PCNSA Device Management and Services Practice Question
Which TWO are best practices for securing management access to a Palo Alto firewall? (Select two)
⚠ Common exam trap
Many exam-takers confuse 'disabling ping' (a minor, non-critical hardening step) with the core best practices of network segmentation and access control, leading them to select Option D instead of the more impactful Options C and E.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a dedicated management subnet
Using a dedicated management subnet (out-of-band management) isolates management traffic from production data traffic, reducing the attack surface and ensuring management access remains available even if the data plane is compromised. This is a foundational security best practice for any network device, including Palo Alto firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use HTTPS with self-signed certificates
Why it's wrong here
Self-signed certificates can lead to man-in-the-middle; use trusted CA certificates.
- ✗
Use SNMP v1 for monitoring
Why it's wrong here
SNMP v1 is insecure; use v3.
- ✓
Use a dedicated management subnet
Why this is correct
Segregates management traffic from production.
- ✗
Disable ping on the management interface
Why it's wrong here
Ping is useful for troubleshooting and not a security risk.
- ✓
Restrict management access to specific IP addresses
Why this is correct
IP whitelisting reduces attack surface.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.