How should I use these Policy Evaluation and Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Policy Evaluation and Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Policy Evaluation and Management domain.

PCNSA · topic practice

Policy Evaluation and Management practice questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA Policy Evaluation and Management practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Policy Evaluation and Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Policy Evaluation and Management

Policy Evaluation and Management questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Policy Evaluation and Management exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Policy Evaluation and Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Policy Evaluation and Management explanation →

A security administrator is troubleshooting a policy misconfiguration. The firewall is configured with a security rule that allows traffic from the 'Engineering' zone to the 'Servers' zone. However, traffic from an Engineering user to a server in the 'DMZ' zone is being denied. What is the most likely cause?

Trap 1: The rule is configured as an intrazone rule.

An intrazone rule would apply within the same zone, but the traffic is between different zones (Engineering and DMZ).

Trap 2: The rule is disabled in the rulebase.

If disabled, the rule would not appear in the rulebase or would be greyed out; there is no such indication.

Trap 3: SSL decryption is blocking the traffic.

There is no indication of decryption; the issue is policy mismatch.

Study all Policy Evaluation and Management common traps →

A
The rule only allows traffic from Engineering to Servers zone, not DMZ.
The rule explicitly allows Engineering to Servers; traffic to DMZ is not covered and is denied by default.
B
The rule is configured as an intrazone rule.
Why wrong: An intrazone rule would apply within the same zone, but the traffic is between different zones (Engineering and DMZ).
C
The rule is disabled in the rulebase.
Why wrong: If disabled, the rule would not appear in the rulebase or would be greyed out; there is no such indication.
D
SSL decryption is blocking the traffic.
Why wrong: There is no indication of decryption; the issue is policy mismatch.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Policy Evaluation and Management explanation →

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

Trap 1: Create a single rule with 'allow' action and no security profiles,…

Without a security profile, no threat inspection occurs at all.

Trap 2: Create a single rule with 'allow' action and a 'threat' profile…

The firewall cannot automatically skip inspection for specific application types within a single rule; it would inspect all traffic matched by the rule.

Trap 3: Use policy-based forwarding to route video traffic to a separate…

Policy-based forwarding does not bypass security profiles; profiles are applied based on security rules, not forwarding.

Study all Policy Evaluation and Management common traps →

A
Create two rules: one for general traffic with 'allow' action and a 'threat' profile, and a higher-priority rule for video conferencing traffic with 'allow' action and no threat profile.
This allows selective bypassing of threat inspection for video traffic while inspecting the rest.
B
Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.
Why wrong: Without a security profile, no threat inspection occurs at all.
C
Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.
Why wrong: The firewall cannot automatically skip inspection for specific application types within a single rule; it would inspect all traffic matched by the rule.
D
Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.
Why wrong: Policy-based forwarding does not bypass security profiles; profiles are applied based on security rules, not forwarding.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Policy Evaluation and Management explanation →

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

Trap 1: The source IP is negated in the rule.

Negate source would exclude that IP, but the rule is meant to block it; not mentioned.

Trap 2: The rule is placed at the top of the rulebase and overridden by a…

If at the top, it would match first; but it is at the bottom.

Trap 3: The rule is disabled in the rulebase.

There is no indication the rule is disabled; it is simply not reached.

Study all Policy Evaluation and Management common traps →

A
The source IP is negated in the rule.
Why wrong: Negate source would exclude that IP, but the rule is meant to block it; not mentioned.
B
The rule is placed at the top of the rulebase and overridden by a later rule.
Why wrong: If at the top, it would match first; but it is at the bottom.
C
The rule is positioned below an allow rule that matches the same traffic.
First match wins, so the allow rule matches before the block rule.
D
The rule is disabled in the rulebase.
Why wrong: There is no indication the rule is disabled; it is simply not reached.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Policy Evaluation and Management explanation →

An organization has a security policy that requires all outbound HTTP traffic from the 'Corporate' zone to the 'Internet' zone to be inspected by the URL Filtering profile. However, the administrator notices that some users can still access blocked categories. What is the most likely cause?

Trap 1: The firewall is configured to use DNS sinkholing, which bypasses…

DNS sinkholing is a separate feature and does not affect URL filtering inspection.

