PCNSA Managing Objects — Timed 25 Questions

Question 1

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Accepted Answer

Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.. The 'Show Group Membership' feature in the Address Groups page allows you to view current members and add new address objects by clicking 'Add New Address'. Option E is correct: You can create a tag, assign it to the address object, and then add that tag to a dynamic address group, which automatically includes all objects with that tag. Option C is incorrect because the 'Add' button in the address group editor only allows selecting existing address objects; it does not allow typing an IP directly. Option B is incorrect because the CLI command is 'set address-group add ', not 'add ip '. Option D is incorrect because Panorama templates push configuration, not individual IP addresses directly into groups.

Answer

Execute 'set address-group add ip ' in CLI.

Answer

Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.

Answer

Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.

Question 2

An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?

Accepted Answer

The rule requires a separate application object. Even though the service group includes both TCP and UDP service objects for DNS (ports 53), the rule is not allowing TCP DNS because it lacks a matching application object. In Palo Alto Networks firewalls, App-ID is used to identify traffic based on application signatures, not just ports. If the security rule does not specify an application (e.g., 'dns'), or if the application is set to something that doesn't match DNS traffic, the rule may not allow the traffic. Option B is the most likely issue.

Answer

The service group includes only UDP service objects

Answer

The security policy action is set to deny

Answer

The service group is incorrectly configured

Question 3

Which THREE of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Accepted Answer

IP Range. IP Range, IP Netmask, and FQDN are all valid address object types in Palo Alto Networks. IP Range defines a contiguous set of IP addresses (e.g., 192.168.1.1-192.168.1.254), IP Netmask uses subnet mask notation (e.g., 192.168.1.0/24), and FQDN represents a fully qualified domain name (e.g., www.example.com). All three are valid address objects in PAN-OS.

Answer

MAC Address

Answer

URL Category

Question 4

A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?

Accepted Answer

Use the address group in a security policy and enable logging at session end in that policy.. The best choice because it allows the administrator to create a single security policy that uses the address group 'Medical-Servers' as the destination and enables logging at session end. By placing this policy as the last rule for that traffic, it will log any sessions to the group that are not already handled by previous policies. This reduces administrative overhead compared to modifying each existing policy individually. While this does not enforce logging on existing policies that already match traffic, it ensures that any traffic to the group is logged at least once. Other options have significant drawbacks: Option A would be ineffective if earlier rules match first; Option B requires manual application to each policy, increasing overhead; Option C does not directly enforce logging. Therefore, D is the most efficient approach to meet the compliance requirement.

Answer

Create a security policy with a log setting at the end of the rulebase that matches traffic to the group.

Answer

Configure a log forwarding profile and apply it to each policy using the group.

Answer

Use a policy optimizer to automatically add logging to policies.

Question 5

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Accepted Answer

Address object. To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Answer

Tag

Answer

Address group

Answer

Region

Question 6

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Accepted Answer

NAT address pool. A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Answer

External dynamic list

Answer

Service group

Answer

IPsec Crypto profile

Question 7

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Accepted Answer

Use an FQDN object in the address group; the firewall resolves it automatically. Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Answer

Use a region object instead

Answer

Create a dynamic address group with a tag-based filter

Answer

Manually add all possible IP addresses to an address group

Question 8

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Accepted Answer

Application object. Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Answer

Application filter

Answer

Application group

Answer

Service object

Question 9

Which TWO statements about External Dynamic Lists (EDLs) are true?

Accepted Answer

EDLs can be used in security policy source and destination fields.. External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Answer

EDLs have a fixed refresh interval that cannot be changed.

Answer

EDLs must be manually updated by an administrator.

Answer

EDLs allow the administrator to add individual IPs directly via the GUI.

Question 10

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Accepted Answer

The application 'web-browsing' does not cover port 8080 traffic.. The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Answer

The rule order is incorrect; a previous rule is denying the traffic.

Answer

The destination address object 10.10.0.0/16 is incorrect.

Answer

The source zone 'GP' should be 'untrust'.

Question 11

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

Accepted Answer

The filter should use double quotes instead of single quotes around the pattern.. In PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.

Answer

The filter should include a tag condition because dynamic groups require tags.

Answer

The dynamic address group cannot use name-based filters; it requires tags.

Answer

The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.

Question 12

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

Accepted Answer

Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.. Dynamic address groups with tag-based or name-based filters automatically include all matching objects, eliminating manual updates when new sites are added. By using a filter like 'Site-*-Networks', the group dynamically incorporates any address group whose name matches the pattern, reducing administrative overhead. This approach aligns with the PCNSA objective of using dynamic objects to simplify policy management in a scalable environment.

Answer

Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.

Answer

Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.

Answer

Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.

Question 13

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Configure IKE gateway, then IPsec crypto profile, then tunnel interface, then static route to tunnel interface, then security policy allowing VPN traffic.. IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.

Answer

Configure IPsec crypto profile, then IKE gateway, then tunnel interface, then static route, then security policy.

Answer

Configure IKE gateway, then IPsec crypto profile, then static route, then tunnel interface, then security policy.

Answer

Configure security policy, then IKE gateway, then IPsec crypto profile, then tunnel interface, then static route.

Question 14

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit. VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Answer

Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit

Answer

Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit

Answer

Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy

Question 15

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 16

Match each PAN-OS CLI command to its function.

Accepted Answer

show interface all: Displays all interfaces and their status.. Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Answer

show system info: Displays the forwarding information base (FIB) routes.

Answer

show route fib: Tests if a packet matches a security policy.

Question 17

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Accepted Answer

Address. To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Answer

Schedule

Answer

Service

Answer

Tag

Question 18

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Accepted Answer

The firewall automatically resolves the FQDN at commit and updates the group accordingly.. Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Answer

The administrator must manually update the address object's IP address.

Answer

Only if the address group is dynamic will the update occur automatically.

Answer

FQDN objects cannot be included in address groups.

Question 19

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Answer

Device groups

Answer

Shared policy

Answer

Template stacks

Question 20

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Accepted Answer

80. The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Answer

22

Answer

443

Answer

8080