Which policy set should be used to ensure that a policy is applied just before the default security rules?

The correct answer is A. Shared post-rulebase. Panorama evaluates security rules in a strict top-down hierarchy: Shared pre-rulebase → Parent device-group pre-rulebase → Child device-group pre-rulebase → Local firewall policy → Child device-group post-rulebase → Parent device-group post-rulebase → Shared post-rulebase →…

Submitted by asante_acc· Apr 18, 2026Policy Evaluation and Management

Question

Options

AShared post-rulebase
BLocal firewall policy
CParent device-group post-rulebase
DChild device-group post-rulebase

How the community answered

(23 responses)

A
96% (22)
D
4% (1)

Explanation

Panorama evaluates security rules in a strict top-down hierarchy: Shared pre-rulebase → Parent device-group pre-rulebase → Child device-group pre-rulebase → Local firewall policy → Child device-group post-rulebase → Parent device-group post-rulebase → Shared post-rulebase → Default security rules. Because the Shared post-rulebase is evaluated immediately before the built-in default security rules (allow intrazone, deny interzone), placing a rule there ensures it is the last administrator-defined rule evaluated before defaults take effect.

Topics

#Policy evaluation order#Security policy hierarchy#Device groups#Post-rulebase

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice