Courseiva

CCNA Object Configuration Creation And Application Questions

26 of 101 questions · Page 2/2 · Object Configuration Creation And Application topic · Answers revealed

Practice these questionsExam hubAll questions
76
Multi-Selecthard

Which THREE of the following are valid methods for registering tags to IP addresses to populate Dynamic Address Groups?

Select 3 answers
A.Assigning the tag directly to the interface in the Network tab.
B.Configuring the VM-Series to monitor cloud provider metadata.
C.Creating a custom App-ID that identifies the traffic.
D.Using the User-ID agent to map IP-to-Tag relationships.
E.Using the XML API to send a registration request.
AnswersB, D, E

VM-Series instances can query cloud provider metadata services (AWS, Azure, GCP) to harvest instance tags, then register those tags against the instance IP addresses. This populates Dynamic Address Groups without external agents, satisfying the tag-registration requirement for cloud-hosted workloads.

Why this answer

Option B is correct because the VM-Series can be configured with a cloud provider plugin (e.g., AWS, Azure, GCP) that polls the cloud metadata service to learn which IP addresses belong to instances carrying specific tags, and this information is used to populate Dynamic Address Groups. Option D is correct because the User-ID agent can register IP-to-tag mappings via the User-ID XML API, allowing tags to be associated with IP addresses and thereby populate Dynamic Address Groups. Option E is correct because the PAN-OS XML API exposes a 'register' operation (e.g., type=user-id, cmd=<register><entry ip=...><tag><member>...</member></tag></entry></register>) that directly registers tags to IP addresses for Dynamic Address Group membership.

Option A is not a valid method because tags are not assigned to interfaces in the Network tab; interface configuration does not register tags to IP addresses for Dynamic Address Groups. Option C is not a valid method because custom App-ID creation identifies applications in traffic and does not register tags to IP addresses for Dynamic Address Group population.

Practice this question →
77
MCQhard

An analyst is reviewing a security policy that references an Address object named Web-Server-Prod. A change request requires updating the object to a new IP address, but the object is referenced by multiple policies across several folders in Strata Cloud Manager. The analyst wants the change to take effect everywhere with minimal effort. What should the analyst do?

A.Edit the Web-Server-Prod object's IP address value; all policies referencing it inherit the update.
B.Delete Web-Server-Prod and create a new object with the new IP, then update each policy manually.
C.Create a new Address object with the new IP and add it as a second destination in each policy.
D.Convert Web-Server-Prod into a Dynamic Address Group so it updates automatically.
AnswerA

Address objects are referenced by name, so editing the object's value updates every policy that uses it. This is the core benefit of object reuse: a single change propagates to all referencing rules without editing each policy individually. It minimizes effort and reduces the risk of inconsistent configurations across folders.

Why this answer

Because policies reference Address objects by name, editing the object's IP value automatically updates every rule that references it, regardless of folder. This is the primary advantage of object-based configuration: a single edit propagates consistently and eliminates the need to touch each policy, reducing effort and the chance of configuration drift.

Exam trap

The trap here is thinking that each policy stores its own copy of the IP address, when policies actually reference the object by name and inherit its current value.

Practice this question →
78
Multi-Selectmedium

A security analyst is creating a new static Address Object on a Palo Alto Networks firewall to represent a partner company's web server at 203.0.113.45/32. The analyst must complete the required fields correctly for the object to commit and function in policy. Which two elements are required when defining this static Address Object? (Choose two.)

Select 2 answers
A.A tag assignment for the object
B.The IP address or subnet value
C.A unique object name
D.A description field entry
E.A DNS server association
AnswersB, C

A static Address Object must contain the actual IP address or subnet it represents, such as 203.0.113.45/32. This value is what the firewall matches against in policy evaluation, so omitting it leaves the object undefined and unusable in any Security Policy rule.

Why this answer

A static Address Object fundamentally needs two things: a unique name so it can be referenced unambiguously, and the IP address or subnet value that the firewall will match. Tags, descriptions, and DNS associations are optional attributes that enhance management or apply to other object types but are not required to create or use this object.

Exam trap

The trap here is treating optional metadata such as tags or descriptions as mandatory fields, when only the name and address value are truly required for a static Address Object.

