Quick Answer
The answer is Rule1 because the Palo Alto Networks firewall processes security rules in sequential order from top to bottom, and the first matching rule is applied regardless of how specific subsequent rules may be. This "rule ordering first match applies" principle means that even though Rule2 is more precisely tailored to HTTP traffic from trust to untrust, Rule1’s broad "allow any to any" with logging at session start matches the internal user’s web request first, so the firewall executes Rule1 and logs the session as allowed. On the PCNSA exam, this concept tests your understanding of policy evaluation order and is a common trap where candidates assume the most specific rule wins, when in reality the firewall stops at the first match. A reliable memory tip is "first match wins, not best match"—always place your most restrictive rules above broad allow rules to avoid unintended access.
This PCNSA practice question tests your understanding of policy evaluation and management. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator configures a security policy with three rules in order: Rule1 allows any to any with log at session start, Rule2 allows HTTP from trust to untrust, Rule3 denies any. Traffic from an internal user to an external web server is logged as allowed. Which rule processed the traffic?
Rule1
Rule1 matches all traffic and is the first rule, so it processes the traffic.
Rule3
Why wrong: Rule3 is a deny rule, but traffic was allowed, so it did not match.
Rule2
Why wrong: Rule2 is more specific but comes after Rule1, so it is not evaluated because Rule1 matched.
No rule matched
Why wrong: Traffic was logged as allowed, so a rule matched.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Rule1
Option A is correct because the first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.
Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Rule1
Why this is correct
Rule1 matches all traffic and is the first rule, so it processes the traffic.
Related concept
Standard ACLs match source addresses.
Rule3
Why it's wrong here
Rule3 is a deny rule, but traffic was allowed, so it did not match.
Rule2
Why it's wrong here
Rule2 is more specific but comes after Rule1, so it is not evaluated because Rule1 matched.
No rule matched
Why it's wrong here
Traffic was logged as allowed, so a rule matched.
Common exam traps
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Detailed technical explanation
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
Key takeaway
ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Real-world example
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related PCNSA ACL questions on filtering logic and placement.
Policy Evaluation and Management — study guide chapter
Learn the concepts, then practise the questions
Policy Evaluation and Management practice questions
Targeted practice on this topic area only
All PCNSA questions
524 questions across all exam domains
Palo Alto Networks Certified Network Security Administrator PCNSA study guide
Full concept coverage aligned to exam objectives
PCNSA practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCNSA questions linked to Managing Objects.
Practise PCNSA questions linked to Policy Evaluation and Management.
Practise PCNSA questions linked to Securing Traffic.
Practise PCNSA questions linked to Core Concepts.
Practise PCNSA questions linked to Palo Alto Networks Platforms and Architecture.
Practise PCNSA questions linked to Device Management and Services.
Practise PCNSA questions linked to App-ID and Content-ID.
Practise PCNSA questions linked to Decryption and Monitoring.
Practise PCNSA questions linked to PCNSA fundamentals.
Practise PCNSA questions linked to PCNSA scenario.
Practise PCNSA questions linked to PCNSA troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Policy Evaluation and Management — This question tests Policy Evaluation and Management — Standard ACLs match source addresses..
The correct answer is: Rule1 — Option A is correct because the first matching rule is applied; even though Rule2 is more specific, Rule1 matches first and allows the traffic. Option B is wrong because Rule2 is after Rule1. Option C is wrong because Rule3 would deny, but traffic was allowed. Option D is wrong because the traffic matched a rule.
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related PCNSA ACL questions on filtering logic and placement.
Standard ACLs match source addresses.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The administrator sees that traffic from 10.10.1.12 is being denied by rule2. Which action should the administrator take to allow this traffic while maintaining security?
hardWhy C: Option D is correct because creating a new rule above rule2 that specifically allows traffic from 10.10.1.12 (or the appropriate subnet) with proper security profiles will permit the traffic without affecting other rules. Option A would allow all traffic matched by rule2, which might be too broad. Option B would cause rule2 to be evaluated before rule1, potentially denying traffic that should be allowed. Option C would modify rule1's source, possibly allowing unintended traffic.
Variation 2. A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?
easyWhy C: Option C is correct because the Palo Alto Networks firewall evaluates security rules in top-down order, from the first rule in the rulebase to the last. If a rule that allows traffic is placed higher in the list, it will match and permit the traffic before the lower-placed block rule is ever evaluated. The block rule at the bottom is effectively never reached for that traffic, which is why the intended blocking action fails.
Variation 3. An administrator has configured multiple security rules for a data center. There is a rule that allows SSH from the 'Management' zone to the 'Server' zone. Recently, the administrator added a new rule allowing SSH from a new 'Admin' zone to the 'Server' zone. The Admin rule is placed above the Management rule. Both rules specify the correct zones, application SSH, and action allow. After committing, SSH traffic from the Admin zone is being denied. What is the most likely issue?
mediumWhy A: If the Admin rule is above the Management rule and both allow SSH, traffic should be allowed. The only plausible reason for denial is that a deny rule exists above the Admin rule that matches the Admin zone traffic. Option B correctly identifies this.
Last reviewed: Jun 24, 2026
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.