How should I use these Deploy and Configure Firewalls practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Deploy and Configure Firewalls questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Deploy and Configure Firewalls domain.

PCNSE · topic practice

Deploy and Configure Firewalls practice questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE Deploy and Configure Firewalls practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Deploy and Configure Firewalls

Practice 10 questions Browse domain →

What the exam tests

What to know about Deploy and Configure Firewalls

Deploy and Configure Firewalls questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Deploy and Configure Firewalls exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Deploy and Configure Firewalls questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Deploy and Configure Firewalls explanation →

A company is deploying a new firewall in active/passive high availability. The two firewalls are connected directly via the HA1 and HA2 interfaces. After configuration, the passive firewall shows 'HA state: passive' but the active firewall shows 'HA state: non-functional'. What is the most likely cause?

Trap 1: The HA1 link is down or misconfigured.

HA1 is for heartbeat; if down, the firewalls would not form a pair.

Trap 2: The HA2 link is being used for management traffic.

HA2 should be dedicated for synchronization; management traffic should not be sent over it.

Trap 3: The preemptive setting is enabled on both firewalls.

Preemption determines which firewall becomes active; it does not cause a non-functional state.

Study all Deploy and Configure Firewalls common traps →

A
The HA1 link is down or misconfigured.
Why wrong: HA1 is for heartbeat; if down, the firewalls would not form a pair.
B
The HA2 link is being used for management traffic.
Why wrong: HA2 should be dedicated for synchronization; management traffic should not be sent over it.
C
The preemptive setting is enabled on both firewalls.
Why wrong: Preemption determines which firewall becomes active; it does not cause a non-functional state.
D
The HA2 link is down or misconfigured.
HA2 is required for session synchronization; if it fails, the active firewall reports non-functional.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring a new firewall to replace an existing one. The existing firewall has a policy that allows traffic from the 10.0.0.0/8 subnet to the internet. The new firewall must use the same policy but also log the traffic. The engineer creates a security rule with source zone 'Trust', destination zone 'Untrust', source address 10.0.0.0/8, and action 'allow'. Logging is set at rule end. However, traffic from 10.1.0.0/16 is not being logged. What is the reason?

Trap 1: The firewall is configured to not log interzone traffic.

Interzone traffic is logged by default if a rule has logging enabled.

Trap 2: The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.

10.1.0.0/16 is indeed within 10.0.0.0/8.

Trap 3: The logging profile is not applied to the rule.

Logging is enabled at rule end; no separate profile is needed for basic logging.

Study all Deploy and Configure Firewalls common traps →

A
Another rule earlier in the policy matches the traffic and allows it before reaching this rule.
If an earlier rule allows the traffic, this rule is never evaluated, and logging is not triggered.
B
The firewall is configured to not log interzone traffic.
Why wrong: Interzone traffic is logged by default if a rule has logging enabled.
C
The source address 10.1.0.0/16 is not part of the 10.0.0.0/8 subnet.
Why wrong: 10.1.0.0/16 is indeed within 10.0.0.0/8.
D
The logging profile is not applied to the rule.
Why wrong: Logging is enabled at rule end; no separate profile is needed for basic logging.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full NAT/PAT explanation →

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Trap 1: reset-both

'reset-both' sends resets to both client and server, but is not used for allow rules.

Trap 2: deny

'deny' blocks traffic and sends a TCP reset.

Trap 3: drop

'drop' silently discards packets.

Study all Deploy and Configure Firewalls common traps →

A
allow
'allow' permits the traffic.
B
reset-both
Why wrong: 'reset-both' sends resets to both client and server, but is not used for allow rules.
C
deny
Why wrong: 'deny' blocks traffic and sends a TCP reset.
D
drop
Why wrong: 'drop' silently discards packets.

Full breakdown with real-world context →

Question 4mediummultiple choice

Review the full routing breakdown →

An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?

Trap 1: The firewall does not support multiple virtual routers.

Palo Alto firewalls do support multiple virtual routers.

Trap 2: The virtual routers are not connected to each other.

They can be connected via a shared interface or redistribution.

Trap 3: NAT is not configured on VR2.

NAT is not required for routing; it is for address translation.

