How should I use these Device Management and Services practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Device Management and Services questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Device Management and Services domain.

PCNSA · topic practice

Device Management and Services practice questions

This domain covers day-to-day firewall operations on PAN-OS: software upgrades, HA synchronization, time/NTP configuration, and interface modes such as virtual wire. Questions are scenario-based, asking you to diagnose a failed upgrade or sync, identify a misconfiguration from an exhibit, or select valid configuration steps.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Device Management and Services

Practice 10 questions Browse domain →

What the exam tests

What to know about Device Management and Services

Be able to upgrade PAN-OS in the correct order, keep HA peers on matching versions, fix time/NTP issues, and configure a virtual wire end to end. The single most important thing: verify both HA peers run the same PAN-OS version before expecting sync to succeed.

PAN-OS upgrade paths, base image installation, and HA active/passive sync requirements after upgrade

Virtual wire configuration: assigning interfaces, zones, and security policy for transparent traffic

NTP and timezone settings that keep logs, certificates, and HA timestamps consistent

Valid versus invalid methods for installing PAN-OS software and content updates

Watch out for

Common Device Management and Services exam traps

▸Upgrading the passive HA peer without matching the active peer's PAN-OS version, breaking config sync
▸Assuming any upload method installs PAN-OS; only supported paths like the web UI or SCP work
▸Forgetting that vwire interfaces need zones and policy before traffic passes, not just interface assignment

Practice set

Device Management and Services questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Device Management and Services explanation →

During a firewall upgrade from PAN-OS 9.1 to 10.0, the administrator receives an error that the upgrade cannot proceed because there is a pending commit. The administrator checks the commit status and sees that a commit was initiated but has not completed. What is the best course of action?

Trap 1: Reboot the firewall to clear the pending commit

Rebooting could cause configuration loss and is not recommended.

Trap 2: Wait for the commit to complete automatically

If the commit is hung, waiting may not help.

Trap 3: Cancel the upgrade and restart

The pending commit must be resolved first.

Study all Device Management and Services common traps →

A
Reboot the firewall to clear the pending commit
Why it fails: Rebooting could cause configuration loss and is not recommended.
B
Run 'commit force yes' from the CLI to force the commit
Forcing the commit will complete or abort the pending commit, clearing the block.
C
Wait for the commit to complete automatically
Why it fails: If the commit is hung, waiting may not help.
D
Cancel the upgrade and restart
Why it fails: The pending commit must be resolved first.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Device Management and Services explanation →

An administrator needs to back up the firewall configuration before making changes. Which method creates a complete backup that can be restored to the same or a different firewall?

Trap 1: Use the 'Device > Setup > Operations > Save named configuration…

This saves a device state snapshot, not a full configuration backup.

Trap 2: Use the 'Save Candidate Config' option in the GUI

This saves only the candidate config, not the running config.

Trap 3: Use the CLI command 'show config running' and copy the output

This displays the config but does not create a file for restore.

Study all Device Management and Services common traps →

A
Use the 'Device > Setup > Operations > Save named configuration snapshot' option
Why it fails: This saves a device state snapshot, not a full configuration backup.
B
Use the 'Save Candidate Config' option in the GUI
Why it fails: This saves only the candidate config, not the running config.
C
Use the CLI command 'show config running' and copy the output
Why it fails: This displays the config but does not create a file for restore.
D
Use the 'Device > Setup > Operations > Export named configuration snapshot' and select 'running-config.xml'
Exporting the running-config.xml snapshot captures the complete, restorable configuration, including policy and network settings, so it can be imported onto the same or a different firewall. Device state and logs are excluded, keeping the file portable.

Full breakdown with real-world context →

Question 3mediummulti select

Read the full Device Management and Services explanation →

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Trap 1: Using the GUI under Device > Dynamic Updates > Content Updates

That is for threat and application updates, not PAN-OS.

Trap 2: Downloading the image via SCP and using 'load software'

'load software' is not a valid command; the correct command is 'request system software upgrade'.

Trap 3: Using Panorama's 'Software' tab to push an upgrade to the firewall

Panorama can push upgrades to managed firewalls, but the question asks for methods on the firewall itself.

