PCNSA Managing Objects Practice Question
A network security administrator is configuring a security policy to allow access to a set of web servers. The servers are located in a dynamic environment where new instances are added frequently. The administrator wants to ensure that the policy automatically includes new web servers without manual updates. The administrator has created a dynamic address group named 'WebServers-DAG' with the filter 'WebServer'. Which additional configuration is required to ensure that the dynamic address group is populated correctly?
⚠ Common exam trap
The trap here is assuming that dynamic address groups can be populated by static members or EDLs, when in fact they rely exclusively on tags matching the filter expression.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that each web server has a tag that matches the filter, such as 'WebServer', applied to its address object.
For a dynamic address group to automatically include members, the filter must match tags applied to address objects. The filter 'WebServer' will include any address object tagged with 'WebServer'. As new web servers are deployed, tagging their address objects with 'WebServer' ensures they are dynamically added to the group, allowing the security policy to automatically cover them without manual updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that each web server has a tag that matches the filter, such as 'WebServer', applied to its address object.
Why this is correct
Dynamic address groups use tags to determine membership. The filter 'WebServer' will match any address object that has the tag 'WebServer'. Therefore, each web server must have an address object with that tag. When new servers are added and tagged appropriately, they are automatically included in the group without manual intervention.
- ✗
Create an address object for each web server and add them as static members to the dynamic address group.
Why it's wrong here
Dynamic address groups are populated based on tags, not static members. Adding static members defeats the purpose of dynamic grouping and does not allow automatic updates when new servers are added. The filter 'WebServer' expects tags to match, so static members would not be considered by the filter.
- ✗
Set the dynamic address group's filter to 'WebServer-*' to match tags that start with 'WebServer'.
Why it's wrong here
The filter 'WebServer-*' uses a wildcard to match tags that begin with 'WebServer-', but the requirement is to match the exact tag 'WebServer'. Using a wildcard would not match the tag 'WebServer' because it expects a hyphen after 'WebServer'. The correct filter is simply 'WebServer' to match the exact tag.
- ✗
Configure the dynamic address group to use an External Dynamic List (EDL) that contains the IP addresses of the web servers.
Why it's wrong here
External Dynamic Lists are used to import IP addresses or domains from an external source, but they are not used to populate dynamic address groups based on tags. While EDLs can be used in policies, they do not automatically add members to a dynamic address group. The filter mechanism is tag-based, not EDL-based.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.