Courseiva
TroubleshootmediumMultiple SelectObjective-mapped

PCNSE Troubleshoot Practice Question

Which TWO CLI commands can be used to check whether a specific security policy rule is being matched by traffic? (Choose two.)

⚠ Common exam trap

Candidates often confuse 'show security-policy rule <rulename>' (which only shows configuration) with a command that shows rule usage, leading them to select option D instead of the correct rule-usage or session-filter commands.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

show security-policy rule-usage

The 'show security-policy rule-usage' command displays the hit count for each security policy rule, allowing you to verify if a specific rule has been matched by traffic. Option C is correct because 'show session all filter rule <rulename>' filters active sessions by the rule name, showing only sessions that matched that specific security policy rule, which directly confirms rule usage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • show session limit

    Why it's wrong here

    This shows session limit configuration, not rule matches.

  • show security-policy rule-usage

    Why this is correct

    This command displays the number of times each rule has been matched.

  • show session all filter rule <rulename>

    Why this is correct

    This shows active sessions that matched the specified rule.

  • show security-policy rule <rulename>

    Why it's wrong here

    This displays the configuration of a specific rule, not hit count.

  • show running security-policy

    Why it's wrong here

    This shows the security policy configuration, not which rules are being matched.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.