PCNSA Managing Objects Practice Question
A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?
⚠ Common exam trap
It's easy for candidates to confuse Custom URL Categories with EDLs, assuming a manually updated list can suffice for dynamic feeds, but the exam emphasizes that EDLs are the only object designed for automated, external-sourced updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
External Dynamic List (EDL)
An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
External Dynamic List (EDL)
Why this is correct
An External Dynamic List imports the vendor's hosted domain feed directly, so the firewall refreshes entries automatically each day. This satisfies the daily-update constraint without manual edits, unlike static address or URL category objects that require administrator intervention.
- ✗
Custom URL Category
Why it's wrong here
A Custom URL Category holds static domain entries that must be edited manually, so it cannot absorb a vendor feed updated daily without external automation. It is tempting because it blocks domains directly, but dynamic lists require an EDL or external dynamic list object instead.
- ✗
Address Group
Why it's wrong here
Address groups bundle IP addresses or other address objects, so they cannot hold domain names; the stem requires daily-updated malicious FQDN entries, which only an External Dynamic List retrieves from the vendor's feed. Address groups are tempting because they group static objects for policy referencing, and would be correct if the indicators were fixed IPs rather than domains.
- ✗
Application Filter
Why it's wrong here
Application Filters match on application characteristics such as category, risk, and behaviour, not on domain names, so they cannot enforce a vendor's domain list. They are tempting because they block traffic by application traits, which suits controlling applications rather than URL or domain indicators.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.