PCNSA Managing Objects Practice Question
A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a single address object with IP subnet 192.168.10.0/24.
Directly uses the subnet as an address object, which is efficient for a contiguous subnet. Option D uses a dynamic address group with tags, allowing flexible grouping without manual updates. Option A creates an address group with individual objects, which is less efficient for a subnet. Option B uses an IP range, which is less efficient than CIDR notation. Option E refers to a non-existent feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an address group and add individual address objects for each server IP.
Why it's wrong here
This is manual and not efficient; it requires creating and managing many objects.
- ✗
Create a single address object with IP range 192.168.10.1-192.168.10.254.
Why it's wrong here
An IP range object (192.168.10.1-192.168.10.254) does not represent the subnet 192.168.10.0/24 as a single logical entity; it enumerates 254 individual host addresses, so any policy referencing this object will not automatically include the network address (.0) or broadcast address (.255), and the firewall cannot apply subnet-level operations such as route summarisation or dynamic updates if the subnet mask changes. This option is tempting because an IP range is a valid address object type in Palo Alto firewalls, and for a contiguous block of hosts that does not require subnet-awareness—such as a static list of DHCP-assigned printers—a range object would be the correct, efficient choice.
- ✓
Create a single address object with IP subnet 192.168.10.0/24.
Why this is correct
A subnet address object directly represents the entire subnet and is the most efficient method.
- ✓
Create a dynamic address group using tags applied to individual address objects.
Why this is correct
Tags allow dynamic grouping; adding tags to address objects automatically populates the group, providing flexibility.
- ✗
Create a predefined address object from the global cache.
Why it's wrong here
There is no 'predefined address object from global cache' concept in Palo Alto firewalls.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.