PCNSA Managing Objects — 40 Questions

Question 1

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application 'web-browsing' does not cover port 8080 traffic.. The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Answer

The rule order is incorrect; a previous rule is denying the traffic.

Answer

The destination address object 10.10.0.0/16 is incorrect.

Answer

The source zone 'GP' should be 'untrust'.

Question 2

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

Accepted Answer

The filter should use double quotes instead of single quotes around the pattern.. In PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.

Answer

The filter should include a tag condition because dynamic groups require tags.

Answer

The dynamic address group cannot use name-based filters; it requires tags.

Answer

The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.

Question 3

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Accepted Answer

Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.. The 'Show Group Membership' feature in the Address Groups page allows you to view current members and add new address objects by clicking 'Add New Address'. Option E is correct: You can create a tag, assign it to the address object, and then add that tag to a dynamic address group, which automatically includes all objects with that tag. Option C is incorrect because the 'Add' button in the address group editor only allows selecting existing address objects; it does not allow typing an IP directly. Option B is incorrect because the CLI command is 'set address-group add ', not 'add ip '. Option D is incorrect because Panorama templates push configuration, not individual IP addresses directly into groups.

Answer

Execute 'set address-group add ip ' in CLI.

Answer

Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.

Answer

Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.

Question 4

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

Accepted Answer

Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.. Dynamic address groups with tag-based or name-based filters automatically include all matching objects, eliminating manual updates when new sites are added. By using a filter like 'Site-*-Networks', the group dynamically incorporates any address group whose name matches the pattern, reducing administrative overhead. This approach aligns with the PCNSA objective of using dynamic objects to simplify policy management in a scalable environment.

Answer

Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.

Answer

Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.

Answer

Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.

Question 5

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure IKE gateway, then IPsec crypto profile, then tunnel interface, then static route to tunnel interface, then security policy allowing VPN traffic.. IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.

Answer

Configure IPsec crypto profile, then IKE gateway, then tunnel interface, then static route, then security policy.

Answer

Configure IKE gateway, then IPsec crypto profile, then static route, then tunnel interface, then security policy.

Answer

Configure security policy, then IKE gateway, then IPsec crypto profile, then tunnel interface, then static route.

Question 6

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 7

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Accepted Answer

Address. To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Answer

Schedule

Answer

Service

Answer

Tag

Question 8

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Answer

Device groups

Answer

Shared policy

Answer

Template stacks

Question 9

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Accepted Answer

Schedule. In Palo Alto Networks NGFW, a Schedule (A) is a valid object type used to define specific date/time ranges that can be referenced in security policy rules to control when they take effect. A Service (D) is a valid object type that defines the protocol and port (e.g., TCP/443) for matching traffic in policy rules. An Address (E) is a valid object type used to define IP addresses, ranges, or subnets (via Address objects) for use in policy rules. By contrast, a User (B) is not a standalone object type in the same sense; user identification is handled through User-ID, user groups, and dynamic user groups rather than a simple 'User' object. An Application group (C) is also not a valid object type; applications are organized via Application Filters and Application Groups are not a supported object category in the Objects tab of the NGFW.

Answer

User

Answer

Application group

Question 10

A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)

Accepted Answer

Source address. In a security policy rule, the Source address (C) and Destination address (D) are mandatory match criteria that define the traffic the rule governs; without them the rule cannot be committed because the firewall has no scope for which IPs the allow action applies. These two fields are required regardless of whether the rule is allow, deny, or any other action, since they establish the fundamental 5-tuple matching for the session. Application (A) is optional because it can be set to "any" and is only strictly required when using application-based policies or App-ID enforcement. User (B) is optional and only needed for user- or group-based rules, typically in conjunction with User-ID. Service (E) is also optional because it can default to "any" or "application-default", so it is not a mandatory field for rule validity.

Answer

Application

Answer

User

Answer

Service

Question 11

How many address objects are members of the 'web-servers' address group?

