mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: Uses a Palo Alto Networks firewall to segment its…
An organization uses a Palo Alto Networks firewall to segment its network into three zones: Corp (10.0.1.0/24), Guest (10.0.2.0/24), and Mgmt (10.0.3.0/24). The firewall is running PAN-OS 10.0. The administrator wants to ensure that only devices from the Corp zone can access the management interface of the firewall via SSH from the internal network. The management interface is physically connected to the Mgmt network, and its IP is 10.0.3.1/24. A security policy must be configured to permit this access. Which approach should the administrator take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an interface management profile on the Mgmt interface that allows SSH only from the Corp subnet (10.0.1.0/24), and apply it to the management interface.
Management access to the firewall's control plane is controlled by Interface Management Profiles, not security policies. Security policies govern data plane traffic that passes through the firewall, not traffic destined to the firewall itself. Therefore, the correct method is to configure an Interface Management Profile on the Mgmt interface that permits SSH only from the Corp subnet (10.0.1.0/24) and apply it to the management interface. Option A incorrectly uses a security policy to control management access. Option B is incorrect because the built-in admin access control list is not the standard method; Interface Management Profiles are the proper way. Option C also misapplies security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a policy with source zone Corp, destination zone Mgmt, and service SSH. Ensure that the management interface is included as a destination in the policy.
Why it's wrong here
Security policies apply to data plane traffic passing through the firewall, not to management traffic destined to the firewall itself.
- ✗
Use the built-in admin access control list in firewall settings to permit SSH from Corp subnet, and disable all other management protocols.
Why it's wrong here
While there is an Admin Access List under Device > Setup > Management, it is not as granular as Interface Management Profiles, and the question emphasizes a security policy approach, which is not suitable. The best practice is to use Interface Management Profiles.
- ✗
Create a security policy with source zone Corp, destination zone Mgmt, and application SSH, and also create a static route to the Mgmt network.
Why it's wrong here
Security policies cannot manage traffic destined to the firewall; also, static routes are unnecessary for directly connected networks.
- ✓
Configure an interface management profile on the Mgmt interface that allows SSH only from the Corp subnet (10.0.1.0/24), and apply it to the management interface.
Why this is correct
Interface Management Profiles control which services and source IPs can access the firewall's management plane on a per-interface basis; this is the correct method.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.