PCNSA Managing Objects Practice Question
An administrator is configuring a security policy rule that must allow access to a web server hosted at www.example.com. The web server's IP address changes frequently due to a content delivery network (CDN). The administrator wants the firewall to automatically update the IP address used in the rule without manual intervention. Which type of address object should be used?
⚠ Common exam trap
Test-takers frequently confuse dynamic address groups with FQDN objects; dynamic groups require external tag registration and do not perform DNS resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FQDN address object
An FQDN address object is designed to resolve a domain name to IP addresses and can be configured to refresh at specified intervals. This enables the firewall to automatically update the object with the current IPs, ensuring security policies remain effective even when the web server's IP changes. For a CDN-hosted server, this provides the necessary automation without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP Range address object
Why it's wrong here
An IP Range address object defines a static range of IP addresses. It does not resolve domain names or update dynamically. If the CDN's IP addresses fall outside the configured range, the policy would not match. Manual updates would be needed, defeating the purpose of automation. This type is unsuitable for scenarios where IP addresses change frequently and are not known in advance.
- ✓
FQDN address object
Why this is correct
An FQDN address object resolves a domain name to IP addresses and can be configured with a refresh interval. The firewall periodically queries DNS and updates the object with the current IP addresses. This allows security policies to automatically adapt to IP changes, such as those from a CDN, without manual updates. It is the appropriate choice for dynamically changing IP addresses tied to a domain name.
- ✗
Dynamic address group
Why it's wrong here
A dynamic address group uses tags to include address objects, but it does not resolve domain names. It relies on external systems to register IP addresses with tags. While it can be dynamic, it requires additional infrastructure and does not inherently handle DNS resolution. For a CDN with frequently changing IPs, this would require custom integration to update tags, which is not as straightforward as an FQDN object.
- ✗
IP Netmask address object
Why it's wrong here
An IP Netmask address object is static and requires manual entry of a subnet. It cannot automatically update when the web server's IP changes. Using this would require frequent manual edits to the security policy, which is error-prone and not scalable. It does not integrate with DNS and therefore cannot track the dynamic IPs of a CDN-hosted web server.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.