PCNSA Managing Objects Practice Question
An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?
⚠ Common exam trap
Test-takers frequently confuse dynamic address groups (which rely on tags and external data) with static address groups, or assume that a single subnet object can cover non-contiguous IPs, leading them to choose option A or C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an address group and a service group
Creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single address object with a subnet
Why it's wrong here
Using a subnet may include unintended IPs.
- ✗
Create separate rules for each server
Why it's wrong here
Inefficient and hard to maintain.
- ✗
Use a dynamic address group with tags
Why it's wrong here
Dynamic address groups are designed to automatically populate based on matching object properties, such as tags, but they cannot filter based on port numbers directly within the group's definition. While tempting because tags can be applied to servers, this method doesn't allow for the specific port 443 criterion needed to group servers for a security policy rule. This approach would be ideal if the requirement was to group servers based on a common characteristic like their role or environment, which could then be tagged.
- ✓
Create an address group and a service group
Why this is correct
This reduces administrative effort and groups related objects.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.