How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

PCNSA · topic practice

Scenario practice questions

Practise Palo Alto Networks Certified Network Security Administrator PCNSA Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

13 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

13 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Open the full VLAN trunking answer →

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

Trap 1: HA1 interface

HA interfaces are for high-availability synchronization, not general management.

Trap 2: VLAN interface

VLAN interfaces are logical layer 3 interfaces for routing, not dedicated management ports.

Trap 3: Ethernet 1/1

Ethernet interfaces are for data traffic, not dedicated management.

Study all Scenario common traps →

A
HA1 interface
Why wrong: HA interfaces are for high-availability synchronization, not general management.
B
VLAN interface
Why wrong: VLAN interfaces are logical layer 3 interfaces for routing, not dedicated management ports.
C
Ethernet 1/1
Why wrong: Ethernet interfaces are for data traffic, not dedicated management.
D
MGT (Management) interface
The MGT interface is a dedicated management port that can be assigned an IP on a separate VLAN for out-of-band management.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Scenario explanation →

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

Trap 1: The firewall is not connected to the cloud for App-ID updates.

App-ID updates are not required in real-time for recognition; they are bundled with content updates.

Trap 2: Decryption is not enabled for Google Drive traffic.

App-ID can identify Google Drive even without decryption.

Trap 3: An application override is configured for Google Drive.

Override would allow the app, not block it.

Study all Scenario common traps →

A
The firewall is not connected to the cloud for App-ID updates.
Why wrong: App-ID updates are not required in real-time for recognition; they are bundled with content updates.
B
The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.
Google Drive has multiple sub-apps; uploads are a different app-ID.
C
Decryption is not enabled for Google Drive traffic.
Why wrong: App-ID can identify Google Drive even without decryption.
D
An application override is configured for Google Drive.
Why wrong: Override would allow the app, not block it.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Scenario explanation →

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

Trap 1: The application 'webapp' is not allowed due to an application…

Override would allow it, not block.

Trap 2: SSL decryption is not enabled.

Content-ID can inspect uploads without decryption if the file is unencrypted.

Trap 3: App-ID is not identifying the application correctly.

Application is already allowed.

Study all Scenario common traps →

A
The application 'webapp' is not allowed due to an application override.
Why wrong: Override would allow it, not block.
B
SSL decryption is not enabled.
Why wrong: Content-ID can inspect uploads without decryption if the file is unencrypted.
C
A file blocking profile is blocking the upload.
File blocking is part of Content-ID and can prevent uploads.
D
App-ID is not identifying the application correctly.
Why wrong: Application is already allowed.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Scenario explanation →

What is the most likely reason the traffic is being denied?

Exhibit

Refer to the exhibit.

Application Command Center
Name: myapp
Category: business-systems
Subcategory: file-sharing
Technology: peer-to-peer
Risk: 4
Characteristics: evasive-behavior, used-by-malware, excessive-bandwidth

Security Policy Rule:
Source: any
Destination: any
Application: myapp
Action: allow
Profile: default

Logs show traffic matching this rule is being denied with action 'reset-both'.

Trap 1: The application is not actually matching the rule.

Logs show the rule is matched.

Trap 2: A DoS protection policy is blocking the traffic.

DoS protection would not typically reset.

Trap 3: App-ID is incorrectly identifying the traffic.

The exhibit shows myapp is identified.

Study all Scenario common traps →

A
The application is not actually matching the rule.
Why wrong: Logs show the rule is matched.
B
A threat prevention profile is blocking the application due to its 'evasive-behavior' characteristic.
Evasive applications are often blocked by default profiles.
C
A DoS protection policy is blocking the traffic.
Why wrong: DoS protection would not typically reset.
D
App-ID is incorrectly identifying the traffic.
Why wrong: The exhibit shows myapp is identified.

Full breakdown with real-world context →

Question 5mediummultiple choice

Review the full routing breakdown →

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Exhibit

Refer to the exhibit.

show routing route 10.0.1.0/24

vr: default
10.0.1.0/24
  via 10.0.0.2, interface ethernet1/3, metric 10, preference 10, route-type static
  via 10.0.0.3, interface ethernet1/4, metric 20, preference 10, route-type static
  via 10.0.0.4, interface ethernet1/5, metric 10, preference 30, route-type ospf

Trap 1: The route via 10.0.0.3 on ethernet1/4

Incorrect: Metric 20 is higher than metric 10.

