PCNSE Core Concepts and Architecture Practice Question
Exhibit
admin@PA-3020# show running security-policy set security-policy rule 1 from zone internal to zone external source 10.0.0.0/8 destination 0.0.0.0/0 application web-browsing service service-http action deny set security-policy rule 2 from zone internal to zone external source 10.1.0.0/16 destination 0.0.0.0/0 application web-browsing service service-http action allow
Refer to the exhibit. A user with IP 10.1.1.100 from the internal zone is trying to access http://203.0.113.1. What will the firewall do?
⚠ Common exam trap
Many candidates assume the firewall will continue to evaluate subsequent rules (like rule 2) after a match, but the first-match logic means rule 1's deny action is applied immediately, preventing any further rule evaluation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny the traffic because rule 1 matches first.
The firewall processes security rules in top-down order. Rule 1 explicitly denies traffic from the internal zone to the destination zone 'untrust-L3' for destination IP 203.0.113.1, which matches the user's traffic. Since rule 1 is matched first, the firewall denies the traffic and does not evaluate subsequent rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Drop the traffic because no rule matches.
Why it's wrong here
The source 10.1.1.100 falls within 10.0.0.0/8 in rule 1, so a rule matches.
- ✗
Allow the traffic because rule 2 matches.
Why it's wrong here
Rule 2 matches the source subnet, but rule 1 matches first because it is listed first and has a broader source that includes 10.1.1.100.
- ✗
Reset the traffic because of rule 1.
Why it's wrong here
The action is deny, not reset.
- ✓
Deny the traffic because rule 1 matches first.
Why this is correct
Rule 1 has source 10.0.0.0/8 which includes 10.1.1.100, so it matches first and denies the traffic.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.