NetSec-Analyst Object Configuration Creation And Application Practice Test 5 — 15 Questions

Question 1

Which components can be included in a 'Security Profile Group'? (Choose TWO)

Accepted Answer

Antivirus Profile. A Security Profile Group in PAN-OS is a container that bundles multiple security profiles so they can be applied together in a security policy rule, and it can include an Antivirus Profile (A) because antivirus scanning is one of the supported profile types that inspects traffic for malware. It can also include a Vulnerability Protection Profile (C), since IPS/vulnerability signatures are another supported profile type that the group aggregates. Tag Objects (B), Service Objects (D), and Address Objects (E) are match criteria or metadata used elsewhere in policy (tags for dynamic grouping, services for port/protocol matching, addresses for source/destination matching), not security profiles, so they cannot be members of a Security Profile Group.

Answer

Tag Object

Answer

Service Object

Answer

Address Object

Question 2

Which of the following are true regarding Dynamic Address Groups? (Choose TWO)

Accepted Answer

They do not require a commit to update membership. Option A is correct because Dynamic Address Groups (DAGs) in Palo Alto Networks firewalls use the Dynamic Address Group registration mechanism (via the User-ID agent or VM-Series plugin) to update group membership in real time without requiring a policy commit, since the tags are registered externally. Option C is correct because DAGs are populated by matching tags against tag-based filters (e.g., 'tag1' and 'tag2'), where the firewall dynamically includes any IP address whose registered tags satisfy the filter expression. Option B is incorrect because DAGs are automatically updated through tag registration, not manually maintained. Option D is incorrect because DAGs are not inherently slower than static groups; they are designed for dynamic environments and provide efficient, real-time membership updates. Option E is incorrect because DAGs support both IPv4 and IPv6 addresses, not IPv6 exclusively.

Answer

They must be manually updated

Answer

They are slower than static groups

Answer

They only support IPv6

Question 3

Which of the following are benefits of using Device Groups in SCM? (Choose THREE)

Accepted Answer

Inheritance of configuration. Device Groups in Palo Alto Networks Strata Cloud Manager (SCM) are hierarchical containers that let child folders/devices automatically receive settings defined at a parent level, so option B (Inheritance of configuration) is correct because policies, objects, and profiles flow down the hierarchy without being recreated per device. Option C (Shared object management) is correct because objects such as address objects, tags, and security profiles defined in a Device Group can be referenced by all member devices, eliminating duplicate definitions. Option E (Configuration modularity) is correct because Device Groups let you organize configuration into reusable, layered building blocks (for example, a baseline group plus site-specific groups) that can be mixed and matched across deployments. Option A (Local-only access) is not a benefit of Device Groups, since Device Groups are precisely a mechanism for centralized, hierarchical management rather than restricting configuration to a single local device. Option D (Automatic hardware replacement) is not a Device Groups feature; hardware replacement/RMA is handled through device onboarding and licensing workflows, not through Device Group membership.

Answer

Local-only access

Answer

Automatic hardware replacement

Question 4

Which elements are required when creating a new custom Service Object? (Choose THREE)

Accepted Answer

Protocol. When creating a custom Service Object, the Protocol (A) is required because the firewall must know which IP protocol (e.g., TCP, UDP, ICMP) the service uses to match traffic correctly. The Port (C) is required because a service object defines the destination port (or port range) that the protocol operates on, such as TCP/443. The Name (D) is required because every service object must have a unique identifier used to reference it in security policy rules. Tag (B) is optional metadata used for grouping or filtering objects and is not mandatory for creation. Description (E) is also optional documentation and is not required for the object to function.

Answer

Tag

Answer

Description

Question 5

What information can you see in the object list view in SCM? (Choose THREE)

Accepted Answer

Object Type. In the SCM (Strata Cloud Manager) object list view, each row displays the Object Type (option B), such as Address, Address Group, Service, or Application, so administrators can identify what kind of object they are managing. The Object Name (option C) is also shown, giving the unique identifier of each object for quick reference and selection. Assigned Tags (option E) appear in the list as well, allowing tag-based filtering and organization of objects across the tenant. Real-time traffic volume (option A) is not part of the object list view; that data belongs to monitoring or dashboard views, not object management. User password (option D) is never displayed in an object list, since credentials are not stored or shown as object attributes in SCM.

Answer

Real-time traffic volume

Answer

User password

Question 6

You are managing security policies in Strata Cloud Manager and need to create an Address Object that represents a subnet used by multiple regional offices. Which approach is best practice for organizational visibility?

Accepted Answer

Create an Address Object with a descriptive name and assign a tag for geographic identification.. Using tags allows for better filtering and reporting across large object sets.

Answer

Use an Address Group containing only one Address Object.

Answer

Assign the address to the 'Any' zone to ensure it is reachable.

Answer

Hardcode the IP address directly in the security policy rule.

Question 7

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

Accepted Answer

The IP address must have a tag associated with it via registration.. DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.

