PCNSE Deploy and Configure Firewalls Practice Question
Exhibit
Refer to the exhibit. admin@PA-500> show interface ethernet1/2.10 Interface ethernet1/2.10 VLAN: 20 Virtual router: default IP netmask: 192.168.10.1/24 Zone: VLAN10 State: up
The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?
⚠ Common exam trap
A common mix-up: candidates confuse the VLAN ID on the sub-interface with the IP subnet or zone name, assuming a mismatch in IP addressing or zone naming is the root cause, when in fact the VLAN tag mismatch is the direct and immediate reason traffic is not processed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VLAN ID is misconfigured as 20 instead of 10.
The exhibit shows the sub-interface is configured with VLAN ID 20, but the administrator intended VLAN 10. In Palo Alto Networks firewalls, sub-interfaces use 802.1Q VLAN tagging, and the VLAN ID must match the tag on incoming frames. Mismatched VLAN IDs cause the firewall to drop or ignore traffic because the sub-interface only processes frames with the configured tag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VLAN ID is misconfigured as 20 instead of 10.
Why this is correct
The sub-interface expects VLAN tag 20, but traffic from VLAN 10 uses tag 10.
- ✗
The IP netmask is /24 but should be /16.
Why it's wrong here
The /24 netmask is appropriate for the intended 192.168.10.0/24 subnet.
- ✗
The zone is incorrectly named 'VLAN10'.
Why it's wrong here
The zone name is for administrative purposes and does not affect routing.
- ✗
The virtual router is not correctly set.
Why it's wrong here
The virtual router is set to 'default' and no routing issue is indicated.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.