Managing Objects practice questions

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Trap 1: Execute 'set address-group <name> add ip <ip>' in CLI.

Incorrect: The CLI command syntax is wrong; you must specify an existing address object name, not an IP address directly.

Trap 2: Navigate to Objects > Address Groups, select the group, and click…

Incorrect: The 'Add' button only allows selection from existing address objects; you cannot type an IP address directly into the group editor.

Trap 3: Use the Panorama template to 'push' the IP address directly into…

Incorrect: Panorama templates are used for bulk configuration deployment, not for adding individual IP addresses to groups.

A
Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.
Correct: The 'Show Group Membership' feature provides a direct way to add a new address object and include it in the group.
B
Execute 'set address-group <name> add ip <ip>' in CLI.
Why wrong: Incorrect: The CLI command syntax is wrong; you must specify an existing address object name, not an IP address directly.
C
Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.
Why wrong: Incorrect: The 'Add' button only allows selection from existing address objects; you cannot type an IP address directly into the group editor.
D
Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.
Why wrong: Incorrect: Panorama templates are used for bulk configuration deployment, not for adding individual IP addresses to groups.
E
Create a tag, assign it to the IP address, and add the tag to the group.
Correct: For dynamic address groups, adding a tag to an address object and including that tag in the group automatically adds the address.

Read the full DNS explanation →

Question 2hardmultiple choice

An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?

Trap 1: The service group includes only UDP service objects

This is incorrect because the stem explicitly states that the service group contains both TCP and UDP service objects. Therefore, the issue is not a missing TCP object.

Trap 2: The security policy action is set to deny

This is unlikely because the question states 'the rule is intended to allow DNS traffic,' so the action should not be set to deny. If it were, no DNS traffic would pass, but the issue is specifically TCP DNS, not all DNS.

Trap 3: The service group is incorrectly configured

This is too vague. The service group is configured correctly (both TCP and UDP 53), according to the stem. The issue lies elsewhere, such as missing application objects.

A
The service group includes only UDP service objects
Why wrong: This is incorrect because the stem explicitly states that the service group contains both TCP and UDP service objects. Therefore, the issue is not a missing TCP object.
B
The rule requires a separate application object
This is correct. The rule likely lacks an application object for DNS. In Palo Alto firewalls, even with correct service definitions, the rule must include the appropriate application (e.g., 'dns') to match the traffic using App-ID.
C
The security policy action is set to deny
Why wrong: This is unlikely because the question states 'the rule is intended to allow DNS traffic,' so the action should not be set to deny. If it were, no DNS traffic would pass, but the issue is specifically TCP DNS, not all DNS.
D
The service group is incorrectly configured
Why wrong: This is too vague. The service group is configured correctly (both TCP and UDP 53), according to the stem. The issue lies elsewhere, such as missing application objects.

Question 3easymulti select

Which THREE of the following are valid types of address objects in Palo Alto Networks? (Choose three.)

Trap 1: MAC Address

Incorrect. MAC Address is not a valid address object type in PAN-OS.

Trap 2: URL Category

Incorrect. URL Category is not an address object but a separate category used in URL filtering.

A
IP Range
Correct. IP Range is a valid address object type.
B
IP Netmask
Correct. IP Netmask is a valid address object type.
C
FQDN
Correct. FQDN is also a valid address object type in Palo Alto Networks.
D
MAC Address
Why wrong: Incorrect. MAC Address is not a valid address object type in PAN-OS.
E
URL Category
Why wrong: Incorrect. URL Category is not an address object but a separate category used in URL filtering.

Question 4mediummultiple choice

A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?

Trap 1: Create a security policy with a log setting at the end of the…

A default rule at the end may not catch traffic that is allowed by earlier rules without logging enabled.

Trap 2: Configure a log forwarding profile and apply it to each policy…

This requires manual configuration on each policy, increasing administrative overhead.

Trap 3: Use a policy optimizer to automatically add logging to policies.

Policy optimizer suggests changes but does not automatically enforce logging on all policies using a specific group.