Trap 2: The route via 10.0.0.4 on ethernet1/5

Incorrect: OSPF has higher preference (30).

Trap 3: All three routes are used in ECMP

Incorrect: Preferences differ, so ECMP does not apply.

Study all Scenario common traps →

A
The route via 10.0.0.3 on ethernet1/4
Why wrong: Incorrect: Metric 20 is higher than metric 10.
B
The route via 10.0.0.2 on ethernet1/3
Correct: Lowest preference (10) and lowest metric (10).
C
The route via 10.0.0.4 on ethernet1/5
Why wrong: Incorrect: OSPF has higher preference (30).
D
All three routes are used in ECMP
Why wrong: Incorrect: Preferences differ, so ECMP does not apply.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full NAT/PAT explanation →

A security administrator notices that traffic from an internal user to a specific external web application is being blocked unexpectedly. The user's IP is 10.10.1.50 and the destination is 203.0.113.5 on port 443. The administrator has already verified that there is a security rule allowing the traffic. Which two logs should the administrator check first to diagnose the issue?

Trap 1: Check the System log for configuration changes that might have…

The System log shows admin actions and system events, but not real-time traffic denials; it would not show why a specific session was blocked.

Trap 2: Check the HIP Match log to see if the user's device lacks required…

HIP Match logs are for GlobalProtect endpoint compliance; they are not typically triggered for general web browsing traffic.

Study all Scenario common traps →

A
Check the Traffic log and the URL Filtering log.
The Traffic log shows whether a rule allowed or denied the traffic; the URL Filtering log shows if a URL filtering profile blocked the request. These two together can identify the blocking cause.
B
Check the Threat log for any intrusion prevention signatures that matched the traffic.
The Threat log records malware, vulnerabilities, and spyware; if the traffic is blocked by a security rule or URL filtering, it would not appear here as a threat.
C
Check the System log for configuration changes that might have added a rule.
Why wrong: The System log shows admin actions and system events, but not real-time traffic denials; it would not show why a specific session was blocked.
D
Check the HIP Match log to see if the user's device lacks required security software.
Why wrong: HIP Match logs are for GlobalProtect endpoint compliance; they are not typically triggered for general web browsing traffic.

Full breakdown with real-world context →

Question 7mediummultiple choice

Review the full subnetting walkthrough →

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

Trap 1: Zone Protection profile is set to 'Log at Session Start'

Zone Protection profiles handle flood protection and other zone-based settings, not rule logging.

Trap 2: The Log Forwarding profile is not applied

Log Forwarding profiles send logs to external destinations but the rule must first have logging enabled.

Trap 3: Disable Server Response Inspection on the rule

Disabling server response inspection does not affect traffic logging.

Study all Scenario common traps →

A
Zone Protection profile is set to 'Log at Session Start'
Why wrong: Zone Protection profiles handle flood protection and other zone-based settings, not rule logging.
B
The Log Forwarding profile is not applied
Why wrong: Log Forwarding profiles send logs to external destinations but the rule must first have logging enabled.
C
The rule has 'Log at Session End' disabled
If 'Log at Session End' is not checked, traffic matching the rule will not be logged.
D
Disable Server Response Inspection on the rule
Why wrong: Disabling server response inspection does not affect traffic logging.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full NAT/PAT explanation →

A firewall administrator is troubleshooting a scenario where outbound HTTPS traffic to a specific website is being blocked. The security rule allows application 'ssl' and service 'application-default'. The URL Filtering profile blocks the category 'hacking'. The administrator confirms the destination URL falls under 'hacking' category. Which action should be taken to allow the traffic while maintaining security?

Trap 1: Change the service to TCP/443 and allow all applications

This would bypass application control but still be subject to URL filtering based on the profile.

Trap 2: Remove the URL Filtering profile from the security rule

This would disable URL filtering for all traffic matching the rule, not just the specific site.

Trap 3: Change the URL Filtering action for 'hacking' category to 'allow'

This would allow all hacking sites, which is too permissive.

