PCNSA Managing Objects Practice Test 2 — 15 Questions

Question 1

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EDL cache time is set higher than the refresh interval. The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Answer

The EDL URL is invalid

Answer

The EDL is not registered as a dynamic list

Answer

The firewall's DNS resolution fails

Question 2

An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?

Accepted Answer

Facebook uses a different application not in the group. Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.

Answer

The rule has no source zone

Answer

The rule's action is set to allow but the application group is configured incorrectly

Answer

The application group includes 'ssl' which is not an application

Question 3

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Accepted Answer

Create a service group with two service objects (one for 1000, one for 2000). Option C is correct because a service group can contain multiple service objects, so creating one service object for TCP 1000 and another for TCP 2000 and grouping them lets a single security rule reference both ports. Option D is correct because a custom application can be defined to include both TCP 1000 and TCP 2000, and that application can then be referenced in one security rule. Option A is incorrect because a port range 1000-2000 would also match all intermediate ports (1001-1999), which is not the required behavior. Option B is incorrect because an application override does not create a service group covering two separate ports. Option E is incorrect because it requires two separate rules rather than a single rule with one service group.

Answer

Create a service object with port range 1000-2000

Answer

Create a service object with port 1000 and use an application override

Answer

Create a single service object with port 1000 and a separate rule for port 2000

Question 4

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

FQDN. In Palo Alto Networks PAN-OS, address objects can be defined as IP Netmask (a single host or subnet specified with an IP address and netmask, e.g., 10.0.0.0/24), IP Range (a contiguous span of addresses defined by start and end IPs, e.g., 10.0.0.1–10.0.0.50), and FQDN (a fully qualified domain name that the firewall resolves to one or more IP addresses, refreshed via DNS). These three are the standard address object types selectable in the Address Object configuration under Objects > Addresses. MAC Address is not a valid address object type; MAC-based matching is handled through the source/destination MAC address fields in security policy, not as an address object. Subnet Object is not a distinct PAN-OS address object type — subnets are represented using the IP Netmask type, so 'Subnet Object' is not a separate valid category.

Answer

MAC Address

Answer

Subnet Object

Question 5

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Accepted Answer

Tags can be applied to address objects. Option A is correct because tag-based dynamic address groups rely on tags that are assigned to address objects, which the firewall then uses as the matching criteria for group membership. Option B is correct because when an address object's tags are modified, the dynamic group membership is recalculated and updated immediately after the configuration is committed, without requiring a manual refresh. Option C is correct because a dynamic address group's match criteria can include one or more tags, allowing flexible membership based on any combination of tag values. Option D is not correct because static address groups contain explicitly listed members and do not use tags for matching; only dynamic address groups support tag-based matching. Option E is not correct because tags in this context are not case-sensitive, so tags differing only in letter case are treated as the same tag.

Answer

A static address group can also use tags for matching

Answer

Tags are case-sensitive

Question 6

Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?

Accepted Answer

The dynamic group requires a commit after adding the object. In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.

Answer

The tag is misspelled

Answer

The address object is not tagged

Answer

The group match type is 'all' not 'any'

Question 7

A security administrator is configuring an address object for a web server accessible from the internet. The server has a public IP of 203.0.113.10/32 and a private IP of 10.0.1.10/32. The administrator needs to create a security policy that allows inbound HTTPS traffic to the server. Which address object type should be used for the destination?

Accepted Answer

IP Netmask (e.g., 203.0.113.10/32). The security policy destination must match the IP address that the firewall sees in the packet header. For inbound traffic from the internet, the destination IP is the public IP 203.0.113.10/32, so an IP Netmask object with that exact address is the appropriate type. Using a /32 netmask ensures a single host match, which is precise and efficient for firewall rule evaluation.

Answer

FQDN (e.g., webserver.example.com)

Answer

IP Range (e.g., 10.0.1.10-10.0.1.10)

Answer

IP Wildcard Mask (e.g., 203.0.113.0/0.0.0.255)

Question 8

An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?

Accepted Answer

Use separate virtual systems (vsys) for each tenant.. Virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.

Answer

Use prefix-based naming conventions for address objects.

Answer

Use separate device groups in Panorama.

Answer

Use tags to isolate objects per tenant.

Question 9

Which THREE of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

IP Range. In Palo Alto Networks PAN-OS, address objects can be defined as an IP Range (option A), which specifies a contiguous block of addresses via start and end IP values, and as an IP Netmask (option B), which defines a subnet using an IP address plus a subnet mask (e.g., 10.0.0.0/24). FQDN (option C) is also a valid address object type, resolving a fully qualified domain name to IP addresses dynamically for use in security policy. MAC Address (option D) is not an address object type in PAN-OS; MAC addresses are handled via MAC filtering or in other object types, not as address objects. URL Category (option E) is a separate object type used for URL filtering profiles, not an address object.

Answer

MAC Address

Answer

URL Category

Question 10

A company uses a Palo Alto Networks firewall to control outbound access. They have created custom application filters to block social media and streaming. However, they need to allow a specific corporate YouTube channel for training videos. The administrator creates an application group "Corporate-YouTube" containing the "youtube-base" application, and adds a security rule to allow traffic from internal users to the application group. Despite this, users still cannot access the corporate YouTube channel. What is the most likely reason?