Trap 2: The rule is placed too low in the rulebase and a higher rule allows…

If the rule is at the top, it should match first; but the issue might be profile configuration.

Trap 3: The rule uses a source zone of 'Corporate' but the users are in a…

The stem states the rule matches Corporate zone; users are in that zone.

Study all Policy Evaluation and Management common traps →

A
The firewall is configured to use DNS sinkholing, which bypasses URL filtering.
Why wrong: DNS sinkholing is a separate feature and does not affect URL filtering inspection.
B
The rule is placed too low in the rulebase and a higher rule allows traffic without URL filtering.
Why wrong: If the rule is at the top, it should match first; but the issue might be profile configuration.
C
The rule uses a source zone of 'Corporate' but the users are in a different zone.
Why wrong: The stem states the rule matches Corporate zone; users are in that zone.
D
The URL Filtering profile is set to 'alert' instead of 'block' for the relevant categories.
An alert action logs but allows traffic; it does not block.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Policy Evaluation and Management explanation →

A firewall administrator is tasked with implementing a policy that allows SSH access from the 'Admin' zone to the 'Core' zone only for specific administrators, and all other SSH attempts should be logged and dropped. The company has a large number of administrators. Which method is most efficient and scalable?

Trap 1: Create a single rule with source zone 'Admin', destination zone…

This would allow all SSH from Admin to Core, not just specific admins.

Trap 2: Create a rule with source zone 'Admin', destination zone 'Core',…

This allows all SSH from Admin to Core, not just specific admins.

Trap 3: Create a rule with source zone 'Admin', destination zone 'Core',…

IP-based management is not scalable for many administrators.

Study all Policy Evaluation and Management common traps →

A
Create a single rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user 'any', action 'allow' and enable logging.
Why wrong: This would allow all SSH from Admin to Core, not just specific admins.
B
Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source user set to an LDAP group containing the administrators, action 'allow', and a second rule with same match criteria but action 'drop' and log at end.
User-ID integration allows scalable user-based policies.
C
Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', action 'allow', and rely on the firewall's default deny rule for others.
Why wrong: This allows all SSH from Admin to Core, not just specific admins.
D
Create a rule with source zone 'Admin', destination zone 'Core', application 'ssh', source address list of all administrators' IPs, action 'allow', and a catch-all drop rule.
Why wrong: IP-based management is not scalable for many administrators.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Policy Evaluation and Management explanation →

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Trap 1: Enable logging on all rules to ensure complete audit trails.

Logging every rule can generate excessive logs; it is recommended to log at the end with a default rule.

Trap 2: Sort rules alphabetically by name to simplify rulebase navigation.

Alphabetical order is not a best practice; rules should be ordered logically by function.

Trap 3: Use service objects based on TCP/UDP ports to define application…

Best practice is to use application objects, not service objects, for application identification.

Study all Policy Evaluation and Management common traps →

A
Enable logging on all rules to ensure complete audit trails.
Why wrong: Logging every rule can generate excessive logs; it is recommended to log at the end with a default rule.
B
Use zone-based policies instead of IP-based policies whenever possible.
Zone-based policies are more scalable and easier to manage.
C
Sort rules alphabetically by name to simplify rulebase navigation.
Why wrong: Alphabetical order is not a best practice; rules should be ordered logically by function.
D
Disable unused rules rather than deleting them to preserve rule order for future use.
Disabling keeps the rule in the rulebase without affecting traffic.
E
Use service objects based on TCP/UDP ports to define application traffic.
Why wrong: Best practice is to use application objects, not service objects, for application identification.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Policy Evaluation and Management explanation →

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

Trap 1: Whether logging is enabled on the rule.

Logging is for visibility, not for blocking decision.

Trap 2: Whether SSL decryption is enabled for the traffic.

Decryption is for inspection, not a direct cause of blocking.