A
Create a security policy with a log setting at the end of the rulebase that matches traffic to the group.
Why wrong: A default rule at the end may not catch traffic that is allowed by earlier rules without logging enabled.
B
Configure a log forwarding profile and apply it to each policy using the group.
Why wrong: This requires manual configuration on each policy, increasing administrative overhead.
C
Use a policy optimizer to automatically add logging to policies.
Why wrong: Policy optimizer suggests changes but does not automatically enforce logging on all policies using a specific group.
D
Use the address group in a security policy and enable logging at session end in that policy.
This single policy, when placed appropriately, will log all sessions to the group with minimal overhead.

Question 5easymultiple choice

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Trap 1: Tag

Tags are metadata, not used for source matching in policies.

Trap 2: Address group

Address groups are used for multiple addresses, not a single IP.

Trap 3: Region

Regions are geographical groupings, not for a single IP.

A
Address object
Address object directly defines a specific IP address.
B
Tag
Why wrong: Tags are metadata, not used for source matching in policies.
C
Address group
Why wrong: Address groups are used for multiple addresses, not a single IP.
D
Region
Why wrong: Regions are geographical groupings, not for a single IP.

Read the full VPN explanation →

Question 6mediummultiple choice

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Trap 1: External dynamic list

EDLs provide IP feeds, not NAT addresses.

Trap 2: Service group

Service groups define port/protocol sets, not translation addresses.

Trap 3: IPsec Crypto profile

Crypto profiles define encryption settings, not NAT addresses.

A
NAT address pool
NAT address pool specifies the translated IP addresses.
B
External dynamic list
Why wrong: EDLs provide IP feeds, not NAT addresses.
C
Service group
Why wrong: Service groups define port/protocol sets, not translation addresses.
D
IPsec Crypto profile
Why wrong: Crypto profiles define encryption settings, not NAT addresses.

Question 7hardmultiple choice

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Trap 1: Use a region object instead

Regions are geographical, not suitable for FQDNs.

Trap 2: Create a dynamic address group with a tag-based filter

Dynamic groups filter based on tags, not FQDN resolution.

Trap 3: Manually add all possible IP addresses to an address group

Not scalable and misses new IPs.

A
Use a region object instead
Why wrong: Regions are geographical, not suitable for FQDNs.
B
Create a dynamic address group with a tag-based filter
Why wrong: Dynamic groups filter based on tags, not FQDN resolution.
C
Use an FQDN object in the address group; the firewall resolves it automatically
FQDN objects automatically resolve and update IPs.
D
Manually add all possible IP addresses to an address group
Why wrong: Not scalable and misses new IPs.

Question 8mediummultiple choice

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Trap 1: Application filter

Filters are for broad categories, not specific apps.

Trap 2: Application group

Groups are for multiple applications, but the question implies specific applications.

Trap 3: Service object

Service objects define ports/protocols, not applications.

A
Application object
Application objects define specific applications like web-browsing.
B
Application filter
Why wrong: Filters are for broad categories, not specific apps.
C
Application group
Why wrong: Groups are for multiple applications, but the question implies specific applications.
D
Service object
Why wrong: Service objects define ports/protocols, not applications.

Question 9mediummulti select

Which TWO statements about External Dynamic Lists (EDLs) are true?

Trap 1: EDLs have a fixed refresh interval that cannot be changed.

The refresh interval is configurable.

Trap 2: EDLs must be manually updated by an administrator.

EDLs are automatically refreshed from an external source.

Trap 3: EDLs allow the administrator to add individual IPs directly via the…

EDLs are read-only in the GUI; IPs cannot be added manually.

A
EDLs can be used in security policy source and destination fields.
EDLs can be used as address objects in policies.
B
EDLs have a fixed refresh interval that cannot be changed.
Why wrong: The refresh interval is configurable.
C
EDLs must be manually updated by an administrator.
Why wrong: EDLs are automatically refreshed from an external source.
D
EDLs support both IP addresses and URLs.
EDLs can contain IPs, URLs, or domains.
E
EDLs allow the administrator to add individual IPs directly via the GUI.
Why wrong: EDLs are read-only in the GUI; IPs cannot be added manually.

Read the full DNS explanation →

Question 10hardmultiple choice

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Trap 1: The rule order is incorrect; a previous rule is denying the traffic.

The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.

Trap 2: The destination address object 10.10.0.0/16 is incorrect.

The subnet appears correct for the data center.

Trap 3: The source zone 'GP' should be 'untrust'.

GlobalProtect typically uses a dedicated zone 'GP'.

A
The application 'web-browsing' does not cover port 8080 traffic.
App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.
B
The rule order is incorrect; a previous rule is denying the traffic.
Why wrong: The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.
C
The destination address object 10.10.0.0/16 is incorrect.
Why wrong: The subnet appears correct for the data center.
D
The source zone 'GP' should be 'untrust'.
Why wrong: GlobalProtect typically uses a dedicated zone 'GP'.

Question 11mediummultiple choice

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

Exhibit

Refer to the exhibit.

deviceconfig {
    devices {
        localhost.localdomain {
            vsys {
                vsys1 {
                    address {
                        entry {
                            @name = "WebServer-1";
                            ip-netmask = "10.0.1.10/32";
                        }
                        entry {
                            @name = "WebServer-2";
                            ip-range = "10.0.1.20-10.0.1.25";
                        }
                        entry {
                            @name = "WebServers-Group";
                            dynamic {
                                filter = "'WebServer-*'";
                            }
                        }
                    }
                }
            }
        }
    }
}

Trap 1: The filter should include a tag condition because dynamic groups…

Tags are not required; name-based filters work with correct syntax.

Trap 2: The dynamic address group cannot use name-based filters; it…

Dynamic address groups can use name-based filters without tags.

Trap 3: The address object 'WebServer-2' uses an IP range, which is not…

Dynamic address groups support IP range objects.

A
The filter should include a tag condition because dynamic groups require tags.
Why wrong: Tags are not required; name-based filters work with correct syntax.
B
The dynamic address group cannot use name-based filters; it requires tags.
Why wrong: Dynamic address groups can use name-based filters without tags.
C
The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.
Why wrong: Dynamic address groups support IP range objects.
D
The filter should use double quotes instead of single quotes around the pattern.
Correct quote type is double quotes for the filter string.

Read the full VPN explanation →

Question 12hardmultiple choice

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

Trap 1: Create a static address group called 'All-Site-Networks' and…

Static group requires manual updates when sites change.

Trap 2: Create a security rule using the 'any' zone for source and…

Using 'any' would allow traffic to/from internet, violating the requirement.

Trap 3: Assign a tag 'Site-Network' to each site address object, then…

This approach fails because dynamic address groups filter individual address objects based on assigned tags, not other address groups. While assigning a tag to each site's *subnet address object* and creating a dynamic group would consolidate all site networks, it doesn't leverage the existing 'Site-A-Networks', 'Site-B-Networks' *address groups* directly. This method is tempting for its automation, as it simplifies management when new individual site subnets are added, automatically including them if tagged correctly. It would be ideal if the requirement was to group individual address objects, but the scenario already provides existing address groups for each site.

A
Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.
Why wrong: Static group requires manual updates when sites change.
B
Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.
Why wrong: Using 'any' would allow traffic to/from internet, violating the requirement.
C
Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.
Why wrong: This approach fails because dynamic address groups filter individual address objects based on assigned tags, not other address groups. While assigning a tag to each site's *subnet address object* and creating a dynamic group would consolidate all site networks, it doesn't leverage the existing 'Site-A-Networks', 'Site-B-Networks' *address groups* directly. This method is tempting for its automation, as it simplifies management when new individual site subnets are added, automatically including them if tagged correctly. It would be ideal if the requirement was to group individual address objects, but the scenario already provides existing address groups for each site.
D
Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.
Dynamic group automatically includes matching objects; minimal overhead.

Read the full VPN explanation →

Question 13mediumdrag order

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Configure IPsec crypto profile, then IKE gateway, then tunnel…

This is incorrect because the IPsec crypto profile (Phase 2) should be configured after the IKE gateway (Phase 1), as Phase 2 parameters depend on the IKE gateway's settings.

Trap 2: Configure IKE gateway, then IPsec crypto profile, then static…

This is incorrect because the static route references the tunnel interface, which must be created before the route can be added.

