PCNSA Managing Objects Practice Test 4 — 15 Questions

Question 1

An administrator needs to create an address object for a server that has the IPv6 address 2001:db8::1. The object will be used in a security policy rule to allow management access. Which address type should the administrator select when creating the object?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IP Netmask. For a single IPv6 host address, the appropriate address object type is IP Netmask. In PAN-OS, IP Netmask supports IPv6 addresses and can be configured with a /128 prefix to represent a single host. This allows the security policy to match traffic to and from that specific IPv6 address. Other types like FQDN or IP Wildcard are not suitable because they either require a domain name or only support IPv4.

Answer

IP Range

Answer

FQDN

Answer

IP Wildcard

Question 2

An administrator is creating a service object to allow TCP port 8080 traffic. The firewall is running PAN-OS 10.1 and the administrator wants to use the predefined service object for this port. Which predefined service object should the administrator select?

Accepted Answer

service-8080. PAN-OS provides predefined service objects for common ports, including service-8080 for TCP port 8080. Using this object directly in a security policy is the most efficient and accurate method. It avoids the need to create a custom service object and ensures the correct port is matched. The other options either correspond to different ports or do not exist as predefined objects.

Answer

service-http-alt

Answer

service-http

Answer

service-https

Question 3

An administrator has created a dynamic address group named 'DB-Servers' with the filter 'db-server' and tagged several address objects with the tag 'db-server'. However, the firewall's dynamic address group is not populating with these addresses. What is a possible reason for this issue?

Accepted Answer

The filter expression must reference the tag with a preceding 'tag.' prefix, e.g., 'tag.db-server'.. Dynamic address group filters in PAN-OS require tags to be prefixed with 'tag.' to be recognized correctly. If the filter is simply 'db-server' without the prefix, the firewall will not match any objects, even if they are tagged. The correct filter syntax is 'tag.db-server'. This ensures the firewall evaluates the tag attribute of address objects. Other options, such as quoting or zone restrictions, are not valid causes for this issue.

Answer

The address objects tagged with 'db-server' are not in the same zone as the dynamic address group.

Answer

The dynamic address group filter must use the tag name in quotes, e.g., 'db-server'.

Answer

The tag 'db-server' is not registered in the firewall's tag registry.

Question 4

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 5

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 6

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Accepted Answer

Use an FQDN object in the address group; the firewall resolves it automatically. Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Answer

Use a region object instead

Answer

Create a dynamic address group with a tag-based filter

Answer

Manually add all possible IP addresses to an address group

Question 7

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Accepted Answer

Application object. Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Answer

Application filter

Answer

Application group

Answer

Service object

Question 8

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 9

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit. VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Answer

Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit

Answer

Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit

Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy

Question 10

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 11

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 12

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080

Question 13

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

Accepted Answer

Address group. An address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.

Answer

Tag

Answer

Schedule

Answer

Service group

Question 14

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Accepted Answer

The group automatically updates and removes the IP address.. Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Answer

The group retains the IP address until manually removed.

Answer

The group is deleted.

Answer

The group requires a commit to update.

Question 15

Which object type is used to group multiple service objects together for use in a security policy?

Accepted Answer

Service group. A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Answer

Schedule

Answer

Tag

Answer

Address group