Study all Device Management and Services common traps →

A
Using the GUI under Device > Dynamic Updates > Software
The web interface's Device > Dynamic Updates > Software section lets administrators check for, download, and install PAN-OS versions on the firewall, making it a supported upgrade method. It satisfies the requirement for a valid GUI-based upgrade path.
B
Using the CLI command 'request system software upgrade install version <version>'
The CLI command 'request system software upgrade install version <version>' triggers the PAN-OS upgrade directly from the firewall's command line, making it a supported method. It satisfies the requirement for a valid CLI-based upgrade path.
C
Using the GUI under Device > Dynamic Updates > Content Updates
Why it fails: That is for threat and application updates, not PAN-OS.
D
Downloading the image via SCP and using 'load software'
Why it fails: 'load software' is not a valid command; the correct command is 'request system software upgrade'.
E
Using Panorama's 'Software' tab to push an upgrade to the firewall
Why it fails: Panorama can push upgrades to managed firewalls, but the question asks for methods on the firewall itself.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Device Management and Services explanation →

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Trap 1: Using the CLI command 'save config to tftp'

This saves configuration, not tech support.

Trap 2: Using the GUI under Monitor > Packet Capture

That is for packet captures, not tech support.

Trap 3: Using the CLI command 'show tech-support'

This displays output but does not generate a downloadable file.

Study all Device Management and Services common traps →

A
Using the CLI command 'save config to tftp'
Why it fails: This saves configuration, not tech support.
B
Using the GUI under Monitor > Packet Capture
Why it fails: That is for packet captures, not tech support.
C
Using the GUI under Device > Troubleshooting > Generate Tech Support File
The GUI path Device > Troubleshooting > Generate Tech Support File directly satisfies the requirement for a supported collection method. It triggers the firewall to compile logs, configuration and diagnostic data into a single archive, which can then be downloaded locally or exported to a server, without requiring CLI access.
D
Using the CLI command 'generate tech-support file'
The CLI command `generate tech-support file` directly produces the diagnostic archive on the firewall itself, satisfying the requirement to collect a technical support file without external tooling. It gathers logs, configuration and system state into a single bundle, making it a valid native collection method alongside the GUI equivalent.
E
Using the CLI command 'show tech-support'
Why it fails: This displays output but does not generate a downloadable file.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Device Management and Services explanation →

Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?

Exhibit

Refer to the exhibit.

admin@PA-3020> show running security-policy

rulebase security rules
  rule 1 name "Allow-Sales"
    source [ 10.1.1.0/24 ]
    destination [ 192.168.1.0/24 ]
    application [ ms-sql ]
    service [ tcp-1433 ]
    action allow
    log-start no
  rule 2 name "Allow-HR"
    source [ 10.1.2.0/24 ]
    destination [ 192.168.2.0/24 ]
    application [ web-browsing ]
    service [ application-default ]
    action allow
    log-start yes

admin@PA-3020> show session id 12345
Source IP: 10.1.1.50
Destination IP: 192.168.1.100
Application: ssl
Service: tcp-443

admin@PA-3020> show log traffic | match 10.1.1.50
... no results ...

Trap 1: Interzone-default

The Interzone-default rule denies interzone traffic by default, but it is not matched because a more specific rule (Rule 1) matches first.

Trap 2: Intrazone-default

The Intrazone-default rule applies only to traffic within the same zone, but the source and destination are in different zones.

Trap 3: Rule 2 (Allow-HR)

Rule 2 permits traffic from the HR zone, but the source (10.1.1.50) belongs to the Sales zone, so it does not match.

Study all Device Management and Services common traps →

A
Interzone-default
Why it fails: The Interzone-default rule denies interzone traffic by default, but it is not matched because a more specific rule (Rule 1) matches first.
B
Intrazone-default
Why it fails: The Intrazone-default rule applies only to traffic within the same zone, but the source and destination are in different zones.
C
Rule 2 (Allow-HR)
Why it fails: Rule 2 permits traffic from the HR zone, but the source (10.1.1.50) belongs to the Sales zone, so it does not match.
D
Rule 1 (Allow-Sales)
With no traffic log entry, the session is being denied before logging, meaning an earlier rule matched and blocked it. Rule 1 sits above the logging rules, so its action terminates evaluation for 10.1.1.50 traffic.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Device Management and Services explanation →

