PCNSA Managing Objects Practice Question
Exhibit
admin@PA-5050> show running address-group MyServers name: MyServers type: dynamic filter: "'Production' andd 'Web'"
Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates may overlook the typo 'andd' and focus on other plausible but incorrect causes, such as zone configuration or reboot requirements, rather than recognizing the invalid filter syntax as the root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The filter syntax is invalid; 'andd' should be 'and'.
The dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The address object must be a member of a static address group to be included in a dynamic group.
Why it's wrong here
Dynamic groups use tags; membership in a static group is not required.
- ✗
The security rule must specify the source zone explicitly.
Why it's wrong here
The source zone is defined in the security rule separately; the address group is a source address, not zone.
- ✗
The dynamic address group filter uses 'andd' which is a valid operator in older PAN-OS versions.
Why it's wrong here
'andd' is a typo; only 'and' is valid.
- ✓
The filter syntax is invalid; 'andd' should be 'and'.
Why this is correct
The typo 'andd' makes the filter invalid; correcting to 'and' resolves the issue.
- ✗
The dynamic address group only updates its membership after a system reboot.
Why it's wrong here
Dynamic address groups update after commit or during policy evaluation; reboot is not required.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.