Study all Scenario common traps →

A
Change the service to TCP/443 and allow all applications
Why wrong: This would bypass application control but still be subject to URL filtering based on the profile.
B
Remove the URL Filtering profile from the security rule
Why wrong: This would disable URL filtering for all traffic matching the rule, not just the specific site.
C
Add a new URL Filtering profile override rule that allows the specific URL and place it above the category block
URL Filtering profiles support override rules to allow or block specific URLs with higher priority.
D
Change the URL Filtering action for 'hacking' category to 'allow'
Why wrong: This would allow all hacking sites, which is too permissive.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Scenario explanation →

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

Trap 1: Source zone: DMZ, Destination zone: trust, Application:…

This would allow traffic from DMZ to trust, which is opposite direction.

Trap 2: Source zone: trust, Destination zone: DMZ, Service: any,…

Using service 'any' and application 'any' is overly permissive and not best practice.

Trap 3: Source zone: trust, Destination zone: trust, Application:…

Both zones should not be the same for this scenario; DMZ is the destination.

Study all Scenario common traps →

A
Source zone: DMZ, Destination zone: trust, Application: web-browsing, Action: allow
Why wrong: This would allow traffic from DMZ to trust, which is opposite direction.
B
Source zone: trust, Destination zone: DMZ, Service: any, Application: any, Action: allow
Why wrong: Using service 'any' and application 'any' is overly permissive and not best practice.
C
Source zone: trust, Destination zone: DMZ, Application: web-browsing, Action: allow
This correctly permits internal users to access the DMZ web server using web-browsing application.
D
Source zone: trust, Destination zone: trust, Application: web-browsing, Action: allow
Why wrong: Both zones should not be the same for this scenario; DMZ is the destination.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full Scenario explanation →

An administrator notices that traffic from a specific IP 10.10.10.5 is not matching the expected security rule that should allow HTTP traffic. The rule uses a source address object defined as '10.10.10.0/24'. Upon investigation, the administrator finds that the traffic is from IP 10.10.10.5, but the rule still does not match. What is the most likely cause?

Trap 1: The traffic is being decrypted by a decryption policy before…

Incorrect. Decryption occurs after policy match; it does not affect whether a rule matches.

Trap 2: The rule's source zone is set to 'DMZ' instead of 'Internal'.

Incorrect. If the zone were wrong, the rule would not match at all, but this does not explain why the address object appears correct yet fails.

Trap 3: A rule above this rule shadows it, blocking the traffic before…

Incorrect. While shadowing is possible, the symptom described is that the rule does not match at all (no hit count increase), not that it is overridden by a deny rule.

Study all Scenario common traps →

A
The traffic is being decrypted by a decryption policy before reaching the security rule.
Why wrong: Incorrect. Decryption occurs after policy match; it does not affect whether a rule matches.
B
The rule's source zone is set to 'DMZ' instead of 'Internal'.
Why wrong: Incorrect. If the zone were wrong, the rule would not match at all, but this does not explain why the address object appears correct yet fails.
C
A rule above this rule shadows it, blocking the traffic before evaluation.
Why wrong: Incorrect. While shadowing is possible, the symptom described is that the rule does not match at all (no hit count increase), not that it is overridden by a deny rule.
D
The source address object is defined with a netmask of /32 instead of /24.
Correct. A /32 netmask means the object matches only the single IP 10.10.10.0, not the entire subnet.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Scenario explanation →

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Trap 1: Decryption Mirror

Decryption Mirror is for passive decryption and does not apply to inbound traffic.

Trap 2: Outbound (Forward Proxy) Decryption

Outbound decryption is for traffic from internal clients to external servers.

Trap 3: SSH Proxy

SSH Proxy is for decrypting SSH traffic, not HTTPS.

Study all Scenario common traps →

A
Inbound Inspection Decryption
Inbound inspection is specifically designed to decrypt traffic entering the network and destined to internal servers.
B
Decryption Mirror
Why wrong: Decryption Mirror is for passive decryption and does not apply to inbound traffic.
C
Outbound (Forward Proxy) Decryption
Why wrong: Outbound decryption is for traffic from internal clients to external servers.
D
SSH Proxy
Why wrong: SSH Proxy is for decrypting SSH traffic, not HTTPS.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Scenario explanation →

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Trap 1: Issue the 'revert to last known good configuration' command.