A company has two Palo Alto Networks firewalls in an active/passive HA pair (PA-5250) running PAN-OS 10.1. The HA configuration uses dedicated HA1 (control link) and HA2 (data link) interfaces. The network team recently replaced a failed switch that connected the HA1 interfaces. After the switch replacement, the HA pair is not forming. The administrator logs into the active firewall and runs 'show high-availability state' which shows the local state as 'active' and the peer state as 'unknown'. The HA1 interface status shows 'link down'. The administrator checks the physical connections and confirms the cables are connected and the switch ports are up. What is the most likely cause and the best course of action?

Trap 1: Ensure that the HA2 interfaces are also connected and configured…

HA2 is for data synchronization, not for control plane communication. HA formation relies on HA1.

Trap 2: Change the HA2 IP addresses to be on the same subnet as HA1

HA1 and HA2 should be on different subnets to avoid conflicts.

Trap 3: Enable HA ping on the HA1 interface to test connectivity

HA ping is a monitoring feature, not a prerequisite for HA formation.

Study all Device Management and Services common traps →

A
Ensure that the HA2 interfaces are also connected and configured correctly
Why it fails: HA2 is for data synchronization, not for control plane communication. HA formation relies on HA1.
B
Change the HA2 IP addresses to be on the same subnet as HA1
Why it fails: HA1 and HA2 should be on different subnets to avoid conflicts.
C
Enable HA ping on the HA1 interface to test connectivity
Why it fails: HA ping is a monitoring feature, not a prerequisite for HA formation.
D
Verify that the HA1 interfaces are on the same VLAN and can ping each other using the configured HA1 IP addresses
HA1 link down despite cabled, up switch ports points to a Layer 2 mismatch after the switch swap. HA1 peers must share a VLAN and reach each other's configured HA1 IP addresses; verifying VLAN membership and mutual ping confirms connectivity before deeper HA troubleshooting.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Device Management and Services explanation →

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

Trap 1: Check the System log for related entries

System log records admin actions, not traffic denials.

Trap 2: Run a packet capture on the ingress interface

Packet capture is more detailed and typically used after identifying a potential issue in the logs.

Trap 3: Check the global counters for dropped packets

Global counters show aggregate drops, not per-session details.

Study all Device Management and Services common traps →

A
Check the System log for related entries
Why it fails: System log records admin actions, not traffic denials.
B
Run a packet capture on the ingress interface
Why it fails: Packet capture is more detailed and typically used after identifying a potential issue in the logs.
C
Check the global counters for dropped packets
Why it fails: Global counters show aggregate drops, not per-session details.
D
Check the Traffic log with the session's source IP and destination
Traffic log shows the rule that matched and the action taken.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Device Management and Services explanation →

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Trap 1: Define a NAT policy to translate internal IPs to the external…

NAT does not enable inspection; it translates addresses.

Trap 2: Enable SSL decryption on the firewall

Decryption is for encrypted traffic, not a requirement for general inspection.

Trap 3: Configure a virtual wire between the internal and external…

Virtual wire is for transparent mode, not layer 3.

Study all Device Management and Services common traps →

A
Create a security policy rule that allows traffic from the internal zone to the external zone
Security policies enforce inspection and control.
B
Define a NAT policy to translate internal IPs to the external interface
Why it fails: NAT does not enable inspection; it translates addresses.
C
Enable SSL decryption on the firewall
Why it fails: Decryption is for encrypted traffic, not a requirement for general inspection.
D
Configure a virtual wire between the internal and external interfaces
Why it fails: Virtual wire is for transparent mode, not layer 3.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Device Management and Services explanation →

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

Trap 1: The destination IP is not covered by a NAT policy

NAT is not required for outbound FTP.

Trap 2: Logging is not enabled on the rule

Logging does not affect whether traffic is allowed.

Trap 3: The rule is set to deny instead of allow

The administrator created the rule to allow.