Study all Policy Evaluation and Management common traps →

A
The position of the deny rule in the rulebase relative to allow rules.
A higher-priority allow rule might match before the deny rule.
B
Whether the deny rule is disabled.
A disabled rule does not affect traffic.
C
Whether the source/destination zones or addresses are correctly defined.
Misconfigured match criteria can cause unexpected blocking.
D
Whether logging is enabled on the rule.
Why wrong: Logging is for visibility, not for blocking decision.
E
Whether SSL decryption is enabled for the traffic.
Why wrong: Decryption is for inspection, not a direct cause of blocking.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Policy Evaluation and Management explanation →

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Exhibit

Refer to the exhibit.

admin@PA-500> show running security-policy

  name                             from             to              source        destination    application     action
  ------------------------------------------------------------------------------------------------------------------
1  allow-web                       trust            untrust         192.168.1.0/24 any            web-browsing    allow
2  block-social                    trust            untrust         192.168.1.0/24 any            social-networking deny
3  allow-all                       trust            untrust         any            any            any             allow

Trap 1: Allow the traffic because rule 1 matches and allows all web traffic.

Rule 1 only allows web-browsing, not social-networking.

Trap 2: Allow the traffic because rule 3 allows all traffic.

Rule 3 is not reached because rule 2 matches first.

Trap 3: Deny the traffic because no rule allows social-networking.

There is a specific deny rule, so the traffic is denied by that rule, not by default.

Study all Policy Evaluation and Management common traps →

A
Allow the traffic because rule 1 matches and allows all web traffic.
Why wrong: Rule 1 only allows web-browsing, not social-networking.
B
Allow the traffic because rule 3 allows all traffic.
Why wrong: Rule 3 is not reached because rule 2 matches first.
C
Deny the traffic because no rule allows social-networking.
Why wrong: There is a specific deny rule, so the traffic is denied by that rule, not by default.
D
Deny the traffic because rule 2 matches and denies social-networking.
Rule 2 explicitly denies social-networking.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full NAT/PAT explanation →

A company has a Palo Alto Networks firewall in production. They recently configured a new security policy rule to allow outbound HTTPS traffic from the internal network (10.0.0.0/8) to the internet. The rule is placed after a block rule that denies all traffic from 10.0.0.0/8 to any external destination. After committing, users report that HTTPS access is still blocked. The administrator checks the firewall logs and sees that the traffic is being denied by the block rule. The administrator verifies the rule order: the new allow rule is at position 5, and the block rule is at position 3. The administrator also checks that the source zone (Trust) and destination zone (Untrust) are correct. What is the most likely cause of the issue?

Trap 1: There is a NAT policy that is interfering with the allow rule.

NAT policies are evaluated after security policies; this would not cause the block rule to match first.

Trap 2: The allow rule has an incorrect application (e.g., ssl instead of…

While application mismatch could be an issue, the log shows the traffic is denied by the block rule, not by the allow rule.

Trap 3: The allow rule has the wrong source address (e.g., 10.0.0.0/8 is…

The source address appears correct; the issue is rule order.

Study all Policy Evaluation and Management common traps →

A
There is a NAT policy that is interfering with the allow rule.
Why wrong: NAT policies are evaluated after security policies; this would not cause the block rule to match first.
B
The allow rule has an incorrect application (e.g., ssl instead of web-browsing).
Why wrong: While application mismatch could be an issue, the log shows the traffic is denied by the block rule, not by the allow rule.
C
The allow rule has the wrong source address (e.g., 10.0.0.0/8 is correct).
Why wrong: The source address appears correct; the issue is rule order.
D
The allow rule is placed below the block rule, so the block rule is evaluated first.
Firewall rules are processed top-down; the block rule at position 3 matches before the allow rule at position 5.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full NAT/PAT explanation →

A security administrator notices that traffic from an internal user to a specific external web application is being blocked unexpectedly. The user's IP is 10.10.1.50 and the destination is 203.0.113.5 on port 443. The administrator has already verified that there is a security rule allowing the traffic. Which two logs should the administrator check first to diagnose the issue?

Trap 1: Check the System log for configuration changes that might have…

The System log shows admin actions and system events, but not real-time traffic denials; it would not show why a specific session was blocked.

Trap 2: Check the HIP Match log to see if the user's device lacks required…

HIP Match logs are for GlobalProtect endpoint compliance; they are not typically triggered for general web browsing traffic.