Accepted Answer

2. The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.

Answer

3

Answer

1

Answer

4

Question 12

Based on the log excerpt, which object is used for the destination address?

Accepted Answer

Address 'any'. The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.

Answer

Zone 'untrust'

Answer

Application 'web-browsing'

Answer

Service 'service-http'

Question 13

A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?

Accepted Answer

443. (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.

Answer

80

Answer

22

Answer

8080

Question 14

An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?

Accepted Answer

Create an address group and a service group. Creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.

Answer

Use a single address object with a subnet

Answer

Create separate rules for each server

Answer

Use a dynamic address group with tags

Question 15

An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?

Accepted Answer

The rule requires a separate application object. Even though the service group includes both TCP and UDP service objects for DNS (ports 53), the rule is not allowing TCP DNS because it lacks a matching application object. In Palo Alto Networks firewalls, App-ID is used to identify traffic based on application signatures, not just ports. If the security rule does not specify an application (e.g., 'dns'), or if the application is set to something that doesn't match DNS traffic, the rule may not allow the traffic. Option B is the most likely issue.

Answer

The service group includes only UDP service objects

Answer

The security policy action is set to deny

Answer

The service group is incorrectly configured

Question 16

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

Accepted Answer

The EDL cache time is set higher than the refresh interval. The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Answer

The EDL URL is invalid

Answer

The EDL is not registered as a dynamic list

Answer

The firewall's DNS resolution fails

Question 17

An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?

Accepted Answer

Facebook uses a different application not in the group. Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.

Answer

The rule has no source zone

Answer

The rule's action is set to allow but the application group is configured incorrectly

Answer

The application group includes 'ssl' which is not an application

Question 18

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Accepted Answer

Create a service group with two service objects (one for 1000, one for 2000). Option C is correct because a service group can contain multiple service objects, so creating one service object for TCP 1000 and another for TCP 2000 and grouping them lets a single security rule reference both ports. Option D is correct because a custom application can be defined to include both TCP 1000 and TCP 2000, and that application can then be referenced in one security rule. Option A is incorrect because a port range 1000-2000 would also match all intermediate ports (1001-1999), which is not the required behavior. Option B is incorrect because an application override does not create a service group covering two separate ports. Option E is incorrect because it requires two separate rules rather than a single rule with one service group.

Answer

Create a service object with port range 1000-2000

Answer

Create a service object with port 1000 and use an application override

Answer

Create a single service object with port 1000 and a separate rule for port 2000

Question 19

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

FQDN. In Palo Alto Networks PAN-OS, address objects can be defined as IP Netmask (a single host or subnet specified with an IP address and netmask, e.g., 10.0.0.0/24), IP Range (a contiguous span of addresses defined by start and end IPs, e.g., 10.0.0.1–10.0.0.50), and FQDN (a fully qualified domain name that the firewall resolves to one or more IP addresses, refreshed via DNS). These three are the standard address object types selectable in the Address Object configuration under Objects > Addresses. MAC Address is not a valid address object type; MAC-based matching is handled through the source/destination MAC address fields in security policy, not as an address object. Subnet Object is not a distinct PAN-OS address object type — subnets are represented using the IP Netmask type, so 'Subnet Object' is not a separate valid category.

Answer

MAC Address

Answer

Subnet Object

Question 20

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Accepted Answer

Tags can be applied to address objects. Option A is correct because tag-based dynamic address groups rely on tags that are assigned to address objects, which the firewall then uses as the matching criteria for group membership. Option B is correct because when an address object's tags are modified, the dynamic group membership is recalculated and updated immediately after the configuration is committed, without requiring a manual refresh. Option C is correct because a dynamic address group's match criteria can include one or more tags, allowing flexible membership based on any combination of tag values. Option D is not correct because static address groups contain explicitly listed members and do not use tags for matching; only dynamic address groups support tag-based matching. Option E is not correct because tags in this context are not case-sensitive, so tags differing only in letter case are treated as the same tag.

Answer

A static address group can also use tags for matching

Answer

Tags are case-sensitive