Study all Device Management and Services common traps →

A
The destination IP is not covered by a NAT policy
Why it fails: NAT is not required for outbound FTP.
B
Logging is not enabled on the rule
Why it fails: Logging does not affect whether traffic is allowed.
C
The rule is set to deny instead of allow
Why it fails: The administrator created the rule to allow.
D
The FTP application requires additional configuration for passive mode
FTP uses dynamic ports; the firewall needs to inspect control channel to allow data channel.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Device Management and Services explanation →

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

Trap 1: Ensure that logging is enabled on the rule

Logging does not affect rule matching.

Trap 2: Check the zone configuration for the destination

Zone mismatch could cause rule not to match, but the log shows another rule matched.

Trap 3: Verify that the source and destination IP ranges are correct

The IPs are within the specified subnets.

Study all Device Management and Services common traps →

A
Ensure that logging is enabled on the rule
Why it fails: Logging does not affect rule matching.
B
Review the application specified in the rule and the actual traffic
The rule uses 'web-browsing' but traffic is HTTPS (ssl), so the rule does not match.
C
Check the zone configuration for the destination
Why it fails: Zone mismatch could cause rule not to match, but the log shows another rule matched.
D
Verify that the source and destination IP ranges are correct
Why it fails: The IPs are within the specified subnets.

Full breakdown with real-world context →

Question 11mediummulti select

Review the full routing breakdown →

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Trap 1: Set the administrative distance for the default route

Default route is optional.

Trap 2: Configure OSPF as the routing protocol

OSPF is optional; static routes can be used.

Trap 3: Configure route redistribution

Redistribution is optional.

Study all Device Management and Services common traps →

A
Set the administrative distance for the default route
Why it fails: Default route is optional.
B
Define at least one static route or enable a dynamic routing protocol
A route is needed to forward traffic.
C
Configure OSPF as the routing protocol
Why it fails: OSPF is optional; static routes can be used.
D
Configure route redistribution
Why it fails: Redistribution is optional.
E
Assign at least one layer 3 interface to the virtual router
An interface must be assigned for routing.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Device Management and Services explanation →

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Exhibit

> show system info

hostname: PA-5250
model: PA-5250
sw-version: 10.1.3
app-version: 8340-5987
threat-version: 8340-5987

> show running ip-route

destination: 0.0.0.0/0
nexthop: 10.0.0.1
interface: ethernet1/1

> show interface ethernet1/1

interface: ethernet1/1
state: up
ip address: 10.0.0.2/24
zone: external

> show interface ethernet1/2

interface: ethernet1/2
state: down
ip address: 192.168.1.1/24
zone: internal

Trap 1: The internal interface has no IP address assigned

An interface without an IP address cannot be assigned to a functioning zone or match policy, yet the stem's policy already references the internal zone successfully. It is tempting because addressing faults commonly cause connectivity loss, and it would be correct if the exhibit showed the interface unaddressed.

Trap 2: The internal zone is not configured

The stem states a security policy already allows traffic from the internal zone, which cannot exist unless that zone is defined and bound to an interface. It is tempting because an unconfigured zone does block policy matching, and it would be correct if the policy referenced a zone absent from the configuration.

Trap 3: The default route is missing

A missing default route would break all external destinations, yet the stem describes a security policy already permitting internal-to-external traffic, so the failure lies elsewhere in the flow. It is tempting because routing is the classic cause of no-internet symptoms, and it would be correct if no route to 0.0.0.0/0 existed at all.

Study all Device Management and Services common traps →

A
The internal interface has no IP address assigned
Why it fails: An interface without an IP address cannot be assigned to a functioning zone or match policy, yet the stem's policy already references the internal zone successfully. It is tempting because addressing faults commonly cause connectivity loss, and it would be correct if the exhibit showed the interface unaddressed.
B
The internal zone is not configured
Why it fails: The stem states a security policy already allows traffic from the internal zone, which cannot exist unless that zone is defined and bound to an interface. It is tempting because an unconfigured zone does block policy matching, and it would be correct if the policy referenced a zone absent from the configuration.
C
The default route is missing
Why it fails: A missing default route would break all external destinations, yet the stem describes a security policy already permitting internal-to-external traffic, so the failure lies elsewhere in the flow. It is tempting because routing is the classic cause of no-internet symptoms, and it would be correct if no route to 0.0.0.0/0 existed at all.
D
The internal interface (ethernet1/2) is administratively down
An administratively down internal interface (ethernet1/2) prevents traffic from entering the firewall from 192.168.1.0/24, so the permitting security policy never matches. Bringing the interface up restores connectivity; policy or NAT misconfigurations would not cause total internal-side failure.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Device Management and Services explanation →

