PCNSA Managing Objects Practice Test 6 — 15 Questions

Question 1

An administrator is configuring a Dynamic Address Group (DAG) to automatically include all servers that have the tag 'WebServer'. The DAG will be used in a security policy. Which two of the following statements are true regarding the configuration and behavior of this DAG? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DAG can be referenced in a security policy as a source or destination address.. Dynamic Address Groups automatically update their membership based on tag changes, and they can be used in security policies as source or destination addresses. These two characteristics make DAGs powerful for dynamic environments where server roles or IPs change frequently.

Answer

The DAG requires the firewall to be connected to a User-ID agent to function.

Answer

The DAG can only contain IP addresses from a single subnet.

Answer

The DAG filter must be written in a specific regular expression syntax.

Question 2

An administrator is creating a security policy and needs to reference multiple service objects for different applications. The administrator wants to group these services into a single object that can be used in the policy. Which TWO of the following statements are true about service groups in PAN-OS? (Choose two.)

Accepted Answer

A service group can contain other service groups, allowing for hierarchical grouping.. The two true statements are that a service group can contain both predefined and custom service objects, and that it can contain other service groups (nested groups). These capabilities provide flexibility in grouping services for policy use. The other options are false because service groups are restricted to service objects and cannot contain address objects or applications, nor can they be used in address fields.

Answer

A service group can be used in the Source Address field of a security policy.

Answer

A service group can contain applications, allowing for application-based filtering.

Answer

A service group can contain address objects to simplify policy creation.

Question 3

A network security administrator needs to create a service object that represents a custom application running on TCP port 8443 and UDP port 8443. The administrator wants to ensure that both protocols are matched by a single service object to simplify policy management. Which action should the administrator take?

Accepted Answer

Create a service group that includes two service objects: one for TCP port 8443 and one for UDP port 8443, then reference the service group in the security policy.. A service group allows multiple service objects to be grouped under one name, so referencing the group in a security policy covers both TCP and UDP port 8443. This reduces the number of objects in the policy and simplifies management. The other options either require multiple objects in the policy or use unsupported protocol combinations.

Answer

Create a service object with protocol TCP and destination port 8443, then create another service object with protocol UDP and destination port 8443, and use both in the security policy.

Answer

Create an application object with protocol TCP-UDP and destination port 8443.

Answer

Create a service object with protocol TCP-UDP and destination port 8443.

Question 4

An administrator needs to ensure that a security policy rule only allows traffic to a specific destination FQDN that resolves to multiple IP addresses, and the IP addresses change frequently. The administrator wants the firewall to automatically update the IP addresses without manual intervention. Which object type should the administrator use?

Accepted Answer

FQDN address object. An FQDN address object is designed to resolve a domain name to its IP addresses and update them automatically as DNS records change. This provides dynamic IP address tracking without manual intervention. The other options either require manual updates or use different mechanisms that do not directly resolve FQDNs. Thus, the FQDN address object is the correct solution for this scenario.

Answer

Dynamic address group with a tag-based filter

Answer

Static address object with a single IP address

Answer

External Dynamic List (EDL) referencing a URL

Question 5

A network security administrator is configuring a security policy to allow access to a set of web servers. The servers are located in a dynamic environment where new instances are added frequently. The administrator wants to ensure that the policy automatically includes new web servers without manual updates. The administrator has created a dynamic address group named 'WebServers-DAG' with the filter 'WebServer'. Which additional configuration is required to ensure that the dynamic address group is populated correctly?

Accepted Answer

Ensure that each web server has a tag that matches the filter, such as 'WebServer', applied to its address object.. For a dynamic address group to automatically include members, the filter must match tags applied to address objects. The filter 'WebServer' will include any address object tagged with 'WebServer'. As new web servers are deployed, tagging their address objects with 'WebServer' ensures they are dynamically added to the group, allowing the security policy to automatically cover them without manual updates.

Answer

Create an address object for each web server and add them as static members to the dynamic address group.

Answer

Set the dynamic address group's filter to 'WebServer-*' to match tags that start with 'WebServer'.

Answer

Configure the dynamic address group to use an External Dynamic List (EDL) that contains the IP addresses of the web servers.

Question 6

An administrator is configuring a security policy and needs to reference a set of external servers that are frequently updated by a third-party service. The servers' IP addresses change often, and the administrator wants the firewall to automatically update the list without manual intervention. Which type of object should the administrator use?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List is designed to automatically retrieve and update lists of IP addresses, URLs, or domains from an external server. By configuring an EDL, the firewall periodically pulls the list and uses it in policy, ensuring that changes made by the third-party service are reflected without manual intervention. This is the most efficient and appropriate solution for dynamically changing IP lists.

