PCNSA Managing Objects Practice Question
A security administrator is configuring an address object for a web server accessible from the internet. The server has a public IP of 203.0.113.10/32 and a private IP of 10.0.1.10/32. The administrator needs to create a security policy that allows inbound HTTPS traffic to the server. Which address object type should be used for the destination?
⚠ Common exam trap
Test-takers frequently confuse the private IP (used internally) with the public IP (used for inbound internet traffic), leading them to select an object type that references the private address, such as IP Range or FQDN, instead of the correct public IP Netmask.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP Netmask (e.g., 203.0.113.10/32)
The security policy destination must match the IP address that the firewall sees in the packet header. For inbound traffic from the internet, the destination IP is the public IP 203.0.113.10/32, so an IP Netmask object with that exact address is the appropriate type. Using a /32 netmask ensures a single host match, which is precise and efficient for firewall rule evaluation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FQDN (e.g., webserver.example.com)
Why it's wrong here
FQDN is dynamic and not recommended for inbound policies where the destination IP must be static.
- ✗
IP Range (e.g., 10.0.1.10-10.0.1.10)
Why it's wrong here
IP Range can define a single IP, but IP Netmask is more standard.
- ✗
IP Wildcard Mask (e.g., 203.0.113.0/0.0.0.255)
Why it's wrong here
Wildcard masks are used for complex address matching but are not the best practice for a single host.
- ✓
IP Netmask (e.g., 203.0.113.10/32)
Why this is correct
IP Netmask /32 is the correct and most efficient way to represent a single host.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.