A security administrator manages a Palo Alto Networks firewall with multiple virtual systems (vsys). The firewall is configured to use Panorama for centralized management. The administrator notices that after committing a configuration change on Panorama, the firewall's vsys2 is not receiving the updated configuration. The firewall can reach Panorama, and other vsys are updated correctly. The administrator verifies that Panorama's device group hierarchy includes the firewall and that the vsys2 template stack is correctly assigned. What is the most likely cause of this issue?

Trap 1: The commit on Panorama failed for vsys2 due to a validation error.

If the commit failed, Panorama would indicate a failure. The administrator did not mention any error.

Trap 2: The admin user does not have sufficient privileges to push…

The admin user role affects the ability to modify configurations, but Panorama pushes regardless of the role that committed.

Trap 3: The firewall's serial number is not registered correctly in…

The serial number is used for authentication at the firewall level, not for targeting specific vsys.

Study all Device Management and Services common traps →

A
The commit on Panorama failed for vsys2 due to a validation error.
Why it fails: If the commit failed, Panorama would indicate a failure. The administrator did not mention any error.
B
The admin user does not have sufficient privileges to push configuration to vsys2.
Why it fails: The admin user role affects the ability to modify configurations, but Panorama pushes regardless of the role that committed.
C
The vsys2 is not included in the device group on Panorama.
For Panorama to push configuration to a specific vsys, that vsys must be part of the device group. If vsys2 is omitted, it won't receive the update.
D
The firewall's serial number is not registered correctly in Panorama for vsys2.
Why it fails: The serial number is used for authentication at the firewall level, not for targeting specific vsys.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full Device Management and Services explanation →

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Define address objects, then zones, then application/service, then…

This order is incorrect because zones must be defined first as they are fundamental to the policy structure; address objects depend on zone context.

Trap 2: Define zones, then address objects, then action, then…

This order is incorrect because you must specify the application/service before setting the action; the action depends on knowing which application/service is being allowed or denied.

Trap 3: Commit, then define zones, then address objects, then…

This order is incorrect because commit is the final step to apply changes; all configuration steps must precede the commit.

Study all Device Management and Services common traps →

A
Define zones, then address objects, then application/service, then action, then commit
This is the correct order because security policies are built hierarchically: zones define the traffic source/destination, address objects specify the endpoints, application/service identifies the traffic type, action dictates the response, and commit applies the changes.
B
Define address objects, then zones, then application/service, then action, then commit
Why it fails: This order is incorrect because zones must be defined first as they are fundamental to the policy structure; address objects depend on zone context.
C
Define zones, then address objects, then action, then application/service, then commit
Why it fails: This order is incorrect because you must specify the application/service before setting the action; the action depends on knowing which application/service is being allowed or denied.
D
Commit, then define zones, then address objects, then application/service, then action
Why it fails: This order is incorrect because commit is the final step to apply changes; all configuration steps must precede the commit.

Full breakdown with real-world context →

Question 15mediummatching

Read the full Device Management and Services explanation →

Match each Palo Alto Networks feature to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Identifies applications regardless of port

Maps IP addresses to usernames

Inspects files and data for threats

Cloud-based malware analysis

VPN client for remote access

Trap 1: App-ID: Maps users to IP addresses for policy enforcement

Incorrect — this describes User-ID, not App-ID. App-ID identifies applications, not users.

Trap 2: User-ID: Identifies applications traversing the network regardless…

Incorrect — this describes App-ID, not User-ID. User-ID maps users to IP addresses.

Study all Device Management and Services common traps →

A
App-ID: Identifies applications traversing the network regardless of port
App-ID uses signatures and behavioral analysis to identify applications, enabling policy enforcement based on app identity.
B
User-ID: Maps users to IP addresses for policy enforcement
User-ID integrates with directory services to map usernames to IP addresses, allowing user-based firewall policies.
C
Content-ID: Inspects content within applications to block threats and data
Content-ID performs deep packet inspection to detect and block malicious files, data patterns, and vulnerabilities.
D
WildFire: Cloud-based threat analysis for unknown files and links
WildFire submits unknown samples to a cloud sandbox for dynamic analysis and generates signatures for new threats.
E
App-ID: Maps users to IP addresses for policy enforcement
Why it fails: Incorrect — this describes User-ID, not App-ID. App-ID identifies applications, not users.
F
User-ID: Identifies applications traversing the network regardless of port
Why it fails: Incorrect — this describes App-ID, not User-ID. User-ID maps users to IP addresses.

