PCNSA Device Management and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Panorama

  Why this is correct

  Panorama provides centralised policy and device management for multiple Palo Alto firewalls, satisfying the requirement to manage them centrally. It pushes shared policies, objects and software updates from one console, unlike managing each firewall individually via its own web interface. This directly meets the stem's multi-firewall central management constraint.

• ✗

  Use CLI scripts

  Why it's wrong here

  CLI scripts push configuration device by device and hold no shared policy repository, so changes do not propagate consistently across the firewall estate. Scripting is tempting for one-off or bulk provisioning tasks, but centralised management requires Panorama, which maintains a single policy and pushes it to managed firewalls.

• ✗

  Use a dedicated management server

  Why it's wrong here

  A dedicated management server is not the Panorama architecture; Panorama itself is the central management platform that aggregates firewalls into device groups and templates. The phrase is tempting because it sounds like centralised control, but Panorama provides the policy repository and push mechanism this scenario needs.

• ✗

  Use SNMP

  Why it's wrong here

  SNMP only polls and traps monitoring data such as interface statistics and health; it cannot push security policy, objects, or commits to firewalls. It is tempting because it is a standard centralised monitoring protocol, but configuration management across multiple firewalls requires Panorama, not an SNMP manager.

Go deeper

Related to this question