PCNSE Deploy and Configure Firewalls Practice Question
Exhibit
Refer to the exhibit. admin@PA-5250> show routing route IPv4 Route Table for virtual-router default destination nexthop metric flags interface age 0.0.0.0/0 10.1.1.1 10 A S ethernet1/1 5m 10.1.1.0/24 10.1.1.100 0 A C ethernet1/1 5m 10.2.2.0/24 10.1.1.200 1 A S ethernet1/1 5m 10.3.3.0/24 10.1.1.200 1 A S ethernet1/1 5m
Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?
⚠ Common exam trap
Many exam-takers assume a missing route is the problem, but the question tests whether you recognize that a route can exist yet still fail if the next hop is unreachable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.
The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.
Why this is correct
If next hop is down, traffic cannot be forwarded.
- ✗
The destination network 10.3.3.0/24 is not in the routing table.
Why it's wrong here
10.3.3.0/24 is present.
- ✗
The source network 10.2.2.0/24 is not in the routing table.
Why it's wrong here
10.2.2.0/24 is present with next hop 10.1.1.200.
- ✗
The default route 0.0.0.0/0 is missing.
Why it's wrong here
Default route exists.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.