PCNSA Managing Objects Practice Question
Exhibit
TRAFFIC log: time: 2024/01/01 10:00 src: 192.168.1.100 dst: 10.0.0.50 rule: rule1 action: allow application: web-browsing service: service-https
Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between service objects (port-based) and application objects (payload-based), and the trap here is that candidates may think removing the application 'web-browsing' would fix the issue, but the rule uses a service group, not an application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service group should not include service-https
The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application web-browsing should not be in the rule
Why it's wrong here
Web-browsing is needed to match HTTP traffic correctly.
- ✓
The service group should not include service-https
Why this is correct
Removing 'service-https' from the group would block HTTPS while allowing HTTP.
- ✗
The rule action should be deny
Why it's wrong here
Changing to deny would block both HTTP and HTTPS, which is not the intent.
- ✗
The source IP should be an address group
Why it's wrong here
The source IP object type is irrelevant to the HTTPS blocking issue.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.