PCNSA Managing Objects Practice Test 5 — 15 Questions

Question 1

An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?

Accepted Answer

RDP. TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.

Answer

FTP

Answer

SSH

Answer

Telnet

Question 2

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

Accepted Answer

Application. The question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Answer

Region

Answer

Address

Answer

Service

Question 3

Which TWO types of address objects can be used in a security policy? (Choose two.)

Accepted Answer

IP Netmask. In a Palo Alto Networks security policy, address objects are used to match the source and destination fields, and the valid address object types include IP Netmask (a subnet defined by an IP address and a subnet mask, e.g., 192.168.1.0/24) and IP Range (a contiguous span of addresses defined by a start and end IP, e.g., 192.168.1.10-192.168.1.20), so options C and D are correct. These two types are explicitly selectable as address objects when building source or destination matching criteria in the policy rule. Option A (Application) is incorrect because applications are matched via the Application field using application objects or application filters, not address objects. Option B (Tag) is incorrect because tags are metadata labels used for grouping and filtering objects or rules, not an address object type usable in the source/destination address fields. Option E (Service) is incorrect because services (TCP/UDP port and protocol definitions) are matched in the Service/Application field, not as address objects.

Answer

Application

Answer

Tag

Answer

Service

Question 4

A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?

Accepted Answer

IP Netmask. For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.

Answer

FQDN

Answer

IP Wildcard Mask

Answer

IP Range

Question 5

A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.

Answer

Custom URL Category

Answer

Address Group

Answer

Application Filter

Question 6

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

Accepted Answer

Tags are case-sensitive. Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Answer

The address objects are not in the same zone

Answer

The group needs a commit after tagging

Answer

Tags are not case-sensitive

Question 7

An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?

Accepted Answer

Both destination port and protocol. In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.

Answer

Destination port

Answer

Source port

Answer

Protocol

Question 8

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

Accepted Answer

The address object has multiple tags including the wrong one. Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Answer

The group is configured as static

Answer

The dynamic group uses 'match all' and the object lacks some tags

Answer

The administrator added the object directly to the group

Question 9

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

Accepted Answer

The admin forgot to add 'web-04' to the address group. The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group. This is the most common cause of such a failure.

Answer

The address object 'web-04' has the wrong IP

Answer

The address group is dynamic and did not update

Answer

The security policy is set to deny

Question 10

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

Accepted Answer

The service group should not include service-https. The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Answer

The application web-browsing should not be in the rule

Answer

The rule action should be deny

Answer

The source IP should be an address group

Question 11

A network security administrator needs to create an address object that represents a range of IP addresses from 10.1.1.10 to 10.1.1.20. Which address object type should be used?

Accepted Answer

IP Range. The requirement is to represent a specific range of IP addresses from 10.1.1.10 to 10.1.1.20. PAN-OS provides an address object type called IP Range that allows defining a start and end IP address. This type is designed exactly for such scenarios, enabling efficient policy management without needing to list each address individually or use a subnet that might include unwanted addresses.

Answer

FQDN

Answer

Dynamic

Answer

IP Netmask

Question 12

An administrator needs to create a security rule that permits HTTP and HTTPS access to a web server cluster. The cluster members are defined as address objects named Web1, Web2, and Web3. The administrator wants to reference these three objects as a single entity in the security rule. Which object type should be created?

Accepted Answer

Address Group. The correct answer is the address group, which is designed to group multiple address objects for use in policy. By creating a static address group containing Web1, Web2, and Web3, the administrator can reference a single object in the security rule, reducing administrative overhead and ensuring consistency. Other object types serve different purposes: service groups group services, dynamic address groups rely on tags, and EDLs import external lists.

Answer

Service Group

Answer

Dynamic Address Group

Answer

External Dynamic List

Question 13

An administrator is configuring a security policy and needs to allow access to a set of web servers that are defined by a dynamic address group. The dynamic address group uses the filter 'web-server' and tags are applied to the address objects. However, the administrator notices that the dynamic group is not populating with the expected members. Which action should the administrator take to troubleshoot this issue?

Accepted Answer

Verify that the tag 'web-server' is registered on the firewall and applied to the correct address objects.. Dynamic address groups populate based on tags applied to address objects. The filter must reference existing tags that are applied correctly. If the group is empty, the most likely cause is that the tag is missing or not applied to the intended address objects. Verifying tag registration and application directly addresses the root cause.

Answer

Restart the management plane to refresh the dynamic address group membership.

Answer

Check that the firewall has a valid license for dynamic address groups.

Answer

Ensure that the dynamic address group is referenced in a security policy with the correct source and destination zones.

Question 14

An administrator needs to create a service object for a custom application that uses TCP port 8080 and UDP port 8080. What is the most efficient way to create this service object?

Accepted Answer

Create a single service object, add TCP and UDP protocols, and specify destination port 8080 for each.. PAN-OS service objects can contain multiple protocol entries. To cover both TCP and UDP on port 8080, the administrator should create one service object and add two protocol entries: one for TCP with destination port 8080 and one for UDP with destination port 8080. This single object can then be referenced in security policies, providing a clean and efficient configuration.

Answer

Create a service object with protocol UDP and destination port 8080.

Answer

Create two service objects: one for TCP port 8080 and one for UDP port 8080, then create a service group containing both.

Answer

Create a service object with protocol TCP and destination port 8080.

Question 15

A network administrator is configuring a security policy to allow SSH access to a server. The administrator wants to use a predefined service object for SSH. Which service object should be selected?

Accepted Answer

ssh. The predefined service object 'ssh' is the correct choice because it is already defined in PAN-OS with the appropriate protocol (TCP) and port (22). Using predefined services simplifies policy creation and ensures accuracy. The other options are either non-existent or custom names that would require manual creation, which does not meet the requirement of using a predefined object.

Answer

ssh-tcp

Answer

service-ssh

Answer

tcp-22