PCNSA Managing Objects Practice Question
An administrator is creating a security policy and needs to reference multiple service objects for different applications. The administrator wants to group these services into a single object that can be used in the policy. Which TWO of the following statements are true about service groups in PAN-OS? (Choose two.)
⚠ Common exam trap
The trap here is assuming that any group object can contain any type of object; in PAN-OS, groups are type-specific and cannot mix object types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service group can contain other service groups, allowing for hierarchical grouping.
The two true statements are that a service group can contain both predefined and custom service objects, and that it can contain other service groups (nested groups). These capabilities provide flexibility in grouping services for policy use. The other options are false because service groups are restricted to service objects and cannot contain address objects or applications, nor can they be used in address fields.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service group can be used in the Source Address field of a security policy.
Why it's wrong here
Service groups are used in the Service/Application field of a security policy, not in the Source Address or Destination Address fields. The Source Address field expects address objects or address groups. Using a service group in the Source Address field would be invalid and the firewall would reject the configuration. Object types must match the field they are used in.
- ✓
A service group can contain other service groups, allowing for hierarchical grouping.
Why this is correct
PAN-OS supports nested service groups, meaning a service group can include other service groups as members. This enables hierarchical organization of services, which can be useful for large environments. However, excessive nesting can impact performance and manageability, so it should be used judiciously. This is a valid and supported configuration.
- ✗
A service group can contain applications, allowing for application-based filtering.
Why it's wrong here
Service groups contain service objects, which define protocol and port combinations. Applications are separate objects in PAN-OS and are referenced in the Application field of a security policy. Service groups cannot contain applications; that would mix different object types. Application-based filtering is done using application objects or application groups, not service groups.
- ✓
A service group can contain both predefined and custom service objects.
Why this is correct
Service groups in PAN-OS can include any combination of predefined and custom service objects. This flexibility allows administrators to group services like HTTP, HTTPS, and custom ports into a single object for policy use. This is a key feature for simplifying rule management, as it reduces the number of objects that need to be referenced individually in security policies.
- ✗
A service group can contain address objects to simplify policy creation.
Why it's wrong here
Service groups are specifically designed to contain service objects, not address objects. Address objects belong in address groups. Mixing object types is not allowed in PAN-OS; each group type is restricted to its corresponding object type. Therefore, a service group cannot contain address objects, and attempting to do so would result in a configuration error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.