Study all Policy Evaluation and Management common traps →

A
Check the Traffic log and the URL Filtering log.
The Traffic log shows whether a rule allowed or denied the traffic; the URL Filtering log shows if a URL filtering profile blocked the request. These two together can identify the blocking cause.
B
Check the Threat log for any intrusion prevention signatures that matched the traffic.
The Threat log records malware, vulnerabilities, and spyware; if the traffic is blocked by a security rule or URL filtering, it would not appear here as a threat.
C
Check the System log for configuration changes that might have added a rule.
Why wrong: The System log shows admin actions and system events, but not real-time traffic denials; it would not show why a specific session was blocked.
D
Check the HIP Match log to see if the user's device lacks required security software.
Why wrong: HIP Match logs are for GlobalProtect endpoint compliance; they are not typically triggered for general web browsing traffic.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full NAT/PAT explanation →

A firewall administrator is troubleshooting a situation where traffic from the 'Engineering' zone (source zone) to the 'Servers' zone (destination zone) is being allowed, but the desired behavior is to block it. The administrator runs 'show running security-policy' and sees the following rules in order: Rule1: from Engineering to Servers allow; Rule2: from Engineering to Servers deny; Rule3: from any to Servers allow. Which TWO statements are true regarding policy evaluation?

Trap 1: To block the traffic, you can set the source zone in Rule2 to…

There is no 'Negate' option for zones; you must reorder rules or use different criteria.

Trap 2: Moving Rule2 to the end of the rulebase will ensure it blocks the…

Moving Rule2 after Rule3 would still not match if Rule1 allows first; the order among the first two is critical.

Trap 3: The firewall evaluates all rules and applies the most restrictive…

Palo Alto firewalls use first-match, not most restrictive; they stop at the first matching rule.

Study all Policy Evaluation and Management common traps →

A
The traffic will be allowed because Rule1 matches before Rule2.
First-match logic: Rule1 matches first, so the action is allow; Rule2 is not evaluated.
B
To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.
Why wrong: There is no 'Negate' option for zones; you must reorder rules or use different criteria.
C
Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.
Why wrong: Moving Rule2 after Rule3 would still not match if Rule1 allows first; the order among the first two is critical.
D
The administrator should move Rule2 above Rule1 to block the traffic.
Placing the deny rule before the allow rule ensures the deny matches first.
E
The firewall evaluates all rules and applies the most restrictive action (deny).
Why wrong: Palo Alto firewalls use first-match, not most restrictive; they stop at the first matching rule.

Full breakdown with real-world context →

Question 12easymultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?

Exhibit

Refer to the exhibit.

admin@PA-5020> show running security-policy
Set application-default

rule  id  name                        from         to           source        destination  application  service   action
---  ---  --------------------------- ----------- ------------ ------------- ------------ ------------ ---------- -------
    1    Allow-Sales-to-App           Sales        App-Servers  10.10.1.0/24  10.20.1.100  any           tcp/80    allow
    2    Allow-Any-Web                any          any           any           any          web-browsing  tcp/80    allow
    3    Block-Restricted-Apps        any          any           any           any          bittorrent    any       deny
    4    Allow-DNS                    any          any           any           any          dns           udp/53    allow

Trap 1: Rule 4 (Allow-DNS)

Rule 4 matches DNS traffic on udp/53, not HTTP on tcp/80.

Trap 2: Rule 3 (Block-Restricted-Apps)

Rule 3 denies bittorrent, which is not the application used.

Trap 3: Rule 1 (Allow-Sales-to-App)

Rule 1's destination is 10.20.1.100, not the external IP 203.0.113.50, so it does not match.

Study all Policy Evaluation and Management common traps →

A
Rule 4 (Allow-DNS)
Why wrong: Rule 4 matches DNS traffic on udp/53, not HTTP on tcp/80.
B
Rule 3 (Block-Restricted-Apps)
Why wrong: Rule 3 denies bittorrent, which is not the application used.
C
Rule 2 (Allow-Any-Web)
Rule 2 matches any source and destination, with application web-browsing and service tcp/80, so it matches this HTTP traffic.
D
Rule 1 (Allow-Sales-to-App)
Why wrong: Rule 1's destination is 10.20.1.100, not the external IP 203.0.113.50, so it does not match.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full Policy Evaluation and Management explanation →

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummatching

Read the full Policy Evaluation and Management explanation →

Match each security rule type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Blocks known attack patterns

Controls access to websites

Prevents transfer of specific file types

Prevents sensitive data exfiltration

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

Trap 1: The destination NAT is causing asymmetric routing.

