NetSec-Analyst Object Configuration Creation And Application Practice Test 6 — 15 Questions

Question 1

An engineer is creating a new Security Policy rule in Strata Cloud Manager that must allow outbound traffic only to a specific external SaaS provider whose IP ranges change frequently. The provider publishes a public HTTPS feed of its current IP ranges. The engineer wants the rule to automatically stay current without manual edits. Which object configuration best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an External Dynamic List (EDL) pointing to the provider's HTTPS feed and reference it as the destination in the rule.. An External Dynamic List is the correct configuration because it pulls the provider's published IP ranges from an HTTPS feed on a refresh schedule and can be referenced directly as the destination in a Security Policy rule. This keeps the rule aligned with the provider's current ranges automatically, eliminating the manual updates and staleness that a static object would introduce.

Answer

Create a Dynamic Address Group with a filter matching tags applied to the provider's IP addresses.

Answer

Create a Service object referencing the provider's domain and use it as the destination in the rule.

Answer

Create a static Address Object containing the provider's current IP ranges and update it manually each quarter.

Question 2

A network security analyst is onboarding a new Palo Alto Networks firewall managed by Panorama. The security team wants to block outbound access to a known command-and-control (C2) domain used by a recent malware campaign. The domain resolves to multiple, frequently changing IP addresses. Which object type should the analyst create to reliably enforce this block in a Security Policy rule?

Accepted Answer

FQDN Address Object. Because the malicious destination is identified by a domain name whose IP addresses change over time, an FQDN Address Object is the appropriate construct. It resolves the domain and refreshes the associated IP addresses, so a Security Policy rule referencing it continues to block the C2 traffic without manual intervention. Static and service objects cannot track resolution changes.

Answer

Dynamic Address Group

Answer

Service Object

Answer

Static Address Object

Question 3

An analyst is building a new Security Policy rule set for a data center firewall. Several rules need to reference the same set of ten web server IP addresses in the DMZ. Rather than entering all ten IPs into every rule individually, the analyst wants a single reusable object that contains all of them. Which object type should the analyst create?

Accepted Answer

Address Group. An Address Group is the correct construct because it holds multiple Address Objects and can be referenced as a single entity in Security Policy rules. Creating one group for the ten DMZ web servers means future changes, such as adding or removing a server, require editing only the group rather than every rule, which reduces error and administrative overhead.

Answer

External Dynamic List

Answer

Service Group

Answer

Application Group

Question 4

A network security analyst is configuring an object in Strata Cloud Manager (SCM) to represent a partner company's web portal that is reachable at portal.example.com and resolves to several changing public IP addresses. The analyst wants the security policy to remain valid even when the partner rotates its DNS records. Which object type should the analyst create to satisfy this requirement?

Accepted Answer

FQDN Address object. An FQDN Address object is the right fit because it resolves a hostname to IP addresses at policy evaluation time, so DNS changes by the partner are absorbed automatically. Static address types and tag-driven dynamic groups do not perform DNS resolution, meaning they would require manual updates and could break the security policy when the partner's records change.

Answer

Dynamic Address Group with a tag filter

Answer

Static Address Group containing the current IP addresses

Answer

IP Netmask Address object

Question 5

A security analyst is configuring a firewall to allow a custom line-of-business application that communicates on TCP ports 8443 and 9443. The application vendor also uses UDP port 500 for keepalive traffic. The analyst wants a single reusable object that represents all of these port and protocol combinations so the same object can be referenced in multiple Security Policy rules. Which object type should the analyst create?

Accepted Answer

A Service Group containing separate Service Objects for TCP/8443, TCP/9443, and UDP/500. Because the application uses multiple protocol and port combinations, the analyst needs individual Service Objects for each pair, then a Service Group to combine them into one reusable reference. This allows a single object to be attached to multiple Security Policy rules while still covering TCP/8443, TCP/9443, and UDP/500, keeping the rule set clean and consistent.

Answer

An Application Group containing the vendor application signature

Answer

An Address Group containing the application server IP addresses

Answer

A single Service Object defining TCP/8443 only

Question 6

A security analyst is creating a new Address Object for a server that will be referenced by several security policies. The server's IP address is 10.20.30.40 and it belongs to the subnet 10.20.30.0/24. The analyst wants the object to represent only this single host, not the entire subnet. Which object type should the analyst select in the SCM object configuration?

Accepted Answer

IP Address. An IP Address object represents a single host and is the appropriate selection when a policy must reference only 10.20.30.40. Other address object types such as IP Netmask, IP Range, or IP Wildcard are designed for multiple addresses or patterns, which would broaden the match and potentially allow unintended traffic. Using the single-host object keeps the rule precise and maintainable.

Answer

IP Range

Answer

IP Wildcard

Answer

IP Netmask

Question 7

A NetSec-Analyst is configuring a new Security Policy rule to allow outbound access to a partner's web server. The partner has provided a hostname but warns that the IP address may change without notice. The analyst wants the policy to keep working if the IP changes. Which object type should the analyst use for the destination?

Accepted Answer

FQDN Address Object. The requirement is to follow a hostname whose IP may change. An FQDN Address Object performs DNS resolution and updates the resolved IP, allowing the policy to remain valid without manual intervention. Static objects, groups, and region objects do not provide hostname-based dynamic resolution.

Answer

Static Address Object

Answer

Address Group

Answer

Region Object

Question 8

While building a security policy in Strata Cloud Manager, an analyst selects the destination field and finds that the required Address object does not yet exist. The analyst wants to create the Address object without leaving the policy rule editor. What is the correct action?

