nerdexam
Palo_Alto_Networks

PCNSE · Question #720

To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?

The correct answer is D. Add the policy in the shared device group as a pre-rule. In Panorama, to assign the highest priority to a security policy, it should be configured as a pre-rule within the "shared" device group.

Submitted by kwame.gh· Apr 18, 2026Deploy and Configure

Question

To ensure that a Security policy has the highest priority, how should an administrator configure a Security policy in the device group hierarchy?

Options

  • AClone the security policy and add it to the other device groups.
  • BAdd the policy to the target device group and apply a master device to the device group.
  • CReference the targeted device's templates in the target device group.
  • DAdd the policy in the shared device group as a pre-rule.

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    8% (2)
  • C
    4% (1)
  • D
    84% (21)

Why each option

In Panorama, to assign the highest priority to a security policy, it should be configured as a pre-rule within the "shared" device group.

AClone the security policy and add it to the other device groups.

Cloning policies to other device groups does not guarantee the highest priority; policy evaluation order is determined by the hierarchy and pre/post-rule designation.

BAdd the policy to the target device group and apply a master device to the device group.

Applying a master device to a device group is not a mechanism for controlling policy priority within the hierarchy.

CReference the targeted device's templates in the target device group.

Referencing templates relates to device configuration, not the priority or placement of security policies within device groups.

DAdd the policy in the shared device group as a pre-rule.Correct

In the Panorama device group hierarchy, policies defined as "pre-rules" in the "shared" device group are evaluated first, giving them the highest priority across all managed firewalls. This ensures they take precedence over policies defined in lower-level device groups or post-rules.

Concept tested: Panorama policy priority and hierarchy

Source: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-firewalls/device-groups-and-templates/device-groups-and-templates-overview

Topics

#Security Policy#Device Group Hierarchy#Policy Priority#Shared Device Group

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice