PCNSE Core Concepts and Architecture Practice Question
A company recently deployed a Palo Alto Networks PA-5250 firewall in a data center. The firewall is configured with multiple virtual routers and is connected to an MPLS WAN router and an internet router. The network team reports that users can access internet resources but cannot reach a critical application hosted in a remote branch office over the MPLS link. The application uses TCP port 443 and is accessed via a fully qualified domain name (FQDN). The security policy includes a rule that allows traffic from the internal zone to the MPLS zone with the application 'ssl' and the destination address set to the FQDN of the application server. The internal DNS server resolves the FQDN correctly to the private IP address 10.20.30.40. The firewall has DNS proxy enabled, but the DNS server is configured as the internal DNS server. The administrator runs a packet capture and sees that the firewall is sending DNS queries for the FQDN to the internal DNS server but the response is not being used to update the dynamic address group (DAG) that is referenced in the security policy. The DAG is configured with a 'FQDN' match criteria. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume DNS Proxy automatically updates DAGs when FQDN match criteria are used, but Palo Alto requires an explicit checkbox to enable this behavior, and many overlook it because they focus on the DNS query/response flow rather than the DAG update configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object
The DNS Proxy object must have the 'Allow FQDN to be updated in DAG' option enabled for the firewall to use DNS responses to update the Dynamic Address Group (DAG) that matches on FQDN. Without this setting, the firewall sends DNS queries but ignores the responses for DAG updates, so the security policy rule referencing the DAG never matches the destination IP address (10.20.30.40), causing traffic to be dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a security policy rule to allow DNS traffic from the firewall to the internal DNS server
Why it's wrong here
DNS traffic is already allowed if the firewall can send queries and receive responses.
- ✗
Change the security policy to use the IP address instead of the FQDN
Why it's wrong here
The FQDN is resolved, but the DAG is not updating; using IP is a workaround but not the root cause.
- ✓
Enable the 'Allow FQDN to be updated in DAG' option in the DNS Proxy object
Why this is correct
This option must be enabled for the firewall to update DAGs based on DNS responses.
- ✗
Configure a static route for the FQDN's IP address pointing to the MPLS interface
Why it's wrong here
Routing is separate from DAG update; the firewall already has connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.