mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: An administrator is configuring a new Palo Alto…
An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?
⚠ Common exam trap
It's easy for candidates to think a strong password alone is sufficient for the default admin account, but Palo Alto Networks best practices explicitly recommend disabling or renaming the default admin to prevent credential-based attacks against a known username.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a dedicated management interface and restrict access to trusted IP addresses.
Using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the default admin account with a strong password.
Why it's wrong here
Best practice is to disable default accounts and create named accounts.
- ✗
Allow HTTP access to the management interface for ease of use.
Why it's wrong here
HTTP is unencrypted; HTTPS should be used.
- ✓
Use a dedicated management interface and restrict access to trusted IP addresses.
Why this is correct
This limits attack surface and is a best practice.
- ✗
Enable SNMP with read-write community strings for monitoring.
Why it's wrong here
Read-write SNMP is a security risk; use read-only if needed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.