Accepted Answer

Use the inline Create New option in the destination object selector to define and save the Address object.. The policy rule editor in Strata Cloud Manager supports inline object creation through the Create New option in the object selector. Selecting it opens a form where the analyst defines the Address object, saves it, and the object is instantly selectable in the policy. This avoids leaving the editor and preserves unsaved policy changes.

Answer

Create the object in a separate browser tab, refresh the policy editor, then select the new object.

Answer

Type the raw IP address directly into the destination field and save the policy; the object is created automatically.

Answer

Close the policy editor, navigate to Objects > Addresses, create the object, then reopen the policy.

Question 9

A security analyst is creating a new static Address Object on a Palo Alto Networks firewall to represent a partner company's web server at 203.0.113.45/32. The analyst must complete the required fields correctly for the object to commit and function in policy. Which two elements are required when defining this static Address Object? (Choose two.)

Accepted Answer

The IP address or subnet value. A static Address Object fundamentally needs two things: a unique name so it can be referenced unambiguously, and the IP address or subnet value that the firewall will match. Tags, descriptions, and DNS associations are optional attributes that enhance management or apply to other object types but are not required to create or use this object.

Answer

A tag assignment for the object

Answer

A description field entry

Answer

A DNS server association

Question 10

An analyst is registering a new firewall in Strata Cloud Manager (SCM) and needs to create a Security Zone object that is restricted to the 'internet' and 'dmz' interfaces only, so that later Security Policy rules can reference it. Which object type should the analyst create to meet this requirement?

Accepted Answer

Security Zone object with the internet and dmz interfaces assigned to it.. A Security Zone object is the only object type in SCM that inherently groups interfaces into a logical unit that policy rules can reference. Address, Service, and Application Filter objects operate on IPs, ports, or application signatures respectively and cannot represent interface membership. Creating a zone object with the two interfaces assigned gives the analyst a reusable, interface-aware reference for subsequent policy configuration.

Answer

Service object that lists the ports used by the internet and dmz interfaces.

Answer

Address Group containing the IP addresses of the internet and dmz interfaces.

Answer

Application Filter object matching applications commonly seen on internet and dmz links.

Question 11

A NetSec-Analyst is creating a new custom Application Object to identify a proprietary internal application that uses TCP port 8443 and a specific URL pattern. The analyst wants the firewall to correctly match and control this application. Which two configuration elements are required when defining this custom Application Object? (Choose two.)

Accepted Answer

A unique application name and category. A custom Application Object must have a unique name and category for identification and organization, and it must include at least one signature or pattern that defines the traffic. The other elements are enforced elsewhere or are optional, so they are not required for the object definition.

Answer

A timeout value for session expiration

Answer

A default action of allow or deny

Answer

An associated security profile group

Question 12

An administrator is creating a new Address Object for a web server that has a hostname 'web01.example.com'. The administrator wants the firewall to resolve this hostname to an IP address dynamically. Which Address Object type should be used?

Accepted Answer

FQDN. To resolve a hostname dynamically, an FQDN Address Object is required. It performs DNS lookups and updates the IP address automatically. IP Netmask, IP Range, and Dynamic Address Group do not provide hostname resolution. The FQDN type is specifically designed for this purpose, ensuring that policies always use the current IP of the named host.

Answer

Dynamic Address Group

Answer

IP Netmask

Answer

IP Range

Question 13

A security administrator needs to create a new Service Object for a custom application that uses TCP port 8443. The administrator wants to ensure the object can be used in a security policy immediately. Which object type should be created?

Accepted Answer

Service Object with protocol TCP and destination port 8443. A Service Object is the correct construct for defining a custom TCP port. It specifies the protocol and port, and can be directly referenced in security policies. The other options either represent different object types or incorrectly combine services, and none provide the precise TCP/8443 definition required.

Answer

Application Filter

Answer

Service Group containing TCP/443 and TCP/8443

Answer

Address Object with the server's IP address and port 8443

Question 14

An analyst is reviewing a security policy that references an Address object named Web-Server-Prod. A change request requires updating the object to a new IP address, but the object is referenced by multiple policies across several folders in Strata Cloud Manager. The analyst wants the change to take effect everywhere with minimal effort. What should the analyst do?

Accepted Answer

Edit the Web-Server-Prod object's IP address value; all policies referencing it inherit the update.. Because policies reference Address objects by name, editing the object's IP value automatically updates every rule that references it, regardless of folder. This is the primary advantage of object-based configuration: a single edit propagates consistently and eliminates the need to touch each policy, reducing effort and the chance of configuration drift.

Answer

Delete Web-Server-Prod and create a new object with the new IP, then update each policy manually.

Answer

Create a new Address object with the new IP and add it as a second destination in each policy.

Answer

Convert Web-Server-Prod into a Dynamic Address Group so it updates automatically.

Question 15

A security analyst manages a firewall through Panorama. The analyst deletes a Service Object that defines TCP/8080, but a Security Policy rule still references it. The analyst then attempts to push the configuration. What is the most likely outcome when the commit is validated?

Accepted Answer

The commit fails validation because the policy references a non-existent object. Security Policy rules depend on the objects they reference. When a referenced Service Object is deleted, the rule contains a dangling reference, and commit validation rejects the configuration because it cannot be resolved into a valid rule. The analyst must restore the object, remove the reference, or substitute a valid one before the push can succeed.

Answer

The rule is automatically disabled but the rest of the commit completes successfully

Answer

The commit succeeds and the rule silently ignores the missing object, allowing all ports

Answer

The firewall automatically recreates the deleted Service Object with default values