PCNSA Device Management and Services Practice Question
A network administrator needs to ensure that firewall-generated traffic (e.g., NTP queries, DNS lookups, Panorama communications) uses a specific source IP address from a loopback interface. Which two configuration steps are required? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse service routes with interface-level settings or static routes, mistakenly thinking they need to configure a route to the loopback or enable a toggle on the loopback interface itself, rather than using the dedicated service route configuration under Device Setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service route configuration for each service type.
Service routes allow you to specify which source IP address the firewall uses for traffic it generates itself, such as NTP, DNS, and Panorama communications. Option C is correct because the actual configuration is performed under Device > Setup > Services > Service Route Configuration, where you can assign a specific source IP (e.g., from a loopback interface) for each service type. This ensures that firewall-originated traffic uses a consistent, routable source address independent of the egress interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define a static route on the firewall directing traffic to the loopback.
Why it's wrong here
Static routes are not required; the source is determined by service routes.
- ✓
Create a service route configuration for each service type.
Why this is correct
Service routes are required to override the default source interface for services.
- ✓
Set the source IP for each service under Device > Setup > Services > Service Route Configuration.
Why this is correct
This is where service routes are configured in the GUI.
- ✗
Configure the management interface IP as the source for all services.
Why it's wrong here
The management interface is only for management traffic; service routes are needed for other traffic.
- ✗
Enable 'Use Loopback as Source' under Network > Interfaces > Loopback.
Why it's wrong here
No such setting exists; source IP is configured via service routes.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.