PCNSA Device Management and Services Practice Question
An administrator is configuring a Palo Alto Networks firewall to send SNMP traps to a monitoring server at 10.1.1.50. The administrator has already configured the SNMP community string under Device > Setup > Operations > SNMP Setup. Which two additional configurations are required to ensure traps are sent successfully? (Choose two.)
⚠ Common exam trap
The trap here is thinking that security policy or permitted IP lists control outbound SNMP traps, when they actually govern inbound polling or dataplane traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an SNMP trap destination under Device > Setup > Operations > SNMP Setup, specifying the server IP 10.1.1.50 and the community string.
To send SNMP traps, the firewall must have a trap destination configured with the server IP and community string. Additionally, a service route for SNMP may be needed if the default management interface cannot reach the server. Security policy rules and management interface permitted IPs do not affect outbound traps, and SNMPv3 is optional. Thus, the trap destination and service route are the required configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure an SNMP trap destination under Device > Setup > Operations > SNMP Setup, specifying the server IP 10.1.1.50 and the community string.
Why this is correct
SNMP trap destinations must be explicitly defined under Device > Setup > Operations > SNMP Setup. The trap destination includes the server IP address and the community string. Without this, the firewall will not know where to send traps, even if the community string is configured for polling. This is a required step to enable trap delivery to the monitoring server.
- ✓
Configure a service route for SNMP under Device > Setup > Services > Service Route Configuration to use an interface that can reach 10.1.1.50.
Why this is correct
Service routes control which interface and source IP the firewall uses for outbound SNMP traffic, including traps. By default, SNMP uses the management interface. If the management interface cannot reach the monitoring server, a custom service route must be configured for SNMP to use an appropriate dataplane interface. This ensures traps are routed correctly to 10.1.1.50.
- ✗
Enable SNMPv3 and configure a user with authentication and encryption, because SNMPv2c traps are not supported.
Why it's wrong here
SNMPv2c traps are supported on Palo Alto Networks firewalls; SNMPv3 is optional for enhanced security. While SNMPv3 provides authentication and encryption, it is not a requirement for sending traps. The question specifies that the community string is already configured, which implies SNMPv2c is in use, so enabling SNMPv3 is not necessary and would not be a required step.
- ✗
Create a security policy rule allowing SNMP traffic from the firewall to the monitoring server on UDP port 162.
Why it's wrong here
SNMP traps are generated by the firewall's management plane, not the dataplane, and are not subject to security policy. Security policy rules apply to traffic traversing the firewall, not to firewall-originated management traffic. Therefore, this rule is unnecessary and would not affect trap delivery.
- ✗
Add the monitoring server's IP address to the management interface's permitted IP list for SNMP.
Why it's wrong here
The management interface's permitted IP list controls which hosts can poll the firewall via SNMP, not where the firewall sends traps. Since the firewall is initiating traps to the server, the server's IP does not need to be in the permitted list. This configuration would be relevant for inbound SNMP polling but not for outbound trap delivery.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.