PCNSA Managing Objects Practice Test 2 — 15 Questions

Question 1

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 2

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Accepted Answer

Address. To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Answer

Schedule

Answer

Service

Answer

Tag

Question 3

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 4

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Answer

Device groups

Answer

Shared policy

Answer

Template stacks

Question 5

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080

Question 6

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

Accepted Answer

Address group. An address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.

Answer

Tag

Answer

Schedule

Answer

Service group

Question 7

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 8

Which object type is used to group multiple service objects together for use in a security policy?

Accepted Answer

Service group. A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Answer

Schedule

Answer

Tag

Answer

Address group

Question 9

An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?

Accepted Answer

RDP. TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.

Answer

FTP

Answer

SSH

Answer

Telnet

Question 10

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

Accepted Answer

Application. The question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Answer

Region

Answer

Address

Answer

Service

Question 11

Which TWO types of address objects can be used in a security policy? (Choose two.)

Accepted Answer

IP Netmask. IP Netmask and IP Range are both types of address objects that define specific IP addresses or groups of IP addresses. Security policies in Palo Alto Networks firewalls use these address objects to match source and destination IP addresses in traffic, enabling granular control over which hosts or networks are allowed or denied.

Answer

Application

Answer

Tag

Answer

Service

Question 12

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Accepted Answer

Schedule. Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.

Answer

User

Answer

Application group

Question 13

A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)

Accepted Answer

Source address. In Palo Alto Networks security policy rules, the source and destination addresses are mandatory because the firewall must know which traffic to evaluate. Without a source or destination address, the rule cannot define the traffic flow and would be invalid. The 'allow' action requires at least these two address objects to create a valid rule.

Answer

Application

Answer

User

Answer

Service

Question 14

How many address objects are members of the 'web-servers' address group?

Accepted Answer

2. The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.

Answer

3

Answer

1

Answer

4

Question 15

Based on the log excerpt, which object is used for the destination address?

Accepted Answer

Address 'any'. The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.

Answer

Zone 'untrust'

Answer

Application 'web-browsing'

Answer

Service 'service-http'