Trap 3: Configure security policy, then IKE gateway, then IPsec crypto…

This is incorrect because the security policy should be created after the tunnel interface and route are in place to ensure proper traffic flow, and the VPN configuration itself must precede the policy.

A
Configure IKE gateway, then IPsec crypto profile, then tunnel interface, then static route to tunnel interface, then security policy allowing VPN traffic.
This is the correct order because IKE gateway defines Phase 1 parameters, IPsec crypto profile defines Phase 2, the tunnel interface is created with the IPsec binding, the route directs traffic into the tunnel, and the security policy permits the traffic.
B
Configure IPsec crypto profile, then IKE gateway, then tunnel interface, then static route, then security policy.
Why wrong: This is incorrect because the IPsec crypto profile (Phase 2) should be configured after the IKE gateway (Phase 1), as Phase 2 parameters depend on the IKE gateway's settings.
C
Configure IKE gateway, then IPsec crypto profile, then static route, then tunnel interface, then security policy.
Why wrong: This is incorrect because the static route references the tunnel interface, which must be created before the route can be added.
D
Configure security policy, then IKE gateway, then IPsec crypto profile, then tunnel interface, then static route.
Why wrong: This is incorrect because the security policy should be created after the tunnel interface and route are in place to ensure proper traffic flow, and the VPN configuration itself must precede the policy.

Open the full VLAN trunking answer →

Question 14mediumdrag order

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Create VLAN object, then configure IP address on VLAN interface,…

This is incorrect because you cannot configure an IP address on a VLAN interface before assigning interfaces to the VLAN; the VLAN interface is not fully created until interfaces are assigned.

Trap 2: Create security policy, then create VLAN object, then assign Layer…

This is incorrect because you cannot create a security policy before the VLAN interface exists; the security policy references the VLAN interface, which must be created first.

Trap 3: Create VLAN object, then assign Layer 2 interfaces to VLAN, then…

This is incorrect because committing before creating a security policy would leave the VLAN interface unprotected; you must create the security policy before committing to ensure traffic is allowed.

A
Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then create security policy, then commit
This is the correct order because you must first create the VLAN, then assign interfaces to it, then assign an IP to the VLAN interface, then create a security policy to permit traffic, and finally commit the changes.
B
Create VLAN object, then configure IP address on VLAN interface, then assign Layer 2 interfaces to VLAN, then create security policy, then commit
Why wrong: This is incorrect because you cannot configure an IP address on a VLAN interface before assigning interfaces to the VLAN; the VLAN interface is not fully created until interfaces are assigned.
C
Create security policy, then create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit
Why wrong: This is incorrect because you cannot create a security policy before the VLAN interface exists; the security policy references the VLAN interface, which must be created first.
D
Create VLAN object, then assign Layer 2 interfaces to VLAN, then configure IP address on VLAN interface, then commit, then create security policy
Why wrong: This is incorrect because committing before creating a security policy would leave the VLAN interface unprotected; you must create the security policy before committing to ensure traffic is allowed.

Question 15mediummatching

Match each firewall deployment mode to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Passively monitors traffic without blocking

Transparent layer 2 deployment

Routable mode with IP addresses

Failover configuration with one standby unit

Trap 1: Layer 3 mode: Acts as a transparent bridge, forwarding traffic…

Incorrect — this describes Layer 2 mode, not Layer 3 mode.

Trap 2: Tap mode: Routes traffic between different subnets using IP…

Incorrect — this describes Layer 3 mode, not Tap mode.

Trap 3: Tap mode: Forwards traffic based on MAC addresses transparently.

Incorrect — Tap mode passively monitors traffic and does not forward; this describes Layer 2 or Virtual Wire mode.

A
Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.
Why wrong: Incorrect — this describes Layer 2 mode, not Layer 3 mode.
B
Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.
Correct — Virtual Wire mode forwards traffic transparently between paired interfaces.
C
Tap mode: Routes traffic between different subnets using IP addresses.
Why wrong: Incorrect — this describes Layer 3 mode, not Tap mode.
D
Layer 2 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.
Correct — Layer 2 mode is a transparent bridge that forwards traffic using MAC addresses.
E
Tap mode: Forwards traffic based on MAC addresses transparently.
Why wrong: Incorrect — Tap mode passively monitors traffic and does not forward; this describes Layer 2 or Virtual Wire mode.