Answer

The interface must be configured as a DHCP server.

Answer

The IP address must be defined as a static Address Object.

Answer

The object must be added to a Service Group.

Question 8

You are migrating policies to Strata Cloud Manager. You notice that an Address Object is being used in a security policy, but the object is defined at the 'Device Group' level. What happens if you try to use this object in a policy at a higher hierarchy level?

Accepted Answer

The object will be unavailable for selection in the higher-level policy.. Objects defined at lower levels (Device Groups) are not visible to policies at higher levels (Global/Parent).

Answer

The policy will automatically push the object to the parent level.

Answer

The object will be converted to a local override.

Answer

The firewall will generate a shadow error during commit.

Question 9

When creating a custom Tag, which action is performed in the 'Objects' > 'Tags' menu?

Accepted Answer

Assigning a color to the tag for organizational visibility.. Tags are created with a name and an optional color for visual identification in the GUI.

Answer

Defining the source zone for the traffic.

Answer

Defining the TCP port range for the tag.

Answer

Associating the tag with a specific security profile.

Question 10

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Accepted Answer

They allow the use of port ranges, such as 1000-2000.. Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly. Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.

Answer

They automatically inherit tags from the policy rule they are applied to.

Answer

They are globally unique across all Device Groups.

Answer

They support the definition of both TCP and UDP ports in a single object.

Question 11

An administrator wants to group multiple existing FQDN Address Objects into a single logical container for easier policy management. Which object type should they use?

Accepted Answer

Static Address Group. Address Groups can contain FQDN objects to simplify policy rulebases.

Answer

Dynamic Address Group

Answer

Service Group

Answer

Region Object

Question 12

Which TWO of the following statements are true regarding the use of 'Address Groups' in PAN-OS?

Accepted Answer

You can include FQDN objects as members of a Static Address Group.. Option C is correct because a Static Address Group in PAN-OS can include FQDN objects as members, alongside IP addresses, IP ranges, and other address objects, allowing domain-based resolution to be referenced in policy. Option E is correct because Static Address Groups support nesting, meaning they can contain both IP addresses (via address objects) and other Address Groups as members. Option A is incorrect because Dynamic Address Groups use tags and match criteria evaluated against registered IP addresses, not manual member selection. Option B is incorrect because address groups can be referenced in both Source and Destination fields of a security policy. Option D is incorrect because address groups are optional; policies can reference individual address objects directly.

Answer

Dynamic Address Groups use manual member selection.

Answer

Address groups can only be used in the Source field of a policy.

Answer

Address groups are mandatory for all security policies.

Question 13

In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?

Accepted Answer

The firewall updates the object member list with all IPs returned during periodic refreshes.. The firewall periodically resolves the FQDN and maintains a list of all returned IPs in the object.

Answer

The firewall will block all traffic until a single IP is specified.

Answer

Only the first IP returned by the DNS server is stored.

Answer

The firewall converts the FQDN to a static object upon the first refresh.

Question 14

Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?

Accepted Answer

Configuring the VM-Series to monitor cloud provider metadata.. Option B is correct because the VM-Series can be configured with a cloud provider plugin (e.g., AWS, Azure, GCP) that polls the cloud metadata service to learn which IP addresses belong to instances carrying specific tags, and this information is used to populate Dynamic Address Groups. Option D is correct because the User-ID agent can register IP-to-tag mappings via the User-ID XML API, allowing tags to be associated with IP addresses and thereby populate Dynamic Address Groups. Option E is correct because the PAN-OS XML API exposes a 'register' operation (e.g., type=user-id, cmd=...) that directly registers tags to IP addresses for Dynamic Address Group membership. Option A is not a valid method because tags are not assigned to interfaces in the Network tab; interface configuration does not register tags to IP addresses for Dynamic Address Groups. Option C is not a valid method because custom App-ID creation identifies applications in traffic and does not register tags to IP addresses for Dynamic Address Group population.

Answer

Assigning the tag directly to the interface in the Network tab.

Answer

Creating a custom App-ID that identifies the traffic.

Question 15

A security administrator is building a URL Filtering profile in Strata Cloud Manager. The organization has a list of 40 marketing-related domains that must be allowed for the Marketing department, but these same domains should be blocked for all other departments. The administrator wants to reuse this list across multiple profiles without retyping the domains each time. Which object type should be created to satisfy this requirement?

Accepted Answer

A custom URL Category object containing the 40 domains, referenced by the URL Filtering profiles.. A custom URL Category object is the correct construct because it stores a reusable list of domains or URLs that URL Filtering profiles can reference. Because the profile applies the same category with different actions per department, centralizing the domain list avoids duplication and reduces the risk of inconsistent allow/block behavior across profiles.

Answer

A Dynamic Address Group with a tag-based filter matching the marketing domains.

Answer

An External Dynamic List (EDL) that pulls the domains from an HTTPS source.

Answer

A Service object with the domains entered as destination FQDN entries.