- A
Define a static route on the firewall directing traffic to the loopback.
Why wrong: Static routes are not required; the source is determined by service routes.
- B
Create a service route configuration for each service type.
Service routes are required to override the default source interface for services.
- C
Set the source IP for each service under Device > Setup > Services > Service Route Configuration.
This is where service routes are configured in the GUI.
- D
Configure the management interface IP as the source for all services.
Why wrong: The management interface is only for management traffic; service routes are needed for other traffic.
- E
Enable 'Use Loopback as Source' under Network > Interfaces > Loopback.
Why wrong: No such setting exists; source IP is configured via service routes.
Quick Answer
The correct answer involves two steps: configuring a loopback interface with the desired IP address and then setting that IP as the source for each service under Device > Setup > Services > Service Route Configuration. This works because service routes decouple the source IP of firewall-generated traffic from the egress interface, allowing you to assign a stable, routable loopback address for services like NTP, DNS, and Panorama communications. On the PCNSA exam, this topic tests your understanding of how to control outbound traffic from the firewall itself, often appearing in scenario-based questions where a consistent source IP is needed for logging or routing policy. A common trap is confusing interface management IPs with service routes—remember that service routes override the default source IP on a per-service basis. Memory tip: think of service routes as a “sticky address” for each service, ensuring your firewall’s own traffic always leaves with the same loopback source, regardless of which physical interface it uses.
PCNSA Device Management and Services Practice Question
This PCNSA practice question tests your understanding of device management and services. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator needs to ensure that firewall-generated traffic (e.g., NTP queries, DNS lookups, Panorama communications) uses a specific source IP address from a loopback interface. Which two configuration steps are required? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Create a service route configuration for each service type.
Option B is correct because service routes allow you to specify which source IP address the firewall uses for traffic it generates itself, such as NTP, DNS, and Panorama communications. Option C is correct because the actual configuration is performed under Device > Setup > Services > Service Route Configuration, where you can assign a specific source IP (e.g., from a loopback interface) for each service type. This ensures that firewall-originated traffic uses a consistent, routable source address independent of the egress interface.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define a static route on the firewall directing traffic to the loopback.
Why it's wrong here
Static routes are not required; the source is determined by service routes.
- ✓
Create a service route configuration for each service type.
Why this is correct
Service routes are required to override the default source interface for services.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
Set the source IP for each service under Device > Setup > Services > Service Route Configuration.
Why this is correct
This is where service routes are configured in the GUI.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Configure the management interface IP as the source for all services.
Why it's wrong here
The management interface is only for management traffic; service routes are needed for other traffic.
- ✗
Enable 'Use Loopback as Source' under Network > Interfaces > Loopback.
Why it's wrong here
No such setting exists; source IP is configured via service routes.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse service routes with interface-level settings or static routes, mistakenly thinking they need to configure a route to the loopback or enable a toggle on the loopback interface itself, rather than using the dedicated service route configuration under Device Setup.
Detailed technical explanation
How to think about this question
Service route configuration works by creating a policy-based routing entry in the firewall's internal routing table for locally generated packets. Each service (e.g., NTP using UDP 123, DNS using UDP 53) can be assigned a specific source IP and egress interface, overriding the default behavior of using the egress interface's IP. This is critical in multi-VR (Virtual Router) environments where the firewall must source traffic from a specific loopback to ensure return traffic is routed correctly, especially when using BGP or OSPF to advertise the loopback IP.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Device Management and Services — study guide chapter
Learn the concepts, then practise the questions
- →
Device Management and Services practice questions
Targeted practice on this topic area only
- →
All PCNSA questions
524 questions across all exam domains
- →
Palo Alto Networks Certified Network Security Administrator PCNSA study guide
Full concept coverage aligned to exam objectives
- →
PCNSA practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PCNSA practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Managing Objects practice questions
Practise PCNSA questions linked to Managing Objects.
Policy Evaluation and Management practice questions
Practise PCNSA questions linked to Policy Evaluation and Management.
Securing Traffic practice questions
Practise PCNSA questions linked to Securing Traffic.
Core Concepts practice questions
Practise PCNSA questions linked to Core Concepts.
Palo Alto Networks Platforms and Architecture practice questions
Practise PCNSA questions linked to Palo Alto Networks Platforms and Architecture.
Device Management and Services practice questions
Practise PCNSA questions linked to Device Management and Services.
App-ID and Content-ID practice questions
Practise PCNSA questions linked to App-ID and Content-ID.
Decryption and Monitoring practice questions
Practise PCNSA questions linked to Decryption and Monitoring.
PCNSA fundamentals practice questions
Practise PCNSA questions linked to PCNSA fundamentals.
PCNSA scenario practice questions
Practise PCNSA questions linked to PCNSA scenario.
PCNSA troubleshooting practice questions
Practise PCNSA questions linked to PCNSA troubleshooting.
Practice this exam
Start a free PCNSA practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PCNSA question test?
Device Management and Services — This question tests Device Management and Services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a service route configuration for each service type. — Option B is correct because service routes allow you to specify which source IP address the firewall uses for traffic it generates itself, such as NTP, DNS, and Panorama communications. Option C is correct because the actual configuration is performed under Device > Setup > Services > Service Route Configuration, where you can assign a specific source IP (e.g., from a loopback interface) for each service type. This ensures that firewall-originated traffic uses a consistent, routable source address independent of the egress interface.
What should I do if I get this PCNSA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.