTPS (destination port 443). Palo Alto Networks firewalls evaluate rules in top-down order, and rule2 explicitly permits HTTPS traffic from trust to untrust, while rule1 only permits HTTP (port 80). Rule3 and rule4 do not match because they are either for different zones or deny the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
rule4
Why it's wrong here
Rule4 is a deny-all, but rule2 matches first.
- ✗
rule3
Why it's wrong here
Rule3 only applies if the user is specifically 'user1'.
- ✗
rule1
Why it's wrong here
Rule1 only allows web-browsing (HTTP), not SSL.
- ✓
rule2
Why this is correct
Rule2 allows SSL for anyone, so it matches the HTTPS traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.