PCNSA Managing Objects Practice Question
An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume 'web-browsing' covers all HTTP traffic regardless of port, but Palo Alto Networks firewalls enforce application identification based on default port definitions, and non-standard ports require explicit configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application 'web-browsing' does not cover port 8080 traffic.
The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application 'web-browsing' does not cover port 8080 traffic.
Why this is correct
App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.
- ✗
The rule order is incorrect; a previous rule is denying the traffic.
Why it's wrong here
The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.
- ✗
The destination address object 10.10.0.0/16 is incorrect.
Why it's wrong here
The subnet appears correct for the data center.
- ✗
The source zone 'GP' should be 'untrust'.
Why it's wrong here
GlobalProtect typically uses a dedicated zone 'GP'.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?
hard- A.80
- ✓ B.443
- C.22
- D.8080
Why B: (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.
Variation 2. A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?
easy- A.22
- B.443
- C.8080
- ✓ D.80
Why D: The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.