The answer is that the web-browsing application does not cover port 8080 traffic, which is why the security policy denies it. In Palo Alto Networks firewalls, each application is defined with a specific set of default ports and protocol signatures; the web-browsing application is pre-configured to match HTTP traffic only on standard ports like 80 and 443, not on port 8080. Even though the custom web application uses HTTP and is identified as web-browsing, the firewall checks both the application signature and the port—if the port doesn’t match the application’s default definition, the traffic is not considered a match for that application. On the PCNSA exam, this tests your understanding of application-based policies versus port-based policies, a common trap where students assume any HTTP traffic on any port will be allowed by the web-browsing application. Remember the memory tip: “Apps have default ports—if the port isn’t in the app, the app won’t match.”
PCNSA Managing Objects Practice Question
This PCNSA practice question tests your understanding of managing objects. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application 'web-browsing' does not cover port 8080 traffic.
The security rule explicitly allows applications 'web-browsing', 'ssl', and 'dns'. While the custom web application uses HTTP on port 8080 and is identified as 'web-browsing', the application 'web-browsing' in Palo Alto Networks firewalls is defined to use standard HTTP ports (typically 80, 8080 is not included by default). Since the application does not match the traffic on port 8080, the firewall does not consider this traffic as matching the application 'web-browsing', and it falls through to the implicit deny rule, causing the denial.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The application 'web-browsing' does not cover port 8080 traffic.
Why this is correct
App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The rule order is incorrect; a previous rule is denying the traffic.
Why it's wrong here
The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.
✗
The destination address object 10.10.0.0/16 is incorrect.
Why it's wrong here
The subnet appears correct for the data center.
✗
The source zone 'GP' should be 'untrust'.
Why it's wrong here
GlobalProtect typically uses a dedicated zone 'GP'.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume 'web-browsing' covers all HTTP traffic regardless of port, but Palo Alto Networks firewalls enforce application identification based on default port definitions, and non-standard ports require explicit configuration.
Trap categories for this question
Command / output trap
The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.
Detailed technical explanation
How to think about this question
Palo Alto Networks firewalls use App-ID to identify traffic based on application signatures, not just port numbers. The 'web-browsing' application is a container that includes HTTP and HTTPS traffic on standard ports (80, 443) and may also include other common ports, but port 8080 is not typically included unless explicitly added via custom application or service override. In a real-world scenario, administrators must either create a custom application for the non-standard port or use a service/port-based rule if App-ID cannot identify the application correctly.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Managing Objects — This question tests Managing Objects — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The application 'web-browsing' does not cover port 8080 traffic. — The security rule explicitly allows applications 'web-browsing', 'ssl', and 'dns'. While the custom web application uses HTTP on port 8080 and is identified as 'web-browsing', the application 'web-browsing' in Palo Alto Networks firewalls is defined to use standard HTTP ports (typically 80, 8080 is not included by default). Since the application does not match the traffic on port 8080, the firewall does not consider this traffic as matching the application 'web-browsing', and it falls through to the implicit deny rule, causing the denial.
What should I do if I get this PCNSA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?
hard
A.80
✓ B.443
C.22
D.8080
Why B: The correct answer is B (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.
Variation 2. A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?
easy
A.22
B.443
C.8080
✓ D.80
Why D: The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.