Question 486 of 504
How to Restrict SSH and HTTPS Management Access to a Trusted Subnet
A multinational organization uses a pair of PA-5250 firewalls in an active/passive high-availability configuration across two data centers. They need to ensure that all management traffic (SSH, HTTPS) to the firewalls is encrypted and sourced only from a dedicated management network (10.10.0.0/24). Which configuration meets these requirements?
Quick Answer
The correct answer is an interface management profile because it is the one mechanism purpose-built to control both the source and the protocol of traffic reaching the management interface itself, which is a different control point than security policy. Security policies govern traffic passing through the dataplane between zones; they have no authority over sessions destined for the firewall's own management plane. To restrict who can SSH or connect via HTTPS to the box, and from where, you configure a management profile that whitelists specific services and source subnets, then apply that profile directly to the interface. Because SSH and HTTPS are encrypted protocols by design, allowing only those two services on the profile satisfies the encryption requirement automatically, while limiting the profile's permitted source to 10.10.0.0/24 satisfies the sourcing requirement. This combination meets both stated needs in a single configuration object rather than requiring separate mechanisms for confidentiality and access restriction. The broader lesson is that whenever a scenario asks you to restrict how administrators reach the firewall's management interface, look for controls that live at the interface or management-profile level rather than reaching for security policy rules, which only govern transit traffic, not access to the device itself.
⚠ Common exam trap
Many exam-takers confuse data-plane security policies with management-plane access control, incorrectly assuming a security rule can restrict SSH/HTTPS to the firewall itself, when in fact interface management profiles are the only mechanism for that purpose on Palo Alto firewalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an interface management profile allowing SSH and HTTPS only from 10.10.0.0/24 and apply it to the management interface.
An interface management profile restricts allowed management services (SSH, HTTPS) to specific source IP addresses or subnets, and applying it to the management interface ensures only traffic from 10.10.0.0/24 can reach the firewall for encrypted management. This directly meets the requirement for encryption (SSH/HTTPS are inherently encrypted) and source restriction without relying on security policies, which do not control management-plane access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the firewall to use a dedicated management port and enable IP whitelisting in device settings.
Why it's wrong here
The dedicated management port already exists; IP whitelisting can be done via interface management profile, but option A is more specific.
- ✓
Configure an interface management profile allowing SSH and HTTPS only from 10.10.0.0/24 and apply it to the management interface.
Why this is correct
The management interface can be restricted to specific IPs using the interface management profile under Device > Setup > Management.
- ✗
Use a loopback interface with an IP from the management subnet and attach an interface management profile.
Why it's wrong here
Loopback interfaces are for data-plane; management of the device is separate.
- ✗
Create a security policy allowing management access from 10.10.0.0/24 to the firewall's IP addresses.
Why it's wrong here
Security policies apply to data-plane traffic, not management-plane traffic to the firewall's own IPs.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A help desk ticket reports that a user cannot access the firewall's web management interface (HTTPS) from the management network. The management interface is on a dedicated MGMT network. Which setting must be enabled on the firewall to allow this access?
easy- A.Enable IKE on the management interface.
- B.Enable User-ID on the management interface.
- C.Configure a service route to redirect management traffic to a dataplane interface.
- ✓ D.Under Device > Setup > Management, add the user's IP or subnet to 'Permitted IP Addresses' for HTTPS.
Why D: The firewall's management interface enforces an access control list for HTTPS (and other management protocols) under Device > Setup > Management. By default, no IP addresses are permitted, so even if the user is on the same MGMT network, the firewall will drop HTTPS requests unless the user's IP or subnet is explicitly added to the 'Permitted IP Addresses' list. This setting is a fundamental security measure to restrict management access to trusted sources only.
Last reviewed: Jun 25, 2026
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.