PCNSA Device Group Practice Question
A security administrator is configuring Panorama to manage multiple firewalls. Which two actions are required to ensure that a firewall receives its configuration from Panorama? (Choose two.)
⚠ Common exam trap
The trap is that candidates often think that enabling Panorama Managed on the firewall is one of the required actions when configuring Panorama, or they confuse device groups with template stacks. The correct pair of actions from Panorama's perspective is adding the firewall to both a device group and a template stack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the firewall to a template stack.
To receive its full configuration from Panorama, a firewall must be added to both a device group and a template stack. The device group provides policy objects (e.g., security policies, address objects), while the template stack provides device settings (e.g., interfaces, zones). Enabling Panorama Managed on the firewall is a necessary step but is performed on the firewall, not as part of configuring Panorama. Committing the Panorama configuration pushes changes but does not establish the management association.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Commit the Panorama configuration.
Why it's wrong here
Committing the Panorama configuration pushes changes to managed firewalls but does not establish the management relationship.
- ✗
Create a local admin account on the firewall.
Why it's wrong here
Creating a local admin account is not needed; firewalls authenticate to Panorama using certificates or pre-shared keys.
- ✓
Add the firewall to a template stack.
Why this is correct
Correct: Adding a firewall to a template stack applies device-level configuration (interfaces, zones, etc.).
- ✓
Add the firewall to a device group.
Why this is correct
Correct: Adding a firewall to a device group applies shared policy objects (security policies, objects).
- ✗
Enable 'Panorama Managed' on the firewall.
Why it's wrong here
Enabling Panorama Managed is a prerequisite on the firewall itself, but the question asks for actions configuring Panorama, so this is not a Panorama action.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.