NAT issues do not cause policy denials.

Trap 2: The rule is too far down in the rulebase and a previous implicit…

Implicit deny is only at the end, so a rule above would need to match.

Trap 3: The application override is misconfigured.

Application override does not cause denials.

Study all Policy Evaluation and Management common traps →

A
The destination NAT is causing asymmetric routing.
Why wrong: NAT issues do not cause policy denials.
B
The rule is too far down in the rulebase and a previous implicit deny is blocking.
Why wrong: Implicit deny is only at the end, so a rule above would need to match.
C
A previous rule with a broader match is denying the traffic before reaching the permit rule.
A rule with deny and broader match earlier in rulebase will block traffic.
D
The application override is misconfigured.
Why wrong: Application override does not cause denials.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Policy Evaluation and Management explanation →

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

Trap 1: The new rule has an incorrect source zone.

Incorrect zone would affect all traffic from that zone.

Trap 2: There is a mismatch between the virtual wire vs layer3 interface.

Interface type does not cause selective session impact.

Trap 3: The committed configuration is still in candidate state.

After commit, configuration moves to running state.

Study all Policy Evaluation and Management common traps →

A
The new rule has an incorrect source zone.
Why wrong: Incorrect zone would affect all traffic from that zone.
B
There is a mismatch between the virtual wire vs layer3 interface.
Why wrong: Interface type does not cause selective session impact.
C
The committed configuration is still in candidate state.
Why wrong: After commit, configuration moves to running state.
D
The commit was successful but the changes are applied only to new sessions, not existing sessions.
Policy changes only affect new sessions; existing sessions continue with the old policy until they timeout.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Policy Evaluation and Management explanation →

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

Trap 1: Decryption policy.

Decryption policy is for decrypting traffic, not blocking applications.

Trap 2: Security policy with service only.

Service only matches port/protocol, not application.

Trap 3: Policy-based forwarding.

PBF is for traffic path selection, not application control.

Study all Policy Evaluation and Management common traps →

A
Security policy with application-ID.
Application-ID enables control over specific applications regardless of port.
B
Decryption policy.
Why wrong: Decryption policy is for decrypting traffic, not blocking applications.
C
Security policy with service only.
Why wrong: Service only matches port/protocol, not application.
D
Policy-based forwarding.
Why wrong: PBF is for traffic path selection, not application control.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full NAT/PAT explanation →

An administrator is troubleshooting why a rule is not being hit. The rule has source zone Trust, destination zone Untrust, source address 10.0.0.0/8, destination address any, application web-browsing, action allow, and log at session end. The traffic is coming from 10.1.1.1 to 1.2.3.4 on port 80, zone Trust to Untrust. The rule count shows zero hits. What could be the issue?

Trap 1: The application must be set to 'any'.

Setting application 'any' would be less specific, not required.

Trap 2: The log setting is preventing hits.

Logging does not affect rule matching.

Trap 3: The destination address is too broad.

Broad destination does not prevent hits.

Study all Policy Evaluation and Management common traps →

A
The application must be set to 'any'.
Why wrong: Setting application 'any' would be less specific, not required.
B
The application is incorrectly identified; perhaps the traffic is using a different app.
If the firewall classifies the traffic as another application, the rule won't match.
C
The log setting is preventing hits.
Why wrong: Logging does not affect rule matching.
D
The destination address is too broad.
Why wrong: Broad destination does not prevent hits.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Policy Evaluation and Management explanation →

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Trap 1: The rule must have at least one security profile attached.

No such requirement.

Trap 2: The rule must have logging disabled.

Policy Optimizer does not require logging disabled.

Trap 3: The rule must be in the top 10 rules by hit count.

No such requirement.

