PCNSA Device Management and Services Practice Question
An administrator wants to allow ping (ICMP) and SSH access on a data interface (e.g., ethernet1/1) for troubleshooting. Which configuration is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an interface management profile on ethernet1/1
Interface management profiles control which management services (ping, SSH, HTTP, etc.) are permitted on a data interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Management' profile on the VLAN interface
Why it's wrong here
A Management profile is applied to a Layer 3 interface to permit ping and SSH to the firewall itself; a VLAN interface is a Layer 2 construct and carries no such profile. It is tempting because the Management profile is exactly the mechanism that enables these services on an interface.
- ✓
Configure an interface management profile on ethernet1/1
Why this is correct
An interface management profile defines which management services, such as ping and SSH, are permitted on that specific data interface. Without it, management traffic is blocked by default on dataplane interfaces, so attaching the profile to ethernet1/1 is the required step to allow troubleshooting access.
- ✗
Create a security policy allowing ICMP and SSH inbound
Why it's wrong here
Security policies filter transit traffic passing through the firewall, not traffic terminating on the firewall's own interface; ICMP and SSH to the device are handled by the interface Management profile. It is tempting because security policies are the normal way to permit ICMP and SSH between zones.
- ✗
Enable the service route for ping and SSH
Why it's wrong here
Service routes direct management-plane traffic out of a specific interface; they do not permit ICMP or SSH to terminate on a data interface. It is tempting because service routes govern how the firewall reaches external services, which is the correct tool when you need management traffic to egress a particular interface.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.