Question 16mediummatching

Match each PAN-OS CLI command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays firewall version and uptime

Lists all interfaces and their status

Displays active security rules

Reboots the firewall

Trap 1: show system info: Displays the forwarding information base (FIB)…

Incorrect — 'show system info' displays system version and uptime, not FIB routes.

Trap 2: show route fib: Tests if a packet matches a security policy.

Incorrect — 'show route fib' displays the FIB routing table, not security policy testing.

A
show interface all: Displays all interfaces and their status.
The 'show interface all' command shows all interfaces with status, IP, and administrative state.
B
show system info: Displays the forwarding information base (FIB) routes.
Why wrong: Incorrect — 'show system info' displays system version and uptime, not FIB routes.
C
show route fib: Tests if a packet matches a security policy.
Why wrong: Incorrect — 'show route fib' displays the FIB routing table, not security policy testing.
D
test security-policy-match: Tests if a packet matches a security policy.
The 'test security-policy-match' command checks which security policy applies to a given source/destination.
E
debug dataplane packet-diag: Captures dataplane packet diagnostics for analysis.
This command enables packet capture on the dataplane for troubleshooting.

Question 17easymultiple choice

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Trap 1: Schedule

Schedules define time-based access, not destinations.

Trap 2: Service

Service objects define ports and protocols, not IP addresses or FQDNs.

Trap 3: Tag

Tags are used for grouping and identification, not for defining destinations.

A
Schedule
Why wrong: Schedules define time-based access, not destinations.
B
Service
Why wrong: Service objects define ports and protocols, not IP addresses or FQDNs.
C
Address
Address objects define IP addresses or FQDNs, making them suitable for specifying a destination.
D
Tag
Why wrong: Tags are used for grouping and identification, not for defining destinations.

Question 18mediummultiple choice

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Trap 1: The administrator must manually update the address object's IP…

Manual update is not required; the firewall handles resolution.

Trap 2: Only if the address group is dynamic will the update occur…

Dynamic groups are based on tags, not FQDN resolution. FQDN resolution happens regardless.

Trap 3: FQDN objects cannot be included in address groups.

FQDN objects are allowed in static address groups.

A
The administrator must manually update the address object's IP address.
Why wrong: Manual update is not required; the firewall handles resolution.
B
Only if the address group is dynamic will the update occur automatically.
Why wrong: Dynamic groups are based on tags, not FQDN resolution. FQDN resolution happens regardless.
C
FQDN objects cannot be included in address groups.
Why wrong: FQDN objects are allowed in static address groups.
D
The firewall automatically resolves the FQDN at commit and updates the group accordingly.
FQDN resolution occurs at commit, ensuring the group uses the current IP.

Question 19hardmultiple choice

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Trap 1: Device groups

Device groups are for Panorama management, not for sharing dynamic address groups directly.

Trap 2: Shared policy

Shared policy is a concept, but EDL is the mechanism for sharing dynamic groups.

Trap 3: Template stacks

Template stacks manage configuration templates, not dynamic address group sharing.

A
Device groups
Why wrong: Device groups are for Panorama management, not for sharing dynamic address groups directly.
B
Shared policy
Why wrong: Shared policy is a concept, but EDL is the mechanism for sharing dynamic groups.
C
Template stacks
Why wrong: Template stacks manage configuration templates, not dynamic address group sharing.
D
External Dynamic Lists
EDLs allow external lists to be referenced in policies and shared across firewalls.

Question 20easymultiple choice

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Trap 1: 22

Port 22 is used for SSH.

Trap 2: 443

Port 443 is used for HTTPS, not HTTP.

Trap 3: 8080

Port 8080 is an alternate HTTP port but not the default.

A
22
Why wrong: Port 22 is used for SSH.
B
443
Why wrong: Port 443 is used for HTTPS, not HTTP.
C
8080
Why wrong: Port 8080 is an alternate HTTP port but not the default.
D
80
Port 80 is the standard port for HTTP.