Full breakdown with real-world context →

Question 16mediummatching

Read the full Device Management and Services explanation →

Match each protocol to its default port used by Palo Alto Networks.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

N/A (ICMP)

161

Trap 1: HTTPS: 22

Incorrect — port 22 is used by SSH, not HTTPS.

Trap 2: SSH: 80

Incorrect — port 80 is used by HTTP, not SSH.

Trap 3: HTTP: 443

Incorrect — port 443 is used by HTTPS, not HTTP.

Study all Device Management and Services common traps →

A
HTTPS: 443
HTTPS uses port 443 by default for secure management access.
B
SSH: 22
SSH uses port 22 by default for secure CLI management.
C
HTTP: 80
HTTP uses port 80 by default (though often redirected to HTTPS for security).
D
HTTPS: 22
Why it fails: Incorrect — port 22 is used by SSH, not HTTPS.
E
SSH: 80
Why it fails: Incorrect — port 80 is used by HTTP, not SSH.
F
HTTP: 443
Why it fails: Incorrect — port 443 is used by HTTPS, not HTTP.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Device Management and Services explanation →

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

Trap 1: Create local accounts for all engineers and sync with AD manually.

Incorrect: Manual sync is impractical and does not leverage AD.

Trap 2: Use Kerberos authentication only.

Incorrect: Kerberos requires a KDC and no fallback is configured.

Trap 3: Configure only RADIUS authentication and disable local…

Incorrect: If RADIUS fails, no access possible; local account is needed for emergency.

Study all Device Management and Services common traps →

A
Create local accounts for all engineers and sync with AD manually.
Why it fails: Incorrect: Manual sync is impractical and does not leverage AD.
B
Use Kerberos authentication only.
Why it fails: Incorrect: Kerberos requires a KDC and no fallback is configured.
C
Configure only RADIUS authentication and disable local authentication.
Why it fails: Incorrect: If RADIUS fails, no access possible; local account is needed for emergency.
D
Enable local authentication and configure RADIUS as the primary authentication method with local fallback.
Correct: This allows AD authentication while local admin account remains available for fallback.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Device Management and Services explanation →

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

Trap 1: Subscribe to the WildFire cloud and rely on updates.

Incorrect: WildFire provides analysis but not immediate signature updates; it distributes signatures periodically.

Trap 2: Set the content update schedule to check every minute.

Incorrect: The minimum schedule interval is 15 minutes, not 1 minute.

Trap 3: Manually download the latest content from the support portal and…

Incorrect: Manual process is slower and not automated.

Study all Device Management and Services common traps →

A
Subscribe to the WildFire cloud and rely on updates.
Why it fails: Incorrect: WildFire provides analysis but not immediate signature updates; it distributes signatures periodically.
B
Set the content update schedule to check every minute.
Why it fails: Incorrect: The minimum schedule interval is 15 minutes, not 1 minute.
C
Manually download the latest content from the support portal and upload via CLI.
Why it fails: Incorrect: Manual process is slower and not automated.
D
Enable 'automatic download' for the threat prevention content and set the schedule to 'check now'.
Correct: This triggers an immediate download of the latest content.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Device Management and Services explanation →

An administrator makes several changes to the firewall configuration and commits. However, after the commit, users report connectivity issues. The administrator wants to revert to the previous configuration quickly without losing the changes that were made earlier in the day but not yet committed. What should the administrator do?

Trap 1: Issue the 'revert to last known good configuration' command.

Incorrect: There is no such command in PAN-OS.

Trap 2: Use 'show configuration saved' and copy the previous config.

Incorrect: This is a manual process and does not preserve uncommitted changes easily.

Trap 3: Reboot the firewall to load the previous running config.

Incorrect: Reboot loads the current running config (the problematic one), not a previous version.

