PCNSA Managing Objects Practice Question
Exhibit
TRAFFIC log: time: 2024/01/01 10:00 src: 192.168.1.100 dst: 10.0.0.50 rule: rule1 action: allow application: web-browsing service: service-https
Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between service objects (port-based) and application objects (payload-based), and the trap here is that candidates may think removing the application 'web-browsing' would fix the issue, but the rule uses a service group, not an application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service group should not include service-https
The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application web-browsing should not be in the rule
Why it's wrong here
The rule matches on service ports, not application identification, so removing web-browsing changes nothing about HTTPS being permitted. Application filters are tempting because App-ID gives granular control. They are the right tool when policy must distinguish applications sharing the same port, such as blocking one SaaS app over 443.
- ✓
The service group should not include service-https
Why this is correct
The service group 'web-services' bundles service-http and service-https, so the allow rule matches HTTPS traffic the administrator meant to block. Removing service-https from the group narrows the match to HTTP only, aligning the rule with the intended policy.
- ✗
The rule action should be deny
Why it's wrong here
Changing the action to deny would block both HTTP and HTTPS, contradicting the intent to permit HTTP while blocking HTTPS. Deny actions are tempting because they immediately stop traffic. A deny rule is correct when the requirement is to drop all matching traffic outright, not to differentiate by protocol within a service group.
- ✗
The source IP should be an address group
Why it's wrong here
The source is a single host, so an address group adds no filtering benefit and cannot separate HTTP from HTTPS. Address groups are tempting for scaling rules across many hosts. They are correct when multiple source addresses share identical policy, which is not the issue here.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.