How to Resolve External Traffic Outages from Firewall Evaluation Order?

You are implementing firewall controls to protect your computer resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall policies, global network firewall policies, and VPC firewall rules. The configuration of rules defines the following characteristics: • The hierarchical firewall policy, bound at the organization level, is allowing/denying spe-cific external traffic. • There is a global network firewall policy with rules that enforce intrusion prevention sys-tem (IPS) capabilities for specific external inbound/outbound traffic. • The VPC firewall rules allow internal communication from RFC 1918 defined subnets communications. • The VPC firewall contains an explicit deny rule with logs enabled. This configuration was successful in multiple preexisting VF'Cs. However, you noticed that the logs were missing when you were reviewing a newly created VPC. All external communications are hanging, but internal traffic is working as expected. You want to fix the connectivity issue. What should you do?

Create a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and reapply the firewall policies and rules in the newVPC.
Raise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC firewall rules.
Review the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall rules are being evaluated before firewall policies, switch the order. Source Reference Answer
Lower the priority numbers of the firewall policy rules and raise the priority numbers of the VPC firewall rules.

Community Votes

83%

17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests precise knowledge of cross-tier firewall rule precedence, with the common trap being the misconception that priority number adjustments can override architectural evaluation order.

This scenario evaluates how hierarchical, global, and VPC-level firewall rules interact during traffic inspection. Community consensus confirms that verifying and correcting the policy evaluation sequence is the only reliable fix for hung external traffic and missing logs.

Option D is frequently selected by candidates who assume lowering priority numbers forces higher-level policies to evaluate first, failing to recognize that priority controls only dictate match order within the same policy scope.

Community Discussion (4 comments)

rich_maverick 👍 1 Selected: C

This question really sucks. The fact is that you really can't affect the order of the evaluation directly by playing with the number values. Hierarchical always comes first. Then, global network and then VPC. There is a way to swap out VPC before global network using networkFirewallPolicyEnforcementOrder. But, given that only external communications are hanging, it would not be my most obvious solution to fix the issue. Unfortunately, C is the least bad answer of the choices presented.

1f01b87 👍 1 Selected: D

Correct answer is D.

b0b25 👍 2 Selected: C

Review to put them in right order

09bd94b 👍 2 Selected: C

this is the only answer with a logical flow

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Palo Alto Networks enforces a strict architectural evaluation sequence where hierarchical policies apply first, followed by global network policies, and finally VPC or device-level rules. When external traffic hangs and logs disappear, it indicates the VPC rules are intercepting or allowing traffic before the global IPS and explicit deny rules can execute. Reviewing and switching the evaluation order ensures that organizational security controls take precedence over local VPC definitions, restoring both connectivity and logging functionality.

Why the Other Options Are Wrong

Option A suggests a disruptive VPC migration that addresses a misconfiguration rather than solving the root cause. Options B and D propose adjusting priority numbers, but priority values only determine rule matching order within identical policy types or scopes. They cannot force a higher architectural layer to evaluate after a lower one without explicitly modifying the enforcement sequence.

Community Comment Notes

Candidates consistently highlight that hierarchical policies naturally evaluate before global and VPC rules, making option C the only logical choice. Comment [3] correctly notes that while priority tweaking is ineffective across tiers, administrators can use settings like networkFirewallPolicyEnforcementOrder to adjust cross-layer sequencing when required. The consensus emphasizes prioritizing architectural evaluation flow over numerical priority manipulation.

Official Reference

Exam Strategy

Always visualize the traffic flow against the platform’s documented evaluation hierarchy before reaching for priority adjustments. Remember that priority numbers only resolve conflicts within the same policy tier, while architectural layers follow a fixed precedence that must be explicitly overridden when necessary.

Related Analysis

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide