Courseiva

CCNA Managing Objects Questions

49 questions · Managing Objects · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Matchingmedium

Match each firewall deployment mode to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Passively monitors traffic without blocking

Transparent layer 2 deployment

Routable mode with IP addresses

Failover configuration with one standby unit

Why these pairings

The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Practice this question →
2
MCQhard

Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?

A.The tag is misspelled
B.The dynamic group requires a commit after adding the object
C.The address object is not tagged
D.The group match type is 'all' not 'any'
AnswerB

A commit is necessary for the dynamic group to reflect the new member.

Why this answer

In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.

Exam trap

The trap here is that candidates assume dynamic groups update instantly when an object is tagged, overlooking the mandatory commit step required to synchronize the candidate configuration with the active running configuration.

How to eliminate wrong answers

Option A is wrong because the tag is correctly applied as 'database' and the question states it is tagged with 'database', so a misspelling is not indicated. Option C is wrong because the address object is explicitly tagged with 'database' as stated in the scenario, so the object is indeed tagged. Option D is wrong because the group match type being 'all' or 'any' affects whether all tags must match or any tag can match, but it does not prevent a correctly tagged object from appearing; the issue is the lack of commit, not the match logic.

Practice this question →
3
MCQhard

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

A.The group automatically updates and removes the IP address.
B.The group retains the IP address until manually removed.
C.The group is deleted.
D.The group requires a commit to update.
AnswerA

Dynamic groups reflect tag changes in real-time.

Why this answer

Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.

Practice this question →
4
Multi-Selectmedium

An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)

Select 2 answers
A.Create a service object with port range 1000-2000
B.Create a service object with port 1000 and use an application override
C.Create a service group with two service objects (one for 1000, one for 2000)
D.Create a custom application that includes both ports
E.Create a single service object with port 1000 and a separate rule for port 2000
AnswersC, D

This groups the two service objects into a single group for use in a rule.

Why this answer

A service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.

Exam trap

The trap here is that candidates often confuse a service group with a port range object, assuming that a range like 1000-2000 is equivalent to specifying only the endpoints, but in reality, it includes every port in between.

Practice this question →
5
MCQhard

A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?

A.80
B.443
C.22
D.8080
AnswerB

MyService defines port 443.

Why this answer

(443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.

Exam trap

The trap here is that candidates often assume the destination port is derived from the server group's common service (e.g., HTTP on port 80) rather than recognizing that the service object explicitly defines the port in the security rule.

How to eliminate wrong answers

Option A (80) is wrong because port 80 is associated with HTTP, not the 'MyService' object which is configured for HTTPS (443). Option C (22) is wrong because port 22 is used for SSH, a management protocol not typically defined in a service object named 'MyService' for web traffic. Option D (8080) is wrong because port 8080 is an alternate HTTP port, often used for proxies or development, and does not match the standard HTTPS port 443 defined in 'MyService'.

Practice this question →
6
MCQhard

A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?

A.The group is configured as static
B.The dynamic group uses 'match all' and the object lacks some tags
C.The administrator added the object directly to the group
D.The address object has multiple tags including the wrong one
AnswerD

A tag matching the group's criteria causes inclusion, even if other tags are different.

Why this answer

Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.

Exam trap

The trap here is that candidates often assume dynamic groups use 'match all' by default or that tag conflicts are impossible, but the 'match any' operator is common and can cause objects with overlapping tags to be included in unintended groups.

How to eliminate wrong answers

Option A is wrong because a static group does not use tags for membership; objects are manually added or removed, so tag mismatches would not cause incorrect inclusion. Option B is wrong because if the group uses 'match all', the object would need to have all specified tags to be included; lacking some tags would exclude it, not cause incorrect inclusion. Option C is wrong because directly adding an object to a dynamic group is not possible; dynamic groups are populated solely by tag-based matching, not manual addition.

Practice this question →
7
MCQeasy

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

A.22
B.443
C.8080
D.80
AnswerD

Port 80 is the standard port for HTTP.

Why this answer

The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.

Exam trap

Palo Alto Networks often tests the distinction between HTTP (port 80) and HTTPS (port 443), and the trap here is that candidates may confuse HTTP with HTTPS or assume a common alternate port like 8080 is the default.

How to eliminate wrong answers

Option A is wrong because port 22 is the default port for SSH, not HTTP. Option B is wrong because port 443 is the default port for HTTPS (HTTP over SSL/TLS), not HTTP. Option C is wrong because port 8080 is an alternate port commonly used for HTTP proxies or web servers, but it is not the pre-defined default for the HTTP service object in Palo Alto Networks firewalls.

Practice this question →
8
MCQhard

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

A.Device groups
B.Shared policy
C.Template stacks
D.External Dynamic Lists
AnswerD

EDLs allow external lists to be referenced in policies and shared across firewalls.

Why this answer

External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.

Exam trap

The trap here is that candidates often confuse Device Groups (which share static policy and objects) with the ability to share dynamic objects, but Device Groups do not support dynamic address groups; only EDLs provide the dynamic, externally-sourced sharing mechanism.

How to eliminate wrong answers

Option A is wrong because Device Groups are used to manage shared policy and configuration across firewalls in Panorama, but they do not directly share dynamic address groups; they share static objects and policies. Option B is wrong because Shared Policy is a configuration element that applies policies across devices, but it does not inherently share dynamic address groups; it relies on objects that must be defined elsewhere. Option C is wrong because Template Stacks are used to manage device-level settings like interfaces and network configurations, not dynamic address groups or object sharing.

Practice this question →
9
MCQmedium

A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?

A.External Dynamic List (EDL)
B.Custom URL Category
C.Address Group
D.Application Filter
AnswerA

EDL can consume frequently updated lists of domains or IPs.

Why this answer

An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.

Exam trap

The trap here is that candidates often confuse Custom URL Categories with EDLs, assuming a manually updated list can suffice for dynamic feeds, but the exam emphasizes that EDLs are the only object designed for automated, external-sourced updates.

How to eliminate wrong answers

Option B is wrong because a Custom URL Category is a static, manually defined list of URLs or domains that does not support automatic updates from an external feed; it requires manual editing to reflect daily changes. Option C is wrong because an Address Group is used to group IP addresses or CIDR ranges, not domain names, and it cannot dynamically update from an external threat intelligence source. Option D is wrong because an Application Filter is used to identify traffic based on application characteristics (e.g., application ID, category, technology), not to block specific domains or URLs.

Practice this question →
10
MCQmedium

An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?

A.The rule has no source zone
B.The rule's action is set to allow but the application group is configured incorrectly
C.Facebook uses a different application not in the group
D.The application group includes 'ssl' which is not an application
AnswerC

Facebook is identified as 'facebook' or similar, not 'web-browsing'.

Why this answer

Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.

Exam trap

The trap here is that candidates assume 'web-browsing' and 'ssl' cover all HTTPS traffic, but Palo Alto Networks treats each application (e.g., Facebook, YouTube) as a separate App-ID, so a rule must explicitly include the specific application to allow it.

How to eliminate wrong answers

Option A is wrong because a missing source zone would cause the rule to not apply at all, but the traffic is being blocked, implying the rule is matched and the action is deny (or no allow rule matches). Option B is wrong because if the rule's action were set to allow and the application group were configured incorrectly, the traffic would still be evaluated; the issue is not a misconfiguration of the group but that Facebook's application is simply not in the group. Option D is wrong because 'ssl' is a valid application object in Palo Alto Networks that represents SSL/TLS encrypted traffic; it is correctly included in the group.

Practice this question →
11
MCQeasy

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

A.Schedule
B.Service
C.Address
D.Tag
AnswerC

Address objects define IP addresses or FQDNs, making them suitable for specifying a destination.

Why this answer

To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.

Exam trap

The trap here is that candidates often confuse the purpose of Service objects (thinking they define the destination website) because they associate 'service' with web traffic, but Service objects only define protocol/port, not the destination host or IP.

How to eliminate wrong answers

Option A is wrong because a Schedule object defines time-based conditions for when a policy is active, not the destination of traffic. Option B is wrong because a Service object specifies the protocol and port (e.g., TCP/443) used by the traffic, not the destination address. Option D is wrong because a Tag is a metadata label used for grouping and filtering objects in the management interface, not a match criterion for traffic destinations.

Practice this question →
12
Multi-Selectmedium

Which TWO statements about External Dynamic Lists (EDLs) are true?

Select 2 answers
A.EDLs can be used in security policy source and destination fields.
B.EDLs have a fixed refresh interval that cannot be changed.
C.EDLs must be manually updated by an administrator.
D.EDLs support both IP addresses and URLs.
E.EDLs allow the administrator to add individual IPs directly via the GUI.
AnswersA, D

EDLs can be used as address objects in policies.

Why this answer

External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.

Exam trap

Palo Alto Networks often tests the misconception that EDLs require manual updates or have fixed refresh intervals, when in fact they are fully automated and configurable, and that EDLs can only be used for IP addresses, not URLs (though they support both).

Practice this question →
13
MCQhard

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

A.The application 'web-browsing' does not cover port 8080 traffic.
B.The rule order is incorrect; a previous rule is denying the traffic.
C.The destination address object 10.10.0.0/16 is incorrect.
D.The source zone 'GP' should be 'untrust'.
AnswerA

App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.

Why this answer

The custom web application on port 8080 is identified as 'web-browsing' by App-ID, but the security rule uses the application object 'web-browsing', which by default only includes standard HTTP ports (80 and 443). Therefore, traffic on port 8080 does not match the rule's application condition, even though the App-ID identifies it as web-browsing. To allow this traffic, the administrator would need to either use a custom application that includes port 8080 or add a service object to the rule.

Exam trap

The trap here is that candidates assume 'web-browsing' covers all HTTP traffic regardless of port, but Palo Alto Networks firewalls enforce application identification based on default port definitions, and non-standard ports require explicit configuration.

How to eliminate wrong answers

Option B is wrong because the traffic is being denied by the implicit deny rule, not by a previous rule; the rule order is not the issue here as the rule in question is present but does not match the application. Option C is wrong because the destination address object 10.10.0.0/16 is correct for the data center subnet, and the traffic is reaching that subnet but is denied due to application mismatch. Option D is wrong because the source zone 'GP' (GlobalProtect) is correct for remote users connecting via GlobalProtect; using 'untrust' would be incorrect as GlobalProtect traffic originates from the GP tunnel zone, not the untrust zone.

Practice this question →
14
MCQeasy

A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?

A.FQDN
B.IP Netmask
C.IP Wildcard Mask
D.IP Range
AnswerB

IP Netmask with /32 (255.255.255.255) represents a single host.

Why this answer

For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.

Exam trap

The trap here is that candidates familiar with Cisco ACLs might choose IP Wildcard Mask (Option C) because they associate wildcard masks with host matching, but Palo Alto Networks uses IP Netmask as the standard and more straightforward method for defining a single host.

How to eliminate wrong answers

Option A (FQDN) is wrong because it is used for domain names that resolve to one or more IP addresses via DNS, not for a static IP address. Option C (IP Wildcard Mask) is wrong because it uses a wildcard mask to match a range of IPs (like Cisco ACLs), but it is not the intended type for a single host in Palo Alto Networks; it would require a mask of 0.0.0.0 to match a single host, which is less intuitive and not the recommended approach. Option D (IP Range) is wrong because it defines a contiguous range of IP addresses (e.g., 192.168.1.100-192.168.1.110), which is unnecessary and less precise for a single host.

Practice this question →
15
MCQhard

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

A.Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.
B.Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.
C.Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.
D.Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.
AnswerD

Dynamic group automatically includes matching objects; minimal overhead.

Why this answer

Dynamic address groups with tag-based or name-based filters automatically include all matching objects, eliminating manual updates when new sites are added. By using a filter like 'Site-*-Networks', the group dynamically incorporates any address group whose name matches the pattern, reducing administrative overhead. This approach aligns with the PCNSA objective of using dynamic objects to simplify policy management in a scalable environment.

Exam trap

The trap here is that candidates often confuse dynamic address groups with static groups or incorrectly assume tags can be applied to address groups instead of address objects, leading them to choose options that require manual updates or fail to meet the scalability requirement.

How to eliminate wrong answers

Option A is wrong because manually adding each site's address group as a member of a static group still requires administrative intervention whenever a new site is added, defeating the goal of minimal overhead. Option B is wrong because using 'any' zone for source and destination would allow traffic from and to any zone, including the internet, which violates the requirement to block all internet traffic except specific services; it also does not leverage address groups for simplified management. Option C is wrong because tags are applied to address objects, not address groups; dynamic address groups filter based on tags of address objects, not groups, so filtering on a tag assigned to a group would not include the group's members automatically.

Practice this question →
16
Multi-Selecteasy

Which TWO types of address objects can be used in a security policy? (Choose two.)

Select 2 answers
A.Application
B.Tag
C.IP Netmask
D.IP Range
E.Service
AnswersC, D

IP Netmask is a standard address object type.

Why this answer

IP Netmask and IP Range are both types of address objects that define specific IP addresses or groups of IP addresses. Security policies in Palo Alto Networks firewalls use these address objects to match source and destination IP addresses in traffic, enabling granular control over which hosts or networks are allowed or denied.

Exam trap

Palo Alto Networks often tests the distinction between address objects and other policy elements like services or applications, so the trap here is that candidates mistakenly think Application or Service can serve as address objects because they are also used in security rules, but they occupy different match fields.

Practice this question →
17
MCQmedium

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

A.NAT address pool
B.External dynamic list
C.Service group
D.IPsec Crypto profile
AnswerA

NAT address pool specifies the translated IP addresses.

Why this answer

A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.

Exam trap

The trap here is that candidates may confuse NAT address pools with IPsec Crypto profiles, thinking that VPN configuration alone resolves IP overlap, when in fact IPsec only encrypts traffic and does not perform address translation to resolve overlapping subnets.

How to eliminate wrong answers

Option B (External dynamic list) is wrong because it is used to dynamically import and manage IP addresses or URLs from an external source (e.g., threat intelligence feeds) for security policy matching, not for performing NAT translations. Option C (Service group) is wrong because it is a logical grouping of services (protocols and ports) used in security policy rules to simplify rule creation, not for IP address translation. Option D (IPsec Crypto profile) is wrong because it defines the IKE and IPsec parameters (e.g., encryption algorithms, authentication methods, DH groups) for securing VPN tunnels, not for translating overlapping IP addresses.

Practice this question →
18
MCQmedium

Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?

A.The admin forgot to add 'web-04' to the address group
B.The address object 'web-04' has the wrong IP
C.The address group is dynamic and did not update
D.The security policy is set to deny
AnswerA

Static groups require explicit member addition.

Why this answer

The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group.

This is the most common cause of such a failure.

Exam trap

Palo Alto Networks often tests the distinction between creating an object and applying it to a group; the trap here is that candidates assume creating the object and referencing the group in the policy is sufficient, forgetting that the object must be a member of the group for the policy to match.

How to eliminate wrong answers

Option B is wrong because the question states the IP is 10.0.0.4 and the admin applied it to the policy; if the IP were wrong, the traffic would still not match, but the most likely cause is the group membership issue, not an IP typo. Option C is wrong because dynamic address groups update automatically based on tags or filters; if the group were dynamic, adding the object with the correct tag would cause it to be included, but the admin would need to ensure the tag matches, and the question does not indicate a dynamic group failure. Option D is wrong because the question states the policy references the address group 'web-servers' and traffic is not allowed; if the policy were set to deny, it would explicitly block traffic, but the most likely cause is the missing group membership, not a deny action.

Practice this question →
19
MCQmedium

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

A.Application object
B.Application filter
C.Application group
D.Service object
AnswerA

Application objects define specific applications like web-browsing.

Why this answer

Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.

Exam trap

The trap here is that candidates often confuse service objects (Layer 4) with application objects (Layer 7), assuming that specifying a port/protocol is sufficient to control applications, but the PCNSA exam emphasizes that application-based policies require App-ID objects for granular control.

How to eliminate wrong answers

Option B is wrong because an Application filter is used to dynamically group applications based on criteria like category or technology, but it cannot be directly placed in the security policy application field; it is used in other contexts like QoS or policy optimization. Option C is wrong because an Application group is a static collection of application objects, but the question asks for the object type to allow specific applications individually, not a group; using a group could inadvertently permit unintended applications within the group. Option D is wrong because a Service object defines Layer 4 protocols and ports (e.g., TCP/443 for HTTPS), but it cannot enforce application-level control; for example, it would allow any traffic on port 443, not just SSL, failing to meet the requirement of allowing only specific applications.

Practice this question →
20
MCQhard

Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?

A.The address object must be a member of a static address group to be included in a dynamic group.
B.The security rule must specify the source zone explicitly.
C.The dynamic address group filter uses 'andd' which is a valid operator in older PAN-OS versions.
D.The filter syntax is invalid; 'andd' should be 'and'.
E.The dynamic address group only updates its membership after a system reboot.
AnswerD

The typo 'andd' makes the filter invalid; correcting to 'and' resolves the issue.

Why this answer

The dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.

Exam trap

The trap here is that candidates may overlook the typo 'andd' and focus on other plausible but incorrect causes, such as zone configuration or reboot requirements, rather than recognizing the invalid filter syntax as the root cause.

How to eliminate wrong answers

Option A is wrong because dynamic address groups do not require the address object to be a member of a static address group; they use tag-based filters to dynamically include objects. Option B is wrong because the exhibit does not indicate a missing source zone; the rule can match traffic without an explicit source zone if the zone is implied or the rule is global, and the issue is specifically with the dynamic group filter. Option C is wrong because 'andd' is not a valid operator in any PAN-OS version; the correct operator is 'and', and using 'andd' is a syntax error.

Option E is wrong because dynamic address groups update their membership in near real-time when tags or objects change, not only after a system reboot.

Practice this question →
21
MCQhard

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

A.Use a region object instead
B.Create a dynamic address group with a tag-based filter
C.Use an FQDN object in the address group; the firewall resolves it automatically
D.Manually add all possible IP addresses to an address group
AnswerC

FQDN objects automatically resolve and update IPs.

Why this answer

Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.

Exam trap

The trap here is that candidates may think FQDN objects require manual IP updates or that dynamic address groups can perform DNS resolution, but in reality, only FQDN objects provide automatic, runtime DNS resolution without manual intervention.

How to eliminate wrong answers

Option A is wrong because a region object is based on geographic location (e.g., country or continent) and cannot represent a dynamic set of IP addresses resolved from an FQDN. Option B is wrong because a dynamic address group with a tag-based filter is used to group objects by tags, not to automatically resolve FQDNs to IPs; it does not handle DNS resolution. Option D is wrong because manually adding all possible IP addresses is impractical and error-prone when IPs change frequently, and it defeats the purpose of automation and dynamic resolution.

Practice this question →
22
MCQeasy

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

A.Address object
B.Tag
C.Address group
D.Region
AnswerA

Address object directly defines a specific IP address.

Why this answer

To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.

Exam trap

The trap here is that candidates may confuse Address Groups with Address Objects, thinking they need a group for flexibility, but the question explicitly asks for the object type to use for a single IP, making the Address Object the direct and correct answer.

How to eliminate wrong answers

Option B (Tag) is wrong because Tags are metadata labels used for policy identification, grouping, or dynamic filtering, not for matching source IP addresses in a security rule. Option C (Address Group) is wrong because while an Address Group can contain Address Objects, using a group for a single IP is unnecessary and adds complexity; the question asks for the object type to use, and the most direct and correct choice is the Address Object itself. Option D (Region) is wrong because Region objects define geographic locations based on IP ranges, not a specific internal IP address, and are typically used in destination or source fields for geo-blocking, not for blocking a single host.

Practice this question →
23
MCQmedium

An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?

A.Destination port
B.Both destination port and protocol
C.Source port
D.Protocol
AnswerB

Service objects require both protocol and destination port.

Why this answer

In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.

Exam trap

The trap here is that candidates often assume only the destination port is needed, forgetting that the protocol is mandatory to uniquely identify the service, as the same port number can be used by different protocols (e.g., TCP vs. UDP).

How to eliminate wrong answers

Option A is wrong because specifying only the destination port without the protocol would leave the service object ambiguous, as the firewall cannot determine whether the traffic uses TCP, UDP, or another protocol. Option C is wrong because source ports are not used in service object definitions; service objects are based on destination ports and protocols, as source ports are typically ephemeral and not relevant for service identification. Option D is wrong because specifying only the protocol without a destination port would create a generic service that matches all traffic of that protocol, which is not the intended behavior for a specific TCP port 8080 service.

Practice this question →
24
MCQmedium

An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?

A.FTP
B.RDP
C.SSH
D.Telnet
AnswerB

RDP uses TCP port 3389.

Why this answer

TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.

Exam trap

The trap here is that candidates may confuse RDP with other remote access protocols like SSH or Telnet, but the specific port 3389 is exclusively associated with RDP in standard networking practice.

How to eliminate wrong answers

Option A is wrong because FTP (File Transfer Protocol) uses TCP ports 20 and 21, not 3389. Option C is wrong because SSH (Secure Shell) uses TCP port 22, not 3389. Option D is wrong because Telnet uses TCP port 23, not 3389.

Practice this question →
25
MCQeasy

Which object type is used to group multiple service objects together for use in a security policy?

A.Schedule
B.Tag
C.Service group
D.Address group
AnswerC

Service groups combine multiple service objects for policy use.

Why this answer

A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.

Exam trap

The trap here is that candidates often confuse 'service group' with 'address group' because both are grouping constructs, but they serve entirely different purposes — one for ports/protocols and one for IP addresses — and the exam expects you to know which object type applies to which policy element.

How to eliminate wrong answers

Option A is wrong because a Schedule object is used to define time-based access control (e.g., business hours), not to group service objects. Option B is wrong because a Tag is a metadata label for filtering or organizing objects in the firewall GUI, not a container for service definitions. Option D is wrong because an Address group is used to group IP addresses or FQDNs, not services; it is the correct grouping mechanism for network objects, not service objects.

Practice this question →
26
MCQmedium

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

A.The filter should include a tag condition because dynamic groups require tags.
B.The dynamic address group cannot use name-based filters; it requires tags.
C.The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.
D.The filter should use double quotes instead of single quotes around the pattern.
AnswerD

Correct quote type is double quotes for the filter string.

Why this answer

In PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.

Exam trap

Palo Alto Networks often tests the subtle syntax requirement that dynamic address group filters must use double quotes (not single quotes) for name-based patterns, leading candidates to overlook this detail and incorrectly assume tags or object types are the issue.

How to eliminate wrong answers

Option A is wrong because dynamic address groups do not require tags; they can use name-based filters or tag-based filters, and tags are optional. Option B is wrong because dynamic address groups can indeed use name-based filters (e.g., with wildcards like '*'), not just tags; tags are one method but not the only one. Option C is wrong because dynamic address groups support IP ranges, network objects, and FQDNs; the use of an IP range in 'WebServer-2' is not a limitation.

Practice this question →
27
MCQhard

A network administrator manages a Palo Alto Networks firewall in a datacenter. They have configured dynamic address groups (DAGs) to automatically include servers based on tags. The tags are assigned via User-ID from Active Directory. The administrator notices that some servers that should be in the DAG are not appearing, while others are correctly added. The firewall is configured to receive User-ID information from a domain controller via the PAN-OS Agent. The tags are correctly assigned in Active Directory. What should the administrator verify first?

A.The firewall's User-ID agent is configured to fetch tags from the correct domain.
B.The dynamic address group's filter expression is correct and uses the tag.
C.The firewall's license for User-ID is active.
D.The security policies using the DAG are committed.
AnswerB

The filter expression must exactly match the tag name; even a minor typo can cause the DAG to not include the intended servers.

Why this answer

The most common cause when tags are correctly assigned in Active Directory but servers are missing from a dynamic address group (DAG) is an incorrect filter expression on the DAG itself. The DAG uses a tag-based filter (e.g., 'tag1' or 'tag1 AND tag2') to match registered IP-address-to-tag mappings; if the filter syntax or tag name does not exactly match what is being registered via User-ID, the servers will not be included. The administrator should verify the DAG's filter expression first before investigating other components.

Exam trap

The trap here is that candidates often assume the problem must be with the User-ID data source (AD or agent) or licensing, when in fact the most direct and likely cause is a simple mismatch in the DAG filter expression itself.

How to eliminate wrong answers

Option A is wrong because the firewall's User-ID agent is already receiving tags correctly (the tags are correctly assigned in AD and the agent is configured), so the issue is not about fetching from the wrong domain. Option C is wrong because if the User-ID license were inactive, no tags would be registered at all, but the administrator observes that some servers are correctly added, indicating the license is active. Option D is wrong because security policies using the DAG do not need to be committed for the DAG to populate; DAG membership is evaluated in real time based on the current tag registrations, independent of policy commit state.

Practice this question →
28
MCQmedium

A company uses a Palo Alto Networks firewall to control outbound access. They have created custom application filters to block social media and streaming. However, they need to allow a specific corporate YouTube channel for training videos. The administrator creates an application group "Corporate-YouTube" containing the "youtube-base" application, and adds a security rule to allow traffic from internal users to the application group. Despite this, users still cannot access the corporate YouTube channel. What is the most likely reason?

A.The firewall's URL filtering profile is blocking the category before application identification can occur.
B.The application group is not correctly associated with the security policy.
C.The application "youtube-base" is not recognized by the firewall.
D.The security rule allowing the application group is placed after a deny rule that blocks the "streaming" category.
AnswerA

URL filtering profiles can block based on URL category before the application is identified, preventing access even if the application is allowed.

Why this answer

The most likely reason is that the URL filtering profile is blocking the YouTube category before the firewall can identify the application. Palo Alto Networks firewalls process URL filtering before application identification in the security policy evaluation order. Even though the application group 'Corporate-YouTube' is allowed, the URL filtering profile (which is applied to the rule or as a default) will block the request if the URL category (e.g., 'streaming-media' or 'social-networking') is denied, preventing the traffic from reaching the application identification stage.

Exam trap

The trap here is that candidates assume application-based rules override all other checks, but Palo Alto Networks firewalls evaluate URL filtering before App-ID, so a URL filtering block will prevent the application from being identified and allowed.

How to eliminate wrong answers

Option B is wrong because if the application group were not correctly associated with the security policy, the rule would not match at all, but the question states the rule was created and added; the issue is that URL filtering preempts the application match. Option C is wrong because 'youtube-base' is a standard, well-known application in Palo Alto Networks App-ID and is recognized by the firewall; if it were not recognized, the rule would simply not match, but the problem is a block before App-ID. Option D is wrong because even if the allow rule is placed after a deny rule for 'streaming', the deny rule would block the traffic based on the application or category, but the scenario describes a custom application filter blocking social media and streaming, not a security rule; the deny rule would need to explicitly match the traffic, and the order could be an issue, but the most likely cause is URL filtering, which is a separate profile that can block regardless of rule order.

Practice this question →
29
Drag & Dropmedium

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.

Practice this question →
30
MCQmedium

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

A.The administrator must manually update the address object's IP address.
B.Only if the address group is dynamic will the update occur automatically.
C.FQDN objects cannot be included in address groups.
D.The firewall automatically resolves the FQDN at commit and updates the group accordingly.
AnswerD

FQDN resolution occurs at commit, ensuring the group uses the current IP.

Why this answer

Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.

Exam trap

The trap here is that candidates may think FQDNs require manual updates or that only dynamic groups support automatic resolution, but Palo Alto firewalls resolve FQDNs at commit for any group type.

How to eliminate wrong answers

Option A is wrong because the firewall automatically resolves the FQDN at commit, so manual updates are unnecessary. Option B is wrong because the automatic update occurs regardless of whether the address group is static or dynamic; the FQDN resolution happens at commit for any group containing an FQDN object. Option C is wrong because FQDN objects can indeed be included in address groups; they are a supported object type in Palo Alto Networks address groups.

Practice this question →
31
MCQeasy

An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?

A.Use a single address object with a subnet
B.Create separate rules for each server
C.Use a dynamic address group with tags
D.Create an address group and a service group
AnswerD

This reduces administrative effort and groups related objects.

Why this answer

Creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.

Exam trap

The trap here is that candidates may confuse dynamic address groups (which rely on tags and external data) with static address groups, or assume that a single subnet object can cover non-contiguous IPs, leading them to choose option A or C.

How to eliminate wrong answers

Option A is wrong because using a single address object with a subnet would only work if all servers share a contiguous IP range, which is not the case here (different IP addresses). Option B is wrong because creating separate rules for each server is inefficient and increases rule count, violating best practices for policy management. Option C is wrong because dynamic address groups with tags are used for grouping objects based on dynamic criteria (e.g., IP address changes via external sources), not for statically grouping multiple known IP addresses; tags are not needed for this static grouping.

Practice this question →
32
MCQeasy

How many address objects are members of the 'web-servers' address group?

A.3
B.1
C.4
D.2
AnswerD

The exhibit clearly lists two members.

Why this answer

The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.

Exam trap

The trap here is that candidates often miscount the number of address objects by confusing individual IP addresses within a subnet object as separate members, rather than recognizing that a single subnet object (e.g., 10.0.0.0/24) counts as one member regardless of how many hosts it represents.

How to eliminate wrong answers

Option A is wrong because it suggests three members, which would require an additional address object not present in the group configuration. Option B is wrong because it implies only one member, but the group contains two distinct address objects (a host and a subnet). Option C is wrong because it indicates four members, which would require more objects than the group actually contains, possibly confusing the number of IP addresses with the number of address objects.

Practice this question →
33
MCQmedium

A security administrator is configuring an address object for a web server accessible from the internet. The server has a public IP of 203.0.113.10/32 and a private IP of 10.0.1.10/32. The administrator needs to create a security policy that allows inbound HTTPS traffic to the server. Which address object type should be used for the destination?

A.FQDN (e.g., webserver.example.com)
B.IP Range (e.g., 10.0.1.10-10.0.1.10)
C.IP Wildcard Mask (e.g., 203.0.113.0/0.0.0.255)
D.IP Netmask (e.g., 203.0.113.10/32)
AnswerD

IP Netmask /32 is the correct and most efficient way to represent a single host.

Why this answer

The security policy destination must match the IP address that the firewall sees in the packet header. For inbound traffic from the internet, the destination IP is the public IP 203.0.113.10/32, so an IP Netmask object with that exact address is the appropriate type. Using a /32 netmask ensures a single host match, which is precise and efficient for firewall rule evaluation.

Exam trap

The trap here is that candidates often confuse the private IP (used internally) with the public IP (used for inbound internet traffic), leading them to select an object type that references the private address, such as IP Range or FQDN, instead of the correct public IP Netmask.

How to eliminate wrong answers

Option A is wrong because an FQDN object resolves to an IP address dynamically, but the firewall policy must match the static public IP in the packet; FQDN is typically used for outbound traffic or when the IP changes frequently, not for a fixed public server. Option B is wrong because an IP Range object (10.0.1.10-10.0.1.10) specifies the private IP, but inbound traffic from the internet arrives with the public IP as the destination, so this would never match. Option C is wrong because an IP Wildcard Mask (203.0.113.0/0.0.0.255) matches a range of addresses (203.0.113.0–203.0.113.255), which is too broad and could allow traffic to unintended hosts, violating the principle of least privilege.

Practice this question →
34
MCQmedium

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

A.Tag
B.Schedule
C.Service group
D.Address group
AnswerD

Address groups combine multiple address objects, simplifying policy creation.

Why this answer

An address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.

Exam trap

The trap here is that candidates may confuse address groups with service groups, thinking both are used for grouping, but service groups only apply to ports/protocols, not IP addresses or subnets.

How to eliminate wrong answers

Option A is wrong because tags are used for policy rule categorization and filtering in the management interface, not for grouping IP addresses or subnets. Option B is wrong because schedules define time-based access windows and have no relation to grouping subnets for source matching. Option C is wrong because service groups are used to combine multiple protocols or ports (e.g., TCP/80 and TCP/443) into a single object, not to group IP addresses or subnets.

Practice this question →
35
MCQeasy

A small business uses a Palo Alto Networks PA-220 firewall. The administrator needs to create a security policy to allow inbound VPN connections from remote employees using IPsec. The remote employees connect using dynamic IP addresses. The administrator creates an address object "Remote-VPN-Users" of type "IP Range" but that doesn't work because the IPs are not known. What address object type should be used instead?

A.IP Netmask
B.Any (0.0.0.0/0)
C.FQDN
D.IP Wildcard Mask
AnswerB

Using 'Any' as source allows all IP addresses, which is the only way to accommodate dynamic remote users.

Why this answer

When remote employees connect using dynamic IP addresses, the source IP is unknown and cannot be defined by a static address object. Using 'Any' (0.0.0.0/0) as the source address in the security policy allows the firewall to accept IPsec VPN traffic from any source IP, which is necessary for clients with dynamic addresses. This is a common practice for remote access VPN configurations where the peer IP is not predetermined.

Exam trap

The trap here is that candidates may think an IP range or netmask can be used to cover a broad set of dynamic IPs, but they fail to recognize that dynamic IPs are unpredictable and cannot be enumerated, making 'Any' the only viable option for source address in remote access VPN policies.

How to eliminate wrong answers

Option A is wrong because IP Netmask requires a specific subnet or host IP, which is not possible when remote users have dynamic IPs that change each connection. Option C is wrong because FQDN resolves to a static IP address or set of IPs, but dynamic IPs are not reliably mapped to a single FQDN, and the firewall would need DNS resolution at policy evaluation time, which is not suitable for dynamic IPsec peers. Option D is wrong because IP Wildcard Mask is used for matching ranges of IPs in a bitwise pattern (similar to ACLs), but it still requires a known range or pattern, which is not feasible when the IPs are completely unknown and dynamic.

Practice this question →
36
Multi-Selectmedium

Which three of the following are true about tag-based dynamic address groups? (Choose three.)

Select 3 answers
A.Tags can be applied to address objects
B.When an address object's tags change, dynamic groups are updated immediately after commit
C.A dynamic address group can match on one or more tags
D.A static address group can also use tags for matching
E.Tags are case-sensitive
AnswersA, B, C

Tags are metadata that can be assigned to address objects.

Why this answer

Tags are metadata labels that can be applied to address objects in Palo Alto Networks firewalls. This allows you to categorize objects flexibly, and dynamic address groups use these tags to automatically include or exclude objects based on tag membership.

Exam trap

Palo Alto Networks often tests the misconception that tags are case-sensitive, but in Palo Alto Networks, tags are case-insensitive, and candidates may also incorrectly assume static groups can use tags for dynamic matching.

Practice this question →
37
MCQhard

An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?

A.Use prefix-based naming conventions for address objects.
B.Use separate device groups in Panorama.
C.Use tags to isolate objects per tenant.
D.Use separate virtual systems (vsys) for each tenant.
AnswerD

Virtual systems create independent logical firewalls, ensuring complete isolation of objects and policies.

Why this answer

Virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.

Exam trap

The trap here is that candidates often confuse administrative separation (like device groups or tags) with true multi-tenant isolation, assuming that naming conventions or Panorama constructs can enforce object boundaries when only virtual systems provide the necessary hardware-enforced separation.

How to eliminate wrong answers

Option A is wrong because prefix-based naming conventions are a manual organizational method and do not prevent a policy from referencing an object from another tenant; they rely on administrator discipline and offer no technical enforcement. Option B is wrong because device groups in Panorama are used for centralized management and template/policy sharing across firewalls, but they do not isolate objects within a single firewall; objects in different device groups can still be referenced in policies if the firewall belongs to multiple groups. Option C is wrong because tags are metadata labels used for filtering and reporting, not for access control or policy enforcement; they do not restrict which objects can be used in security policies.

Practice this question →
38
Multi-Selecthard

A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)

Select 2 answers
A.Application
B.User
C.Source address
D.Destination address
E.Service
AnswersC, D

Every rule must have a source address (can be 'any').

Why this answer

In Palo Alto Networks security policy rules, the source and destination addresses are mandatory because the firewall must know which traffic to evaluate. Without a source or destination address, the rule cannot define the traffic flow and would be invalid. The 'allow' action requires at least these two address objects to create a valid rule.

Exam trap

Palo Alto Networks often tests the misconception that Application or Service are mandatory for an 'allow' rule, but Palo Alto Networks allows 'any' for these fields, making source and destination addresses the only mandatory objects.

Practice this question →
39
MCQhard

A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?

A.Region
B.Address
C.Service
D.Application
AnswerD

Application objects identify traffic by application signatures, allowing port-independent policy enforcement.

Why this answer

The question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.

Exam trap

The trap here is that candidates often confuse Service objects (port-based) with Application objects (app-based), assuming that specifying a port like TCP/443 is sufficient to allow HTTPS traffic, but the PCNSA exam emphasizes that App-ID is required for true application-level control.

How to eliminate wrong answers

Option A is wrong because a Region object is used to group IP addresses by geographic location (e.g., country or continent) for geo-blocking or geo-allow policies, not for identifying applications. Option B is wrong because an Address object defines a specific IP address or subnet (e.g., 10.0.0.0/8) for source or destination matching, not the application layer. Option C is wrong because a Service object defines a protocol and port number (e.g., TCP/443 for HTTPS), which matches traffic based solely on Layer 4 criteria, not the application identity.

Practice this question →
40
MCQmedium

An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?

A.Tags are case-sensitive
B.The address objects are not in the same zone
C.The group needs a commit after tagging
D.Tags are not case-sensitive
AnswerA

Tags are case-sensitive; 'Production' and 'production' are different.

Why this answer

Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.

Exam trap

The trap here is that candidates may assume tags are case-insensitive (like many other network device configurations) and overlook the exact-match requirement, leading them to choose Option D or incorrectly attribute the issue to a commit requirement.

How to eliminate wrong answers

Option B is wrong because dynamic address groups match tags globally across all zones; zone membership does not affect tag-based inclusion. Option C is wrong because tagging address objects does not require a commit to update the dynamic group membership — the group is evaluated in real time based on current tags. Option D is wrong because tags are explicitly case-sensitive in Palo Alto Networks firewalls, as demonstrated by the mismatch in this scenario.

Practice this question →
41
Multi-Selectmedium

Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)

Select 3 answers
A.Schedule
B.User
C.Application group
D.Service
E.Address
AnswersA, D, E

Schedule objects define time-based access.

Why this answer

Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.

Exam trap

The trap here is that candidates may confuse 'User' as a valid object type because it appears in policy configuration, but Palo Alto Networks does not have a standalone 'User' object; instead, users are handled via User-ID and authentication profiles.

Practice this question →
42
Multi-Selectmedium

A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?

Select 2 answers
A.Create an address group and add individual address objects for each server IP.
B.Create a single address object with IP range 192.168.10.1-192.168.10.254.
C.Create a single address object with IP subnet 192.168.10.0/24.
D.Create a dynamic address group using tags applied to individual address objects.
E.Create a predefined address object from the global cache.
AnswersC, D

A subnet address object directly represents the entire subnet and is the most efficient method.

Why this answer

Directly uses the subnet as an address object, which is efficient for a contiguous subnet. Option D uses a dynamic address group with tags, allowing flexible grouping without manual updates. Option A creates an address group with individual objects, which is less efficient for a subnet.

Option B uses an IP range, which is less efficient than CIDR notation. Option E refers to a non-existent feature.

Practice this question →
43
Multi-Selectmedium

Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Select 3 answers
A.FQDN
B.MAC Address
C.Subnet Object
D.IP Netmask
E.IP Range
AnswersA, D, E

FQDN is a valid type for domain names.

Why this answer

FQDN (Fully Qualified Domain Name) is a valid address object type in Palo Alto Networks that allows you to define a security policy rule based on a domain name rather than an IP address. The firewall dynamically resolves the FQDN to IP addresses at runtime, which is useful for destinations like cloud services or websites with changing IPs.

Exam trap

The trap here is that candidates may confuse 'Subnet Object' with the valid 'IP Netmask' type, or assume MAC addresses are valid address objects due to their use in other security contexts, but Palo Alto Networks strictly uses Layer 3 IP-based address objects for policy enforcement.

Practice this question →
44
MCQeasy

A company with a Palo Alto Networks firewall operating in Layer 2 transparent mode wants to control access to an internal ERP system. The ERP system uses a non-standard TCP port 4444. The security administrator creates a custom application object named 'ERP' with protocol set to 'tcp' and port range 4444-4444. Then, a security policy is configured allowing application 'ERP' from the internal zone to the ERP server zone. Users report they cannot connect to the ERP system. Firewall logs show no traffic matching the application 'ERP'. What should the administrator do to resolve the issue?

A.Change the security rule to use 'application-default' instead of the custom application.
B.Add a service object for port 4444 and include it in the security rule.
C.Create an Application Override policy for port 4444 and assign it to the 'ERP' application.
D.Disable application identification on the firewall.
AnswerC

Application Override bypasses App-ID and forces traffic on that port to be treated as the specified application, enabling the security rule to match.

Why this answer

In Layer 2 transparent mode, Palo Alto Networks firewalls rely on Application Override policies to bypass App-ID for traffic that uses non-standard ports. Since the custom application 'ERP' is defined with TCP port 4444 but App-ID cannot identify it on that port (as it is non-standard), an Application Override policy explicitly maps the traffic to the 'ERP' application, allowing the security policy to match and permit the traffic.

Exam trap

The trap here is that candidates assume creating a custom application object with the correct port is sufficient, but they overlook that App-ID must first identify the traffic, which requires an Application Override for non-standard ports.

How to eliminate wrong answers

Option A is wrong because 'application-default' refers to the predefined ports for known applications, not a custom application; it would not help identify traffic on a non-standard port. Option B is wrong because adding a service object for port 4444 does not solve the identification issue; the security policy already allows the application, but the traffic is not being recognized as 'ERP' due to App-ID failure. Option D is wrong because disabling application identification would remove all application-based controls, which is overly broad and insecure, and would not specifically resolve the identification of the custom application.

Practice this question →
45
MCQeasy

Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?

A.The application web-browsing should not be in the rule
B.The service group should not include service-https
C.The rule action should be deny
D.The source IP should be an address group
AnswerB

Removing 'service-https' from the group would block HTTPS while allowing HTTP.

Why this answer

The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.

Exam trap

Palo Alto Networks often tests the distinction between service objects (port-based) and application objects (payload-based), and the trap here is that candidates may think removing the application 'web-browsing' would fix the issue, but the rule uses a service group, not an application.

How to eliminate wrong answers

Option A is wrong because the application 'web-browsing' is not part of the rule configuration described; the rule uses a service group, not an application object, so removing an application would not address the service misconfiguration. Option B is correct as explained. Option C is wrong because changing the rule action to deny would block all traffic matching the rule, including the intended HTTP traffic, which is not the desired outcome.

Option D is wrong because the source IP being an address group is irrelevant to the issue; the problem lies in the service group definition, not the source addressing.

Practice this question →
46
Matchingmedium

Match each PAN-OS CLI command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Displays firewall version and uptime

Lists all interfaces and their status

Displays active security rules

Reboots the firewall

Why these pairings

Correct matches: show interface all -> displays interfaces, test security-policy-match -> tests policy, debug dataplane packet-diag -> captures packets. Common confusions: show system info is not about routes, show route fib is not about security policy.

Practice this question →
47
MCQhard

An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?

A.The EDL URL is invalid
B.The EDL is not registered as a dynamic list
C.The firewall's DNS resolution fails
D.The EDL cache time is set higher than the refresh interval
AnswerD

The cache time instructs the firewall to keep the old list until it expires.

Why this answer

The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.

Exam trap

The trap here is that candidates often assume the issue is with connectivity or registration (options A, B, or C), but the real cause is a misalignment between the firewall's cache time and the server's update frequency, which is a subtle but critical configuration detail.

How to eliminate wrong answers

Option A is wrong because an invalid EDL URL would cause the firewall to fail to download the list entirely, not to use an old list after a refresh interval. Option B is wrong because if the EDL were not registered as a dynamic list, the firewall would not be able to use it at all for blocking; the question states the firewall uses the old list, implying it was registered and functional. Option C is wrong because DNS resolution failure would prevent the firewall from reaching the EDL server, resulting in no list update or a download failure, not the use of a cached old list.

Practice this question →
48
MCQmedium

Based on the log excerpt, which object is used for the destination address?

A.Zone 'untrust'
B.Application 'web-browsing'
C.Address 'any'
D.Service 'service-http'
AnswerC

'any' is the pre-defined address object used as the destination.

Why this answer

The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.

Exam trap

The trap here is that candidates confuse the destination address object with other policy components like zones or services, because the log excerpt may show multiple fields, but the question specifically targets the address object used for the destination.

How to eliminate wrong answers

Option A is wrong because 'Zone untrust' is a security zone, not an address object; it defines the source or destination zone in the policy, not the destination address. Option B is wrong because 'Application web-browsing' is an application object that identifies traffic type (e.g., HTTP/HTTPS), not a destination address. Option D is wrong because 'Service service-http' is a service object that defines the destination port (TCP/80), not the destination address.

Practice this question →
49
Drag & Dropmedium

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Managing Objects questions.

Start 20-question session