Palo Alto Networks EDL Not Updating: Cache Time Issue
An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?
Quick Answer
The answer is that the EDL cache time is set higher than the refresh interval. This occurs because the firewall’s cache time dictates how long it holds a downloaded list before requesting a fresh copy from the server; if the cache time is configured to 10 minutes while the server updates every 5 minutes, the firewall will not poll for the new list until its local cache expires, causing it to serve stale data. On the Palo Alto Networks PCNSA exam, this scenario tests your understanding of how External Dynamic List (EDL) cache time and refresh intervals interact—a common trap is assuming the firewall checks the server at the same rate the server updates, when in reality the cache time overrides that frequency. A helpful memory tip is to think of the cache time as a “stale buffer”: if it’s longer than the server’s update cycle, the firewall is always one refresh behind.
⚠ Common exam trap
Many candidates assume the issue is with connectivity or registration (options A, B, or C), but the real cause is a misalignment between the firewall's cache time and the server's update frequency, which is a subtle but critical configuration detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EDL cache time is set higher than the refresh interval
The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EDL URL is invalid
Why it's wrong here
An invalid URL would prevent retrieval entirely.
- ✗
The EDL is not registered as a dynamic list
Why it's wrong here
If not registered, the firewall would not attempt to retrieve it.
- ✗
The firewall's DNS resolution fails
Why it's wrong here
DNS failure would cause an error, not stale data.
- ✓
The EDL cache time is set higher than the refresh interval
Why this is correct
The cache time instructs the firewall to keep the old list until it expires.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?
hard- A.Device groups
- B.Shared policy
- C.Template stacks
- ✓ D.External Dynamic Lists
Why D: External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.