PCNSA Managing Objects Practice Question
An administrator needs to create an object that represents a set of subnets belonging to the same department, but the subnets are not contiguous. The object will be used in a security policy rule and must be updated automatically when new subnets are added in IP address management (IPAM). Which type of address object should the administrator use?
⚠ Common exam trap
The trap here is assuming that a static address group or IP range can represent multiple non-contiguous subnets and be automatically updated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic address group
A dynamic address group is designed to automatically include address objects based on tags, which can be updated by external systems like IPAM. This allows the group to reflect changes without manual intervention. For non-contiguous subnets that need automatic updates, this object type provides the necessary flexibility and integration, unlike static address objects that require manual maintenance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP Netmask address object
Why it's wrong here
An IP Netmask address object defines a single subnet using an IP address and netmask, such as 10.1.0.0/24. It cannot represent multiple non-contiguous subnets as a single object. While it can be used in policy rules, it does not support automatic updates from IPAM and would require manual creation of separate objects for each subnet, which is inefficient for this scenario.
- ✓
Dynamic address group
Why this is correct
A dynamic address group uses tags to automatically include address objects that match a filter. When new subnets are registered in IPAM and tagged appropriately, they can be dynamically added to the group. This meets the requirement for a non-contiguous set of subnets and automatic updates, making it the most efficient and scalable solution.
- ✗
IP Range address object
Why it's wrong here
An IP Range address object defines a contiguous range of IP addresses, such as 10.1.0.10-10.1.0.20. It is limited to a single continuous span and cannot include multiple non-contiguous subnets. It also lacks integration with external IPAM systems for automatic updates. Using this would require manual maintenance and would not accurately represent the department's subnets.
- ✗
FQDN address object
Why it's wrong here
An FQDN address object resolves a domain name to IP addresses and is used for resources identified by DNS names, not for static subnets. It does not represent multiple subnets and cannot be automatically updated from an IPAM system. This type is unsuitable because the requirement is to group subnets, not domain names, and dynamic updates from IPAM are not supported.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.