mediumMultiple Choice
PCNSA Practice Question: An administrator is configuring a new Palo Alto…
An administrator is configuring a new Palo Alto Networks firewall and wants to ensure that management access to the firewall is secure. Which of the following is a best practice for securing management access?
⚠ Common exam trap
It's easy for candidates to think a strong password alone is sufficient for the default admin account, but Palo Alto Networks best practices explicitly recommend disabling or renaming the default admin to prevent credential-based attacks against a known username.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a dedicated management interface and restrict access to trusted IP addresses.
Using a dedicated management interface physically separates management traffic from data traffic, reducing the attack surface. Restricting access to trusted IP addresses via an access list ensures that only authorized hosts can reach the management plane, which is a foundational security best practice for any network device, including Palo Alto Networks firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the default admin account with a strong password.
Why it's wrong here
Leaving the default admin account enabled preserves a well-known username that attackers target directly; best practice is to disable it and create a named administrator with a strong password. Default accounts are relevant only during initial provisioning before a replacement administrative account exists.
- ✗
Allow HTTP access to the management interface for ease of use.
Why it's wrong here
HTTP transmits management credentials and session data in cleartext, so it fails the secure-access requirement outright; HTTPS is the supported management protocol. HTTP access is tempting for convenience during initial setup, but it should be disabled once HTTPS management is confirmed working.
- ✓
Use a dedicated management interface and restrict access to trusted IP addresses.
Why this is correct
A dedicated management interface separates control-plane traffic from data-plane traffic, so management sessions cannot be reached through production-facing ports. Restricting access to trusted IP addresses adds a second control, limiting which sources may even attempt authentication. Together these satisfy the stem's requirement for secure management access on the new firewall.
- ✗
Enable SNMP with read-write community strings for monitoring.
Why it's wrong here
Read-write SNMP community strings allow an attacker to alter device configuration and are sent unencrypted in SNMPv1/v2c; read-only SNMPv3 with authentication and privacy is the secure monitoring choice. Read-write access suits environments where a management platform must push configuration changes via SNMP.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.