PCNSE Core Concepts and Architecture Practice Question
Which three are valid security policy rule actions on a Palo Alto Networks firewall? (Choose three.)
⚠ Common exam trap
Watch out — candidates often confuse 'Log' as an action because it appears in the rule configuration, but it is merely a log setting, not a traffic disposition action like Allow, Deny, or Drop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
(Deny) is correct because security policy rules on Palo Alto Networks firewalls use 'Deny' as a valid action to silently discard traffic without sending a TCP RST or ICMP unreachable message. This action is used when you want to block traffic while providing no feedback to the sender, which is common for stealth or compliance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
Deny drops traffic and can generate logs.
- ✗
Log
Why it's wrong here
Log is a setting within a rule, not an action.
- ✓
Drop
Why this is correct
Drop silently discards traffic without logging.
- ✓
Allow
Why this is correct
Allow is a primary action to permit traffic.
- ✗
Forward
Why it's wrong here
Forward is not a security policy action; it is a routing concept.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.