PCNSA Managing Objects Practice Question
Which object type is used to group multiple service objects together for use in a security policy?
⚠ Common exam trap
It's easy for candidates to confuse 'service group' with 'address group' because both are grouping constructs, but they serve entirely different purposes — one for ports/protocols and one for IP addresses — and the exam expects you to know which object type applies to which policy element.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service group
A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Schedule
Why it's wrong here
Schedules define when policy rules apply, not which services they match; service groups bundle service objects. It is tempting because schedules are policy components, and a schedule would be correct for time-based rule enforcement, not for grouping services.
- ✗
Tag
Why it's wrong here
Tags classify policy traffic by metadata labels and cannot aggregate service objects for reuse. They are tempting because tags drive dynamic policy matching and rule filtering, but grouping ports and protocols into one referenced unit requires a service group, not a tag.
- ✓
Service group
Why this is correct
A service group holds multiple service objects, letting a single policy rule reference them collectively. This matches the stem's need to group services for use in a security policy, unlike individual service objects or application filters.
- ✗
Address group
Why it's wrong here
Address groups bundle IP addresses or subnets, not service objects, so they cannot satisfy a policy rule referencing multiple ports and protocols. They are tempting because groups reduce object sprawl, but the correct construct for aggregating services is a service group.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.