PCNSA Managing Objects Practice Test 3 — 15 Questions

Question 1

A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?

Accepted Answer

443. (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.

Answer

80

Answer

22

Answer

8080

Question 2

A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?

Accepted Answer

IP Netmask. For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.

Answer

FQDN

Answer

IP Wildcard Mask

Answer

IP Range

Question 3

An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?

Accepted Answer

Create an address group and a service group. Creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.

Answer

Use a single address object with a subnet

Answer

Create separate rules for each server

Answer

Use a dynamic address group with tags

Question 4

A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.

Answer

Custom URL Category

Answer

Address Group

Answer

Application Filter

Question 5

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

Accepted Answer

Tags are case-sensitive. Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Answer

The address objects are not in the same zone

Answer

The group needs a commit after tagging

Answer

Tags are not case-sensitive

Question 6

An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?

Accepted Answer

Both destination port and protocol. In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.

Answer

Destination port

Answer

Source port

Answer

Protocol

Question 7

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

Accepted Answer

The address object has multiple tags including the wrong one. Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Answer

The group is configured as static

Answer

The dynamic group uses 'match all' and the object lacks some tags

Answer

The administrator added the object directly to the group

Question 8

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

Accepted Answer

The EDL cache time is set higher than the refresh interval. The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Answer

The EDL URL is invalid

Answer

The EDL is not registered as a dynamic list

Answer

The firewall's DNS resolution fails

Question 9

An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?

Accepted Answer

Facebook uses a different application not in the group. Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.

Answer

The rule has no source zone

Answer

The rule's action is set to allow but the application group is configured incorrectly

Answer

The application group includes 'ssl' which is not an application

Question 10

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Accepted Answer

Create a service group with two service objects (one for 1000, one for 2000). A service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.

Answer

Create a service object with port range 1000-2000

Answer

Create a service object with port 1000 and use an application override

Answer

Create a single service object with port 1000 and a separate rule for port 2000

Question 11

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

FQDN. FQDN (Fully Qualified Domain Name) is a valid address object type in Palo Alto Networks that allows you to define a security policy rule based on a domain name rather than an IP address. The firewall dynamically resolves the FQDN to IP addresses at runtime, which is useful for destinations like cloud services or websites with changing IPs.

Answer

MAC Address

Answer

Subnet Object

Question 12

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Accepted Answer

Tags can be applied to address objects. Tags are metadata labels that can be applied to address objects in Palo Alto Networks firewalls. This allows you to categorize objects flexibly, and dynamic address groups use these tags to automatically include or exclude objects based on tag membership.

Answer

A static address group can also use tags for matching

Answer

Tags are case-sensitive

Question 13

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny

Question 14

Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?

Accepted Answer

The dynamic group requires a commit after adding the object. In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.

Answer

The tag is misspelled

Answer

The address object is not tagged

Answer

The group match type is 'all' not 'any'

Question 15

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

Accepted Answer

The service group should not include service-https. The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Answer

The application web-browsing should not be in the rule

Answer

The rule action should be deny

Answer

The source IP should be an address group