Accepted Answer

The firewall's URL filtering profile is blocking the category before application identification can occur.. The most likely reason is that the URL filtering profile is blocking the YouTube category before the firewall can identify the application. Palo Alto Networks firewalls process URL filtering before application identification in the security policy evaluation order. Even though the application group 'Corporate-YouTube' is allowed, the URL filtering profile (which is applied to the rule or as a default) will block the request if the URL category (e.g., 'streaming-media' or 'social-networking') is denied, preventing the traffic from reaching the application identification stage.

Answer

The application group is not correctly associated with the security policy.

Answer

The application "youtube-base" is not recognized by the firewall.

Answer

The security rule allowing the application group is placed after a deny rule that blocks the "streaming" category.

Question 11

A network administrator manages a Palo Alto Networks firewall in a datacenter. They have configured dynamic address groups (DAGs) to automatically include servers based on tags. The tags are assigned via User-ID from Active Directory. The administrator notices that some servers that should be in the DAG are not appearing, while others are correctly added. The firewall is configured to receive User-ID information from a domain controller via the PAN-OS Agent. The tags are correctly assigned in Active Directory. What should the administrator verify first?

Accepted Answer

The dynamic address group's filter expression is correct and uses the tag.. The most common cause when tags are correctly assigned in Active Directory but servers are missing from a dynamic address group (DAG) is an incorrect filter expression on the DAG itself. The DAG uses a tag-based filter (e.g., 'tag1' or 'tag1 AND tag2') to match registered IP-address-to-tag mappings; if the filter syntax or tag name does not exactly match what is being registered via User-ID, the servers will not be included. The administrator should verify the DAG's filter expression first before investigating other components.

Answer

The firewall's User-ID agent is configured to fetch tags from the correct domain.

Answer

The firewall's license for User-ID is active.

Answer

The security policies using the DAG are committed.

Question 12

A small business uses a Palo Alto Networks PA-220 firewall. The administrator needs to create a security policy to allow inbound VPN connections from remote employees using IPsec. The remote employees connect using dynamic IP addresses. The administrator creates an address object "Remote-VPN-Users" of type "IP Range" but that doesn't work because the IPs are not known. What address object type should be used instead?

Accepted Answer

Any (0.0.0.0/0). When remote employees connect using dynamic IP addresses, the source IP is unknown and cannot be defined by a static address object. Using 'Any' (0.0.0.0/0) as the source address in the security policy allows the firewall to accept IPsec VPN traffic from any source IP, which is necessary for clients with dynamic addresses. This is a common practice for remote access VPN configurations where the peer IP is not predetermined.

Answer

IP Netmask

Answer

FQDN

Answer

IP Wildcard Mask

Question 13

A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?

Accepted Answer

Use the address group in a security policy and enable logging at session end in that policy.. The best choice because it allows the administrator to create a single security policy that uses the address group 'Medical-Servers' as the destination and enables logging at session end. By placing this policy as the last rule for that traffic, it will log any sessions to the group that are not already handled by previous policies. This reduces administrative overhead compared to modifying each existing policy individually. While this does not enforce logging on existing policies that already match traffic, it ensures that any traffic to the group is logged at least once. Other options have significant drawbacks: Option A would be ineffective if earlier rules match first; Option B requires manual application to each policy, increasing overhead; Option C does not directly enforce logging. Therefore, D is the most efficient approach to meet the compliance requirement.

Answer

Create a security policy with a log setting at the end of the rulebase that matches traffic to the group.

Answer

Configure a log forwarding profile and apply it to each policy using the group.

Answer

Use a policy optimizer to automatically add logging to policies.

Question 14

A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?

Accepted Answer

Create a single address object with IP subnet 192.168.10.0/24.. Option C is correct because a single address object can be defined with the IP subnet type and the value 192.168.10.0/24, which represents the entire subnet in one object and is the most efficient way to cover all servers sharing that subnet. Option D is correct because a dynamic address group uses tags to automatically include address objects whose tags match the group's filter, so as servers are tagged (for example, with a 'web-servers' tag) they are added to the group without manually editing membership. Option A is not the best answer because creating an address group with individual address objects for each server IP requires manual per-host maintenance and does not efficiently represent the shared subnet. Option B is not correct because an IP range object 192.168.10.1-192.168.10.254 excludes the network address and is a less precise representation than the subnet object, and it is not one of the marked correct methods. Option E is incorrect because predefined address objects come from Palo Alto Networks' predefined/global object cache for known external services and cannot be used to define an arbitrary internal subnet such as 192.168.10.0/24.

Answer

Create an address group and add individual address objects for each server IP.

Answer

Create a single address object with IP range 192.168.10.1-192.168.10.254.

Answer

Create a predefined address object from the global cache.

Question 15

Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?

Accepted Answer

The filter syntax is invalid; 'andd' should be 'and'.. The dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.

Answer

The address object must be a member of a static address group to be included in a dynamic group.

Answer

The security rule must specify the source zone explicitly.

Answer

The dynamic address group filter uses 'andd' which is a valid operator in older PAN-OS versions.

Answer

The dynamic address group only updates its membership after a system reboot.