PCNSA Managing Objects Practice Question
An administrator needs to ensure that a security policy rule only allows traffic to a specific destination FQDN that resolves to multiple IP addresses, and the IP addresses change frequently. The administrator wants the firewall to automatically update the IP addresses without manual intervention. Which object type should the administrator use?
⚠ Common exam trap
Many exam-takers confuse dynamic address groups with FQDN address objects, as both can handle dynamic IPs but rely on different mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FQDN address object
An FQDN address object is designed to resolve a domain name to its IP addresses and update them automatically as DNS records change. This provides dynamic IP address tracking without manual intervention. The other options either require manual updates or use different mechanisms that do not directly resolve FQDNs. Thus, the FQDN address object is the correct solution for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
FQDN address object
Why this is correct
An FQDN address object resolves the domain name to IP addresses and automatically updates the IP addresses when DNS changes. This meets the requirement of automatic updates without manual intervention. It is the correct choice for dynamic IP addresses associated with a domain name. The firewall periodically performs DNS resolution to keep the object current.
- ✗
Dynamic address group with a tag-based filter
Why it's wrong here
A dynamic address group uses tags to group registered IP addresses, but it does not resolve FQDNs. It relies on tags applied by other processes, such as User-ID or external sources. This would not automatically track the IP addresses of a domain name. Therefore, it does not meet the requirement.
- ✗
Static address object with a single IP address
Why it's wrong here
A static address object uses a fixed IP address that does not change automatically. If the IP addresses of the FQDN change, the administrator would need to manually update the object. This fails the requirement for automatic updates. Static objects are not suitable for dynamic FQDN resolution.
- ✗
External Dynamic List (EDL) referencing a URL
Why it's wrong here
An External Dynamic List imports IP addresses from an external server, but it requires the administrator to host a list at a URL. It does not automatically resolve an FQDN to its current IP addresses. The EDL must be manually updated or scripted to reflect DNS changes. This adds complexity and does not directly use DNS resolution.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.