PCNSA Managing Objects — 10 Questions

Question 1

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Accepted Answer

Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.. The 'Show Group Membership' feature in the Address Groups page allows you to view current members and add new address objects by clicking 'Add New Address'. Option E is correct: You can create a tag, assign it to the address object, and then add that tag to a dynamic address group, which automatically includes all objects with that tag. Option C is incorrect because the 'Add' button in the address group editor only allows selecting existing address objects; it does not allow typing an IP directly. Option B is incorrect because the CLI command is 'set address-group add ', not 'add ip '. Option D is incorrect because Panorama templates push configuration, not individual IP addresses directly into groups.

Answer

Execute 'set address-group add ip ' in CLI.

Answer

Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.

Answer

Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.

Question 2

An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?

Accepted Answer

The rule requires a separate application object. Even though the service group includes both TCP and UDP service objects for DNS (ports 53), the rule is not allowing TCP DNS because it lacks a matching application object. In Palo Alto Networks firewalls, App-ID is used to identify traffic based on application signatures, not just ports. If the security rule does not specify an application (e.g., 'dns'), or if the application is set to something that doesn't match DNS traffic, the rule may not allow the traffic. Option B is the most likely issue.

Answer

The service group includes only UDP service objects

Answer

The security policy action is set to deny

Answer

The service group is incorrectly configured

Question 3

Which THREE of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

IP Range. IP Range, IP Netmask, and FQDN are all valid address object types in Palo Alto Networks. IP Range defines a contiguous set of IP addresses (e.g., 192.168.1.1-192.168.1.254), IP Netmask uses subnet mask notation (e.g., 192.168.1.0/24), and FQDN represents a fully qualified domain name (e.g., www.example.com). All three are valid address objects in PAN-OS.

Answer

MAC Address

Answer

URL Category

Question 4

A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?

Accepted Answer

Use the address group in a security policy and enable logging at session end in that policy.. The best choice because it allows the administrator to create a single security policy that uses the address group 'Medical-Servers' as the destination and enables logging at session end. By placing this policy as the last rule for that traffic, it will log any sessions to the group that are not already handled by previous policies. This reduces administrative overhead compared to modifying each existing policy individually. While this does not enforce logging on existing policies that already match traffic, it ensures that any traffic to the group is logged at least once. Other options have significant drawbacks: Option A would be ineffective if earlier rules match first; Option B requires manual application to each policy, increasing overhead; Option C does not directly enforce logging. Therefore, D is the most efficient approach to meet the compliance requirement.

Answer

Create a security policy with a log setting at the end of the rulebase that matches traffic to the group.

Answer

Configure a log forwarding profile and apply it to each policy using the group.

Answer

Use a policy optimizer to automatically add logging to policies.

Question 5

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 6

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 7

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Accepted Answer

Use an FQDN object in the address group; the firewall resolves it automatically. Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Answer

Use a region object instead

Answer

Create a dynamic address group with a tag-based filter

Answer

Manually add all possible IP addresses to an address group

Question 8

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Accepted Answer

Application object. Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Answer

Application filter

Answer

Application group

Answer

Service object

Question 9

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 10

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Accepted Answer

The application 'web-browsing' does not cover port 8080 traffic.. The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Answer

The rule order is incorrect; a previous rule is denying the traffic.

Answer

The destination address object 10.10.0.0/16 is incorrect.

Answer

The source zone 'GP' should be 'untrust'.