Study all Deploy and Configure Firewalls common traps →

A
The static route in VR1 does not point to an interface or next hop that is reachable via VR2.
Without route redistribution, VR1 cannot use VR2's routes.
B
The firewall does not support multiple virtual routers.
Why wrong: Palo Alto firewalls do support multiple virtual routers.
C
The virtual routers are not connected to each other.
Why wrong: They can be connected via a shared interface or redistribution.
D
NAT is not configured on VR2.
Why wrong: NAT is not required for routing; it is for address translation.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

An engineer is troubleshooting an inter-zone rule that should allow traffic from zone 'Trust' to zone 'Untrust'. The rule has a source address of 10.0.0.0/8 and destination address of any. The traffic is being denied. The engineer checks the log and sees the rule is not matched. What is the most likely reason?

Trap 1: The source address 10.0.0.0/8 is not included in the source zone.

The source zone is Trust; the source address is the IP, not the zone.

Trap 2: The destination address is set to 'any', which is not valid.

'any' is a valid destination address in a rule.

Trap 3: The traffic is intra-zone, not inter-zone.

If both zones are the same, it would be intra-zone; but here it's Trust to Untrust.

Study all Deploy and Configure Firewalls common traps →

A
The source address 10.0.0.0/8 is not included in the source zone.
Why wrong: The source zone is Trust; the source address is the IP, not the zone.
B
The destination address is set to 'any', which is not valid.
Why wrong: 'any' is a valid destination address in a rule.
C
The traffic is intra-zone, not inter-zone.
Why wrong: If both zones are the same, it would be intra-zone; but here it's Trust to Untrust.
D
A rule with a 'deny' action appears earlier in the security policy.
If a deny rule matches before the allow rule, the traffic is denied.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Deploy and Configure Firewalls explanation →

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Trap 1: A management profile must be applied to the vwire.

Management profiles are for management access, not required for vwire.

Trap 2: A zone must be assigned to the vwire.

The vwire itself is not a zone; zones are assigned to the interfaces that are part of the vwire.

Trap 3: The interfaces must be of type 'aggregate'.

Any interface type can be used in a vwire.

Study all Deploy and Configure Firewalls common traps →

A
Two physical or subinterfaces assigned to the vwire.
A vwire requires exactly two interfaces.
B
A management profile must be applied to the vwire.
Why wrong: Management profiles are for management access, not required for vwire.
C
A zone must be assigned to the vwire.
Why wrong: The vwire itself is not a zone; zones are assigned to the interfaces that are part of the vwire.
D
The interfaces must be of type 'aggregate'.
Why wrong: Any interface type can be used in a vwire.
E
No IP addresses configured on the interfaces used in the vwire.
Interfaces in a vwire operate at layer 2 without IPs.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Deploy and Configure Firewalls explanation →

Which THREE of the following are valid methods to enable traffic logging when configuring a security rule?

Trap 1: Enable 'Logging' under the rule's 'Actions' tab.

Logging is enabled via the rule's 'Log Setting' not an Actions tab.

Trap 2: Configure 'Log at Rule Match' under the rule's 'Advanced' settings.

There is no such setting; logging is at start or end.

Study all Deploy and Configure Firewalls common traps →

A
Set 'Log at Session End' in the rule.
This logs when the session ends.
B
Apply a Log Forwarding profile to the rule.
This allows sending logs to external systems.
C
Enable 'Logging' under the rule's 'Actions' tab.
Why wrong: Logging is enabled via the rule's 'Log Setting' not an Actions tab.
D
Configure 'Log at Rule Match' under the rule's 'Advanced' settings.
Why wrong: There is no such setting; logging is at start or end.
E
Set 'Log at Session Start' in the rule.
This logs the beginning of a session.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full VPN explanation →

You are deploying a pair of PA-5250 firewalls in active/passive HA mode for a large enterprise. The firewalls are configured with multiple virtual routers (VRs) to segment traffic: VR-A for internal corporate network, VR-B for DMZ, and VR-C for Internet edge. Each VR is associated with a separate Vsys. The HA pair uses IPsec tunnel monitoring to determine failover. The customer reports that after a recent configuration change, failover does not occur when the primary firewall's Internet-facing interface (ethernet1/1) goes down. You verify that the primary firewall detects the interface failure, but the secondary does not take over. The HA configuration shows: 'monitor failure only' set to 'link-status', 'monitor hold time' 1000ms, 'promotion hold time' 2000ms, and 'monitor failure condition' is 'any'. The IPsec tunnel monitoring is configured for tunnel to a remote site. The path monitoring includes the Internet-facing interface under VR-C. What is the most likely reason for the failover failure?

Trap 1: The use of multiple virtual routers prevents HA from monitoring…

HA monitoring is per-Vsys and can monitor interfaces in different VRs within the same Vsys.

Trap 2: The 'monitor hold time' is too short, causing flapping to be…

1000ms is a standard value and would not prevent failover detection.

Trap 3: The 'monitor failure only' is set to 'link-status' instead of…

While path monitoring is more comprehensive, link-status should still trigger failover for a direct interface failure.

Study all Deploy and Configure Firewalls common traps →

A
The use of multiple virtual routers prevents HA from monitoring interfaces across VRs.
Why wrong: HA monitoring is per-Vsys and can monitor interfaces in different VRs within the same Vsys.
B
The IPsec tunnel monitoring is configured, but it is not a valid HA monitoring method; only path, interface, and route monitoring are supported.
IPsec tunnel monitoring is not an HA monitoring method; the firewall may not consider it for failover decisions.
C
The 'monitor hold time' is too short, causing flapping to be ignored.
Why wrong: 1000ms is a standard value and would not prevent failover detection.
D
The 'monitor failure only' is set to 'link-status' instead of 'path-monitoring'.
Why wrong: While path monitoring is more comprehensive, link-status should still trigger failover for a direct interface failure.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Deploy and Configure Firewalls explanation →

A company has deployed two PA-5250 firewalls in an active/passive high-availability pair. The passive firewall shows the status 'non-functional' after a reboot. The active firewall is still passing traffic. The administrator checks the HA configuration and sees that the preemptive setting is enabled on both firewalls. What is the most likely cause of the passive firewall showing 'non-functional'?

Trap 1: The preemptive setting is causing the passive firewall to remain in…

Preemptive setting affects priority, not operational state.

Trap 2: The HA2 keepalive timer has expired.

HA2 keepalive failure would cause 'suspended' or 'passive' state, not 'non-functional'.

Trap 3: The hello interval on the passive firewall is set to a different…

Hello interval mismatch would cause 'suspended', not 'non-functional'.

Study all Deploy and Configure Firewalls common traps →

A
The preemptive setting is causing the passive firewall to remain in non-functional state until a failover occurs.
Why wrong: Preemptive setting affects priority, not operational state.
B
The HA2 keepalive timer has expired.
Why wrong: HA2 keepalive failure would cause 'suspended' or 'passive' state, not 'non-functional'.
C
The management port (MGT) on the passive firewall is down or unplugged.
A down MGT port breaks the HA1 control link, causing the firewall to show 'non-functional'.
D
The hello interval on the passive firewall is set to a different value than on the active firewall.
Why wrong: Hello interval mismatch would cause 'suspended', not 'non-functional'.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full DNS explanation →

A security engineer is deploying a Palo Alto Networks firewall in a branch office. The firewall must enforce the following security policies: (1) Allow outbound HTTPS traffic from internal users to the internet. (2) Block all inbound traffic from the internet to the internal network except for SMTP traffic to a specific mail server. (3) Allow outbound DNS traffic from internal DNS servers to external DNS servers. Which TWO security rules should the engineer create to satisfy these requirements? (Choose two.)

Trap 1: Rule: from internal to external, source any, destination any,…

Using service instead of application may allow non-HTTPS traffic on port 443.

Trap 2: Rule: from internal to external, source any, destination any,…

Overly permissive; allows all outbound traffic.

Trap 3: Rule: from internal to external, source any, destination any,…

Allows all web-browsing including HTTP, but requirement is only HTTPS.

Study all Deploy and Configure Firewalls common traps →

A
Rule: from internal to external, source any, destination any, application any, service tcp/443, action allow.
Why wrong: Using service instead of application may allow non-HTTPS traffic on port 443.
B
Rule: from internal to external, source internal-users, destination any, application ssl, service application-default, action allow.
Correctly allows HTTPS with application-based control.
C
Rule: from external to internal, source any, destination mail-server-ip, application smtp, service application-default, action allow.
Correctly allows inbound SMTP only to the mail server.
D
Rule: from internal to external, source any, destination any, application any, service any, action allow.
Why wrong: Overly permissive; allows all outbound traffic.
E
Rule: from internal to external, source any, destination any, application web-browsing, service application-default, action allow.
Why wrong: Allows all web-browsing including HTTP, but requirement is only HTTPS.

Full breakdown with real-world context →

Question 11mediummultiple choice

Review the full routing breakdown →

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Exhibit

Refer to the exhibit.

admin@PA-5250> show routing route

IPv4 Route Table for virtual-router default

destination  nexthop      metric   flags  interface  age
0.0.0.0/0    10.1.1.1     10       A S    ethernet1/1  5m
10.1.1.0/24  10.1.1.100   0        A C    ethernet1/1  5m
10.2.2.0/24  10.1.1.200   1        A S    ethernet1/1  5m
10.3.3.0/24  10.1.1.200   1        A S    ethernet1/1  5m

Trap 1: The destination network 10.3.3.0/24 is not in the routing table.

10.3.3.0/24 is present.

Trap 2: The source network 10.2.2.0/24 is not in the routing table.

10.2.2.0/24 is present with next hop 10.1.1.200.

Trap 3: The default route 0.0.0.0/0 is missing.

Default route exists.

Study all Deploy and Configure Firewalls common traps →

A
The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.
If next hop is down, traffic cannot be forwarded.
B
The destination network 10.3.3.0/24 is not in the routing table.
Why wrong: 10.3.3.0/24 is present.
C
The source network 10.2.2.0/24 is not in the routing table.
Why wrong: 10.2.2.0/24 is present with next hop 10.1.1.200.
D
The default route 0.0.0.0/0 is missing.
Why wrong: Default route exists.

Full breakdown with real-world context →

Question 12mediumdrag order

Read the full VPN explanation →

Order the steps to configure an IPsec VPN tunnel between two Palo Alto firewalls.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediummatching

Review the full routing breakdown →

Match each type of route to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manually configured by administrator

Learned via link-state routing protocol

Learned via path-vector routing protocol

Directly attached network

Used when no specific route matches destination

Question 14easymultiple choice

Read the full Deploy and Configure Firewalls explanation →

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Exhibit

Refer to the exhibit.
Time,Source,Destination,Application,Action,Rule
2024-05-01 10:00:00,192.168.1.100,203.0.113.50,ssl,deny,default-deny

Trap 1: The session ended with TCP FIN, causing the firewall to deny.

TCP FIN is logged as the session end reason after the action; it does not cause denial.

Trap 2: The destination IP is blacklisted.

No evidence of a blacklist; the log shows the rule 'default-deny'.

Trap 3: The security rule 'default-deny' explicitly blocks this traffic.

'default-deny' is a built-in implicit rule, not an explicit user-configured rule.

Study all Deploy and Configure Firewalls common traps →

A
The application 'ssl' is not allowed in any security rule.
The traffic matched the built-in default-deny rule because no user-defined rule allowed the application.
B
The session ended with TCP FIN, causing the firewall to deny.
Why wrong: TCP FIN is logged as the session end reason after the action; it does not cause denial.
C
The destination IP is blacklisted.
Why wrong: No evidence of a blacklist; the log shows the rule 'default-deny'.
D
The security rule 'default-deny' explicitly blocks this traffic.
Why wrong: 'default-deny' is a built-in implicit rule, not an explicit user-configured rule.

Full breakdown with real-world context →

Question 15mediummultiple choice

Open the full VLAN trunking answer →

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Exhibit

Refer to the exhibit.
admin@PA-500> show interface ethernet1/2.10
Interface ethernet1/2.10
  VLAN: 20
  Virtual router: default
  IP netmask: 192.168.10.1/24
  Zone: VLAN10
  State: up

Trap 1: The IP netmask is /24 but should be /16.

The /24 netmask is appropriate for the intended 192.168.10.0/24 subnet.

Trap 2: The zone is incorrectly named 'VLAN10'.

The zone name is for administrative purposes and does not affect routing.

Trap 3: The virtual router is not correctly set.

The virtual router is set to 'default' and no routing issue is indicated.

Study all Deploy and Configure Firewalls common traps →

A
The VLAN ID is misconfigured as 20 instead of 10.
The sub-interface expects VLAN tag 20, but traffic from VLAN 10 uses tag 10.
B
The IP netmask is /24 but should be /16.
Why wrong: The /24 netmask is appropriate for the intended 192.168.10.0/24 subnet.
C
The zone is incorrectly named 'VLAN10'.
Why wrong: The zone name is for administrative purposes and does not affect routing.
D
The virtual router is not correctly set.
Why wrong: The virtual router is set to 'default' and no routing issue is indicated.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full NAT/PAT explanation →

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Exhibit

Refer to the exhibit.
admin@PA-500# show running config | match nat
...
nat {
    source-nat {
        rule "SNAT-Outside" {
            source [ 10.0.0.0/8 ];
            destination [ any ];
            service [ any ];
            to-interface ethernet1/1;
            source-translation {
                interface-address;
            }
        }
    }
}

Trap 1: The 'interface-address' option requires a specific translated…

Interface-address uses the IP of the specified interface dynamically.

Trap 2: The rule should be under 'destination-nat' instead of 'source-nat'.

This is a source NAT scenario; destination NAT is for inbound traffic.

Trap 3: The 'to-interface' should be 'any'.

Specifying the egress interface is correct and often necessary.

Study all Deploy and Configure Firewalls common traps →

A
The 'interface-address' option requires a specific translated address.
Why wrong: Interface-address uses the IP of the specified interface dynamically.
B
The rule is missing a 'from' zone specification.
Source NAT rules must include the source zone to determine when to translate.
C
The rule should be under 'destination-nat' instead of 'source-nat'.
Why wrong: This is a source NAT scenario; destination NAT is for inbound traffic.
D
The 'to-interface' should be 'any'.
Why wrong: Specifying the egress interface is correct and often necessary.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full NAT/PAT explanation →

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

Trap 1: Dynamic NAT (1:1 pool)

Dynamic NAT uses a pool of public IPs but still one-to-one, not sufficient for 500 users with one IP.

Trap 2: Static NAT (1:1)

Static NAT maps one internal IP to one external IP, not scalable for many users.

Trap 3: Destination NAT

Destination NAT is used for inbound traffic to internal servers.

Study all Deploy and Configure Firewalls common traps →

A
Dynamic NAT (1:1 pool)
Why wrong: Dynamic NAT uses a pool of public IPs but still one-to-one, not sufficient for 500 users with one IP.
B
Static NAT (1:1)
Why wrong: Static NAT maps one internal IP to one external IP, not scalable for many users.
C
Destination NAT
Why wrong: Destination NAT is used for inbound traffic to internal servers.
D
Source NAT with IP and port translation (PAT)
PAT enables many internal IPs to share a single public IP via port multiplexing.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Deploy and Configure Firewalls explanation →

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

Trap 1: The destination IP is in a blacklist.

There is no mention of a blacklist; the rule is named 'Allow-SSL'.

Trap 2: The security rule is placed too low in the rulebase.

The traffic matches the rule, so rule order is not the issue; it is being matched but denied due to service mismatch.

Trap 3: The SSL certificate is expired.

An expired certificate would cause a browser warning but not a firewall denial.

Study all Deploy and Configure Firewalls common traps →

A
The destination IP is in a blacklist.
Why wrong: There is no mention of a blacklist; the rule is named 'Allow-SSL'.
B
The security rule is placed too low in the rulebase.
Why wrong: The traffic matches the rule, so rule order is not the issue; it is being matched but denied due to service mismatch.
C
The security rule 'Allow-SSL' has 'service' set to 'application-default' but the website uses port 8443.
Application-default restricts matching to the default port (443 for ssl), so port 8443 traffic does not match.
D
The SSL certificate is expired.
Why wrong: An expired certificate would cause a browser warning but not a firewall denial.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Deploy and Configure Firewalls explanation →

By default, what is the action on traffic between two different zones without any security rule?

Trap 1: allow

Intrazone traffic is allowed by default, but interzone traffic is denied.

Trap 2: depends on the application

Default action is deny regardless of application.

