PCNSA Managing Objects Practice Question
An administrator is configuring a security policy rule and needs to reference a service that uses both TCP port 80 and TCP port 443. The administrator wants to minimize the number of objects in the policy. What should the administrator create to achieve this?
⚠ Common exam trap
The trap here is thinking a single custom service object can define multiple ports, but in PAN-OS each service object only supports one protocol and one port range.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service group containing service-http and service-https.
A service group is designed to bundle multiple service objects for use in security policies. By creating a service group that contains service-http and service-https, the administrator can reference both ports with a single object. This minimizes the number of objects and simplifies policy management. Custom service objects cannot contain multiple ports, and address or application groups serve different purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An application group containing web-browsing and ssl.
Why it's wrong here
Application groups are used to group applications, not services. While web-browsing and ssl are applications that use ports 80 and 443, they are not service objects. Using an application group would change the policy to application-based, which might not be desired if the administrator specifically wants to match ports. The question asks for a service reference, so an application group is not appropriate.
- ✗
A custom service object with both ports defined.
Why it's wrong here
A single custom service object can only define one protocol and one port range. It cannot contain multiple ports like 80 and 443 simultaneously. To cover both ports, the administrator would need two separate service objects or a service group. Therefore, creating a custom service object with both ports is not possible in PAN-OS.
- ✓
A service group containing service-http and service-https.
Why this is correct
A service group allows bundling multiple service objects into a single reference. By creating a service group that includes service-http (TCP/80) and service-https (TCP/443), the administrator can use one object in the security policy. This reduces the number of objects and simplifies management. It is the most efficient way to represent multiple services in a single policy rule.
- ✗
An address group containing the server's IP address.
Why it's wrong here
An address group is used to group IP addresses or subnets, not services. It does not define ports or protocols. Referencing an address group in a security policy would specify the source or destination addresses, not the services. This does not fulfill the requirement to reference both TCP ports.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.