PCNSA Device Management and Services Practice Question
Which license is required for the firewall to use URL filtering?
⚠ Common exam trap
It's easy for candidates to assume Threat Prevention or WildFire includes URL filtering, but Palo Alto Networks separates these as distinct subscriptions, and only the URL Filtering license enables URL categorization and policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
URL Filtering
URL filtering requires a dedicated URL Filtering license on Palo Alto Networks firewalls to enable the firewall to query the PAN-DB cloud or use a locally installed URL database for categorizing URLs. Without this license, the firewall cannot perform URL-based access control, even if other security subscriptions like Threat Prevention or WildFire are active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS Security
Why it's wrong here
DNS Security licenses DNS sinkholing and DNS-based command-and-control detection, not URL category lookups. It tempts because DNS filtering also blocks malicious domains, but URL filtering requires the URL Filtering licence, which supplies the PAN-DB category database queried per HTTP request.
- ✗
GlobalProtect
Why it's wrong here
GlobalProtect is the VPN and endpoint agent subscription, providing host posture and tunnel connectivity, not URL category data. It tempts because remote users' web traffic traverses the firewall, but URL filtering still requires the separate URL Filtering licence for PAN-DB category lookups.
- ✓
URL Filtering
Why this is correct
URL Filtering is a licensed subscription that activates the PAN-DB URL database on the firewall, enabling category-based and custom URL policy enforcement. Without this licence, the firewall cannot query PAN-DB, so the URL filtering profile cannot classify traffic. It directly satisfies the stem's requirement for the licence needed to use URL filtering.
- ✗
WildFire
Why it's wrong here
WildFire licences cloud sandboxing of files and links to detect zero-day malware, not URL category enforcement. It tempts because WildFire inspects web-delivered content, but category-based allow or block decisions need the URL Filtering licence and its PAN-DB lookups.
- ✗
Threat Prevention
Why it's wrong here
Threat Prevention licenses IPS signatures, antivirus and anti-spyware scanning, not URL category matching. It tempts because it also inspects web sessions for exploits, but blocking by URL category demands the URL Filtering licence, which enables PAN-DB lookups per request.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.