PCNSA Managing Objects Practice Question
An administrator is creating a Dynamic Address Group (DAG) that should include all servers tagged with 'web' and 'prod'. The firewall is configured to use a VMware NSX-T service manager for tag registration. Which configuration is required to ensure the DAG is populated correctly?
⚠ Common exam trap
The trap here is using an 'or' operator instead of 'and', which would include servers with either tag rather than both, leading to a broader group than intended.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an address group with type 'Dynamic' and a match filter that uses the tags 'web' and 'prod' with an 'and' operator.
To create a Dynamic Address Group that includes only servers with both 'web' and 'prod' tags, the administrator must configure the DAG with a match filter that uses the 'and' operator between the tags. This ensures that only addresses that have both tags are included. The DAG must also be linked to the NSX-T service manager as the source of tags, but the filter logic is critical for correct membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an address group with type 'Dynamic' and a match filter that uses the tags 'web' and 'prod' with an 'and' operator.
Why this is correct
A Dynamic Address Group uses a match filter to include members based on tags. To include only servers that have both 'web' and 'prod' tags, the filter must use the 'and' operator, such as 'web' and 'prod'. This ensures that only addresses with both tags are included. The DAG must also be configured to use the appropriate source, such as the NSX-T service manager, but the filter is the key to correct membership.
- ✗
Create a Dynamic Address Group and configure it to use the 'Any' filter, then rely on NSX-T to push the correct IP addresses.
Why it's wrong here
Using an 'Any' filter would include all registered IP addresses from the NSX-T service manager, not just those with the specified tags. This would result in a DAG that contains far too many addresses, potentially allowing unintended traffic. The filter must be specific to the tags to achieve the desired membership.
- ✗
Create a Dynamic Address Group with a filter that uses the tags 'web' or 'prod' with an 'or' operator.
Why it's wrong here
Using an 'or' operator would include servers that have either 'web' or 'prod' tag, which is broader than required. The scenario specifies servers tagged with both 'web' and 'prod', so an 'or' filter would incorrectly include servers with only one of the tags. This would lead to overly permissive policies.
- ✗
Create an address group with type 'Static' and manually add the IP addresses of the servers.
Why it's wrong here
A Static Address Group requires manual addition of IP addresses or address objects. It does not support dynamic membership based on tags. Since the requirement is to use tags from NSX-T, a static group would not automatically update when tags change, defeating the purpose of dynamic grouping.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.