Incorrect: There is no such command in PAN-OS.

Trap 2: Use 'show configuration saved' and copy the previous config.

Incorrect: This is a manual process and does not preserve uncommitted changes easily.

Trap 3: Reboot the firewall to load the previous running config.

Incorrect: Reboot loads the current running config (the problematic one), not a previous version.

Study all Scenario common traps →

A
Issue the 'revert to last known good configuration' command.
Why wrong: Incorrect: There is no such command in PAN-OS.
B
Use 'show configuration saved' and copy the previous config.
Why wrong: Incorrect: This is a manual process and does not preserve uncommitted changes easily.
C
Use the 'commit revert' command to revert to before the problematic commit.
Correct: This reverts the configuration to the previous state while keeping uncommitted changes in the candidate.
D
Reboot the firewall to load the previous running config.
Why wrong: Incorrect: Reboot loads the current running config (the problematic one), not a previous version.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full NAT/PAT explanation →

A company has a Palo Alto Networks firewall with multiple virtual routers. The security policy has a rule that allows SSH from the 'Internal' zone to the 'DMZ' zone. Recently, a new subnet 10.10.20.0/24 was added to the Internal zone. Users in that subnet report they cannot SSH to a server at 192.168.1.10 in the DMZ, while users from other subnets in Internal can. The rule has source address object '10.0.0.0/8' which includes the new subnet. The rule's source zone is Internal, destination zone is DMZ, and application is SSH. The administrator confirms the new subnet's IPs are within 10.0.0.0/8. What is the most likely cause of the problem?

Trap 1: The application is not correctly identified because the SSH server…

Incorrect. The problem is zone/VR-related, not application identification.

Trap 2: There is a deny rule placed above the allow rule that matches the…

Incorrect. While possible, the question states other subnets in Internal work, so a deny rule specific to the new subnet is unlikely.

Trap 3: The rule's source address object is incorrectly defined as…

Incorrect. The subnet 10.10.20.0/24 is within 10.0.0.0/8, so the object includes it.

Study all Scenario common traps →

A
The application is not correctly identified because the SSH server uses a non-standard port.
Why wrong: Incorrect. The problem is zone/VR-related, not application identification.
B
There is a deny rule placed above the allow rule that matches the new subnet but not the other subnets.
Why wrong: Incorrect. While possible, the question states other subnets in Internal work, so a deny rule specific to the new subnet is unlikely.
C
The firewall's route table has a more specific route for 10.10.20.0/24 pointing to a different virtual router, causing traffic from that subnet to enter via an interface in a different zone.
Correct. If the subnet's traffic enters via a different VR and zone, the security policy rule (which expects the Internal zone) will not match.
D
The rule's source address object is incorrectly defined as '10.0.0.0/8' but the new subnet is not actually within that range.
Why wrong: Incorrect. The subnet 10.10.20.0/24 is within 10.0.0.0/8, so the object includes it.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed PCNSA session

Frequently asked questions

What does the PCNSA exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSA topics?: Use the topic links above to move to related areas, or go back to the PCNSA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSA exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSA questions Scenario domain overview PCNSA exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

What is the most likely reason the traffic is being denied?

Exhibit

Refer to the exhibit. A firewall has learned three routes for the 10.0.1.0/24 network. Which route will be used for forwarding traffic destined to 10.0.1.1?

Exhibit

A security administrator notices that traffic from a specific subnet is not being logged in the Traffic logs, although the traffic is allowed by a security policy rule. Which configuration setting should be verified?

An administrator needs to create a rule that allows internal users to access a public web server hosted in the DMZ. The firewall is in layer 3 mode. Which rule configuration is correct for this scenario?

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Track your progress over time

Start a Scenario only practice session

Related PCNSA topic practice pages

Managing Objects practice questions

Policy Evaluation and Management practice questions

Securing Traffic practice questions

Core Concepts practice questions

Palo Alto Networks Platforms and Architecture practice questions

Device Management and Services practice questions

App-ID and Content-ID practice questions

Decryption and Monitoring practice questions

PCNSA fundamentals practice questions

PCNSA scenario practice questions

PCNSA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid