PCNSE Troubleshoot Practice Question
Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?
⚠ Common exam trap
Watch out — candidates often assume the issue is with the server or network connectivity (Option E) or jump to packet capture (Option A) instead of focusing on the security policy itself, which is the direct cause indicated by the log's 'dropped by security rule' message.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the rule order to see if a rule earlier in the policy is also matching
When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the packet capture tool to capture the traffic
Why it's wrong here
Packet capture is for deeper analysis, not the first step.
- ✓
Check the rule order to see if a rule earlier in the policy is also matching
Why this is correct
Multiple rules may match; an earlier rule might deny the traffic.
- ✗
Enable logging at session end for all rules
Why it's wrong here
Logging is already enabled; the drop is logged.
- ✓
Review the security rule that matched the session to ensure it is configured correctly
Why this is correct
The rule might have incorrect source, destination, or service.
- ✗
Check the server's network connectivity
Why it's wrong here
The issue is at the firewall, not the server.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.