Trap 3: prompt

No prompt behavior exists for default interzone traffic.

Study all Deploy and Configure Firewalls common traps →

A
deny
By default, traffic between different zones is denied unless a security rule allows it.
B
allow
Why wrong: Intrazone traffic is allowed by default, but interzone traffic is denied.
C
depends on the application
Why wrong: Default action is deny regardless of application.
D
prompt
Why wrong: No prompt behavior exists for default interzone traffic.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Deploy and Configure Firewalls explanation →

An administrator adds a new security rule to allow outbound 'web-browsing' and 'ssl' traffic. After committing, users report that some HTTPS sites are still blocked. Traffic logs show that the traffic matches the new rule but is denied. What is the most likely cause?

Trap 1: A decryption policy is required for HTTPS traffic.

Decryption is not required for the rule to allow traffic, but it may affect URL filtering; however, the traffic is being denied, not just filtered.

Trap 2: The application filter does not include 'ssl'.

The rule allows 'ssl', so the filter includes it.

Trap 3: The rule is placed too low in the rulebase.

If the traffic matches the rule, placement is not the issue.

Study all Deploy and Configure Firewalls common traps →

A
The service 'application-default' does not match the port used by the site.
Application-default restricts matching to the standard port for the application, so sites on non-standard ports do not match.
B
A decryption policy is required for HTTPS traffic.
Why wrong: Decryption is not required for the rule to allow traffic, but it may affect URL filtering; however, the traffic is being denied, not just filtered.
C
The application filter does not include 'ssl'.
Why wrong: The rule allows 'ssl', so the filter includes it.
D
The rule is placed too low in the rulebase.
Why wrong: If the traffic matches the rule, placement is not the issue.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Deploy and Configure Firewalls sessions

Start a Deploy and Configure Firewalls only practice session

Every question in these sessions is drawn from the Deploy and Configure Firewalls domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Deploy and Configure Firewalls questions →Mixed PCNSE session

Frequently asked questions

What does the PCNSE exam test about Deploy and Configure Firewalls?: Deploy and Configure Firewalls questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Deploy and Configure Firewalls questions in a focused session?: Yes — the session launcher on this page draws every question from the Deploy and Configure Firewalls domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSE topics?: Use the topic links above to move to related areas, or go back to the PCNSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSE exam covers. They are not copied from any real exam or dump site.

Deploy and Configure Firewalls only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSE questions Deploy and Configure Firewalls domain overview PCNSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Deploy and Configure Firewalls practice questions

What to know about Deploy and Configure Firewalls

Common Deploy and Configure Firewalls exam traps

Deploy and Configure Firewalls questions

A security engineer needs to allow inbound HTTPS traffic from the internet to a web server in the DMZ. The source zone is 'Untrust', destination zone is 'DMZ', and the destination address is the web server's IP. Which security policy action should be used?

Which TWO of the following are required when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Which THREE of the following are valid methods to enable traffic logging when configuring a security rule?

Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?

Exhibit

Order the steps to configure an IPsec VPN tunnel between two Palo Alto firewalls.

Match each type of route to its description.

What is the most likely reason the traffic from 192.168.1.100 to 203.0.113.50 is being denied?

Exhibit

The administrator intended to create a sub-interface for VLAN 10 with IP 192.168.10.1/24. However, traffic from VLAN 10 is not being routed through this interface. Based on the exhibit, what is the cause?

Exhibit

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

Exhibit

A company needs to provide internet access to 500 internal users using a single public IP address. Which NAT method should be configured?

A security administrator notices that traffic to a specific website is being denied. The traffic log shows that the application is 'ssl' and the action is 'deny' with the rule being 'Allow-SSL'. What is the most likely cause?

By default, what is the action on traffic between two different zones without any security rule?

An administrator adds a new security rule to allow outbound 'web-browsing' and 'ssl' traffic. After committing, users report that some HTTPS sites are still blocked. Traffic logs show that the traffic matches the new rule but is denied. What is the most likely cause?

Track your progress over time

Start a Deploy and Configure Firewalls only practice session

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions

Securing Traffic and App-ID practice questions

Securing Users and Applications with Authentication practice questions

Decryption and SSL Inspection practice questions

Managing Troubleshooting and High Availability practice questions