Study all Policy Evaluation and Management common traps →

A
The rule must have at least one security profile attached.
Why wrong: No such requirement.
B
The firewall must have a valid support license.
Policy Optimizer is a licensed feature.
C
The rule must have logging disabled.
Why wrong: Policy Optimizer does not require logging disabled.
D
The rule must be in the top 10 rules by hit count.
Why wrong: No such requirement.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full NAT/PAT explanation →

A security rule is configured with source zone 'Trust', destination zone 'Untrust', source address 'any', destination address '10.10.10.0/24', application 'ssl', service 'https', action 'allow', log at session end. A user from Trust zone tries to access https://10.10.10.5. The traffic is not matching. What is the most likely reason?

Trap 1: The action should be 'allow with security profile'.

Action 'allow' is sufficient for matching; profiles are optional.

Trap 2: The service https requires TCP 443, but ssl application is used for…

Service match is based on port/protocol, not application.

Trap 3: The destination address is a specific subnet but the user is…

Host within subnet should match the address range.

Study all Policy Evaluation and Management common traps →

A
The application ssl is not matching because HTTPS traffic may be classified as web-browsing.
HTTPS is web-browsing, not ssl.
B
The action should be 'allow with security profile'.
Why wrong: Action 'allow' is sufficient for matching; profiles are optional.
C
The service https requires TCP 443, but ssl application is used for encryption.
Why wrong: Service match is based on port/protocol, not application.
D
The destination address is a specific subnet but the user is accessing a host within that subnet.
Why wrong: Host within subnet should match the address range.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Policy Evaluation and Management sessions

Start a Policy Evaluation and Management only practice session

Every question in these sessions is drawn from the Policy Evaluation and Management domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Policy Evaluation and Management questions →Mixed PCNSA session

Frequently asked questions

What does the PCNSA exam test about Policy Evaluation and Management?: Policy Evaluation and Management questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Policy Evaluation and Management questions in a focused session?: Yes — the session launcher on this page draws every question from the Policy Evaluation and Management domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSA topics?: Use the topic links above to move to related areas, or go back to the PCNSA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSA exam covers. They are not copied from any real exam or dump site.

Policy Evaluation and Management only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSA questions Policy Evaluation and Management domain overview PCNSA exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Policy Evaluation and Management practice questions

What to know about Policy Evaluation and Management

Common Policy Evaluation and Management exam traps

Policy Evaluation and Management questions

A network engineer needs to ensure that all traffic from the 'Guest' zone to the 'Internet' zone is inspected for malware, but also wants to allow high-bandwidth video conferencing traffic to bypass threat inspection for performance reasons. Which approach best achieves this?

A firewall administrator notices that a security rule intended to block traffic from a specific IP address is not working. The rule is placed at the bottom of the security rulebase, and the traffic is being allowed by a rule higher in the list. What is the most likely cause?

An organization has a security policy that requires all outbound HTTP traffic from the 'Corporate' zone to the 'Internet' zone to be inspected by the URL Filtering profile. However, the administrator notices that some users can still access blocked categories. What is the most likely cause?

Which TWO statements correctly describe best practices for managing security policies in Palo Alto Networks firewalls? (Choose two.)

Which THREE factors should be considered when troubleshooting a 'deny' rule that is unexpectedly blocking traffic? (Choose three.)

A user at 192.168.1.10 attempts to access a social networking site (application: social-networking). Based on the exhibit, what will the firewall do?

Exhibit

Refer to the exhibit. A user on the Sales subnet (10.10.1.50) attempts to browse to an external website using HTTP (port 80) to download a legitimate file. The website's IP is 203.0.113.50. Which rule will match this traffic?

Exhibit

Drag and drop the steps to configure Active/Passive High Availability on a Palo Alto Networks firewall into the correct order.

Match each security rule type to its purpose.

A network administrator notices that traffic from a specific subnet is being denied even though there is a permit rule that matches the source and destination. The rulebase has over 500 rules. What is the most likely cause?

After a policy change, a security administrator commits the candidate configuration, but the changes do not take effect immediately for all users. Some users report connectivity issues while others do not. What should the administrator check first?

A company wants to block file-sharing applications like BitTorrent, but allow HTTP and HTTPS. Which type of policy is most appropriate to achieve this granular control?

An administrator wants to use Policy Optimizer to consolidate rules. Which of the following is a prerequisite for using Policy Optimizer on a rule?

Track your progress over time

Start a Policy Evaluation and Management only practice session

Related PCNSA topic practice pages

Managing Objects practice questions