Answer

FQDN address object

Answer

Static address group

Answer

Dynamic address group

Question 7

A security administrator is configuring an External Dynamic List (EDL) for IP addresses that will be used in a security policy to block malicious traffic. The EDL is hosted on an internal web server at https://edl.example.com/blocklist. The administrator wants to ensure that the firewall can retrieve the list and that it is updated every hour. Which configuration is required for the EDL to function correctly?

Accepted Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and ensure that the firewall can resolve the DNS name and has a route to the web server.. For an EDL to be retrieved, the firewall must be able to resolve the domain name and reach the server. The update interval is set in the EDL configuration. Certificate authentication is only needed if the server requires it and the firewall does not trust the certificate. Thus, ensuring DNS resolution and network connectivity is fundamental.

Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and ensure that the firewall has a valid certificate to authenticate to the web server.

Answer

Configure the EDL with source URL https://edl.example.com/blocklist, set the recurring update to hourly, and configure a custom URL category to include the EDL.

Answer

Configure the EDL with source URL http://edl.example.com/blocklist, set the recurring update to hourly, and add the EDL to a security policy as a source address.

Question 8

An administrator is creating a Dynamic Address Group (DAG) that should include all servers tagged with 'web' and 'prod'. The firewall is configured to use a VMware NSX-T service manager for tag registration. Which configuration is required to ensure the DAG is populated correctly?

Accepted Answer

Create an address group with type 'Dynamic' and a match filter that uses the tags 'web' and 'prod' with an 'and' operator.. To create a Dynamic Address Group that includes only servers with both 'web' and 'prod' tags, the administrator must configure the DAG with a match filter that uses the 'and' operator between the tags. This ensures that only addresses that have both tags are included. The DAG must also be linked to the NSX-T service manager as the source of tags, but the filter logic is critical for correct membership.

Answer

Create a Dynamic Address Group and configure it to use the 'Any' filter, then rely on NSX-T to push the correct IP addresses.

Answer

Create a Dynamic Address Group with a filter that uses the tags 'web' or 'prod' with an 'or' operator.

Answer

Create an address group with type 'Static' and manually add the IP addresses of the servers.

Question 9

An administrator is creating a new address object in PAN-OS and needs to ensure that the object can be used in security policies to match traffic from a specific subnet and also from a specific range of IP addresses within that subnet. Which two address object types should the administrator consider? (Choose two.)

Accepted Answer

IP Netmask. To match a specific subnet, the administrator should use an IP Netmask object, which defines a network and mask. To match a specific range of IP addresses within that subnet, an IP Range object is appropriate, as it allows a start and end IP. Both types can be referenced in security policies. The other types are either for domain names or dynamic membership, which do not fit the static requirements.

Answer

FQDN

Answer

Dynamic Address Group

Answer

IP Wildcard Mask

Question 10

An administrator needs to create an External Dynamic List (EDL) that contains a list of malicious IP addresses. The list is hosted on an internal web server at http://192.168.1.50/malicious.txt. The firewall must check for updates every hour. Which configuration is required?

Accepted Answer

Create an EDL object with type 'IP List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.. To create an External Dynamic List for malicious IP addresses hosted on an internal web server via HTTP, the administrator must configure an EDL of type 'IP List' with the correct source URL and set the check interval to 60 minutes. This ensures the firewall retrieves the list hourly, as required. The EDL can then be used in security policies to block traffic from those IP addresses.

Answer

Create an EDL object with type 'IP List', source URL 'https://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.

Answer

Create an EDL object with type 'Domain List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 60 minutes.

Answer

Create an EDL object with type 'IP List', source URL 'http://192.168.1.50/malicious.txt', and set the check interval to 5 minutes.

Question 11

An administrator is configuring a Dynamic Address Group (DAG) to automatically include all servers that have the tag 'WebServer'. The DAG will be used in a security policy. Which two of the following statements are true regarding the configuration and behavior of this DAG? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall must receive the tag information via an external source, such as a User-ID agent or a syslog listener.. Dynamic Address Groups are populated based on tags that are registered with the firewall. The two essential actions are: the firewall must receive tag information from an external source (like User-ID agent or syslog), and the DAG filter must reference those tags. Without both, the group will not be populated. Manual addition or DNS resolution are not part of the DAG mechanism.

Answer

The administrator must enable the 'Dynamic Group' option in the security policy rule.

Answer

The administrator must manually add each IP address as a static member of the DAG.

Answer

The firewall must be configured to resolve the IP addresses to hostnames via DNS.

Question 12

An administrator is creating an application filter to allow only specific applications while blocking others within a category. The administrator wants to ensure that the filter matches applications based on their risk level. Which attribute should the administrator use in the application filter?

Accepted Answer

Risk. The Risk attribute in an application filter allows matching applications based on their security risk level (1-5). This is the only attribute among the options that directly reflects risk. Using Risk, the administrator can create filters that include or exclude applications by risk, ensuring that only applications with acceptable risk levels are allowed.

Answer

Subcategory

Answer