Study all Device Management and Services common traps →

A
Issue the 'revert to last known good configuration' command.
Why it fails: Incorrect: There is no such command in PAN-OS.
B
Use 'show configuration saved' and copy the previous config.
Why it fails: Incorrect: This is a manual process and does not preserve uncommitted changes easily.
C
Use the 'commit revert' command to revert to before the problematic commit.
Correct: This reverts the configuration to the previous state while keeping uncommitted changes in the candidate.
D
Reboot the firewall to load the previous running config.
Why it fails: Incorrect: Reboot loads the current running config (the problematic one), not a previous version.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full network assurance explanation →

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Trap 1: Use the CLI command 'set snmp trap' with the receiver IP.

Incorrect: No such CLI command; configuration is done via web UI or CLI set commands under device config.

Trap 2: Configure an SNMP manager and select the traps to send.

Incorrect: There is no 'SNMP manager' object in PAN-OS; trap configuration is via server profiles.

Trap 3: Enable SNMP on the management interface and set the trap…

Incorrect: This only enables SNMP but does not configure which logs generate traps.

Study all Device Management and Services common traps →

A
Use the CLI command 'set snmp trap' with the receiver IP.
Why it fails: Incorrect: No such CLI command; configuration is done via web UI or CLI set commands under device config.
B
Configure an SNMP manager and select the traps to send.
Why it fails: Incorrect: There is no 'SNMP manager' object in PAN-OS; trap configuration is via server profiles.
C
Enable SNMP on the management interface and set the trap destination.
Why it fails: Incorrect: This only enables SNMP but does not configure which logs generate traps.
D
Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.
Correct: SNMP server profile defines trap destinations; log forwarding profile selects which logs trigger traps.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Device Management and Services sessions

Start a Device Management and Services only practice session

Every question in these sessions is drawn from the Device Management and Services domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Device Management and Services questions →Mixed PCNSA session

Frequently asked questions

What does the PCNSA exam test about Device Management and Services?: Be able to upgrade PAN-OS in the correct order, keep HA peers on matching versions, fix time/NTP issues, and configure a virtual wire end to end. The single most important thing: verify both HA peers run the same PAN-OS version before expecting sync to succeed.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Device Management and Services questions in a focused session?: Yes — the session launcher on this page draws every question from the Device Management and Services domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSA topics?: Use the topic links above to move to related areas, or go back to the PCNSA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSA exam covers. They are not copied from any real exam or dump site.

Device Management and Services only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSA questions Device Management and Services domain overview PCNSA exam guide

Exam traps to avoid

▸Upgrading the passive HA peer without matching the active peer's PAN-OS version, breaking config sync
▸Assuming any upload method installs PAN-OS; only supported paths like the web UI or SCP work
▸Forgetting that vwire interfaces need zones and policy before traffic passes, not just interface assignment

Device Management and Services practice questions

What to know about Device Management and Services

Common Device Management and Services exam traps

Device Management and Services questions

During a firewall upgrade from PAN-OS 9.1 to 10.0, the administrator receives an error that the upgrade cannot proceed because there is a pending commit. The administrator checks the commit status and sees that a commit was initiated but has not completed. What is the best course of action?

An administrator needs to back up the firewall configuration before making changes. Which method creates a complete backup that can be restored to the same or a different firewall?

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1.100 on TCP port 443. The traffic log shows no entries for that source IP. Which security rule is expected to match this traffic?

Exhibit

A security engineer needs to ensure that all traffic from the internal network to the internet is inspected by the firewall. The firewall is deployed in virtual wire mode (Layer 2) with subinterfaces. Which configuration is required to achieve this?

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

Exhibit

Drag and drop the steps to configure a security policy on a Palo Alto Networks firewall into the correct order.

Match each Palo Alto Networks feature to its primary function.

Match each protocol to its default port used by Palo Alto Networks.

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

After a new zero-day exploit is discovered, a firewall must receive the latest threat prevention signature immediately. What is the most effective method to ensure the firewall gets the update as soon as it is released?

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

Track your progress over time

Start a Device Management and Services only practice session

Related PCNSA topic practice pages

Managing Objects practice questions

Securing Traffic practice questions

Policy Evaluation and Management practice questions