PCNSA Managing Objects Practice Question
Exhibit
Refer to the exhibit.
deviceconfig {
devices {
localhost.localdomain {
vsys {
vsys1 {
address {
entry {
@name = "WebServer-1";
ip-netmask = "10.0.1.10/32";
}
entry {
@name = "WebServer-2";
ip-range = "10.0.1.20-10.0.1.25";
}
entry {
@name = "WebServers-Group";
dynamic {
filter = "'WebServer-*'";
}
}
}
}
}
}
}
}Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?
⚠ Common exam trap
Palo Alto Networks often tests the subtle syntax requirement that dynamic address group filters must use double quotes (not single quotes) for name-based patterns, leading candidates to overlook this detail and incorrectly assume tags or object types are the issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The filter should use double quotes instead of single quotes around the pattern.
In PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The filter should include a tag condition because dynamic groups require tags.
Why it's wrong here
Tags are not required; name-based filters work with correct syntax.
- ✗
The dynamic address group cannot use name-based filters; it requires tags.
Why it's wrong here
Dynamic address groups can use name-based filters without tags.
- ✗
The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.
Why it's wrong here
Dynamic address groups support IP range objects.
- ✓
The filter should use double quotes instead of single quotes around the pattern.
Why this is correct
Correct quote type is double quotes for the filter string.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.