Practice this question →
79
MCQmedium

A network security analyst is creating a new Security Policy rule in Strata Cloud Manager to allow access to a SaaS application. The SaaS provider publishes a list of IP addresses that changes frequently, and the analyst wants the rule to automatically adapt without manual edits. They decide to use a Dynamic Address Group (DAG) based on tags. What must be configured on the firewall or in Strata Cloud Manager for the DAG to populate its members?

A.A DNS proxy that resolves the SaaS application's domain name and dynamically updates the DAG membership.
B.A static list of the SaaS provider's IP addresses entered directly into the DAG definition.
C.An External Dynamic List (EDL) that contains the SaaS provider's IP addresses, referenced by the DAG.
D.A registered IP-tag source, such as a VM Information Source or a User-ID agent, that applies the required tags to the IP addresses.
AnswerD

Dynamic Address Groups rely on tags applied to IP addresses by an external source. Without a registered IP-tag source like a VM Information Source, User-ID agent, or an API-based tag provider, the firewall has no way to learn which IPs belong to the group. This makes the rule automatically adapt as the SaaS provider's IPs change.

Why this answer

Dynamic Address Groups automatically include IP addresses based on tags applied by a registered IP-tag source. The firewall must receive tag information from a VM Information Source, User-ID agent, or similar service. This allows the Security Policy rule to dynamically adapt to changing IP addresses without manual intervention, which is essential for SaaS applications with frequently updated IP ranges.

Exam trap

The trap here is assuming that an External Dynamic List alone can populate a Dynamic Address Group, when in fact the DAG requires tags from a registered source.

Practice this question →
80
MCQmedium

A security analyst needs to define a custom application object in Strata Cloud Manager for an internally developed line-of-business tool that uses TCP port 8443 and is not covered by any existing App-ID signature. The analyst wants the security policy to match this traffic by the custom application rather than by a port-based service. Which configuration step is required?

A.Create an Application Filter that includes the port range and reference it in the policy.
B.Create a custom Application object specifying the TCP port 8443, then reference it in the security policy.
C.Create an External Dynamic List that contains the tool's server IP and reference it as an application.
D.Create a Service object for TCP 8443 and use it in the policy's service field.
AnswerB

A custom Application object lets the analyst define a new application with its own port, protocol, and timeout characteristics when no App-ID signature exists. Once created, it is selectable in the security policy's application field, so policy matching is by the custom application rather than by a raw service. This meets the requirement precisely.

Why this answer

When no App-ID signature covers an internal application, the correct approach is to create a custom Application object that defines the port and protocol, then reference it in the policy. This gives application-based matching and control for the custom tool, which a port-only Service object or an Application Filter cannot provide.

Exam trap

The trap here is assuming that a Service object for the port is equivalent to an application definition, when Service objects match only port and protocol.

Practice this question →
81
MCQmedium

An analyst is registering a new firewall in Strata Cloud Manager (SCM) and needs to create a Security Zone object that is restricted to the 'internet' and 'dmz' interfaces only, so that later Security Policy rules can reference it. Which object type should the analyst create to meet this requirement?

A.Service object that lists the ports used by the internet and dmz interfaces.
B.Address Group containing the IP addresses of the internet and dmz interfaces.
C.Application Filter object matching applications commonly seen on internet and dmz links.
D.Security Zone object with the internet and dmz interfaces assigned to it.
AnswerD

A Security Zone object is the correct construct for grouping one or more interfaces into a logical trust boundary. By assigning the 'internet' and 'dmz' interfaces to a single zone object, the analyst gives policy rules a stable reference that automatically tracks those interfaces. This is exactly the purpose of a zone object in SCM's object configuration model.

Why this answer

A Security Zone object is the only object type in SCM that inherently groups interfaces into a logical unit that policy rules can reference. Address, Service, and Application Filter objects operate on IPs, ports, or application signatures respectively and cannot represent interface membership. Creating a zone object with the two interfaces assigned gives the analyst a reusable, interface-aware reference for subsequent policy configuration.

Exam trap

The trap here is assuming that any object which lists the interfaces' IP addresses behaves like a zone, when only a Security Zone object actually binds to interfaces.

Practice this question →
82
MCQhard

An administrator attempts to delete an Address Object that is referenced by a security policy. What will happen?

A.The object is deleted, and the policy rule automatically removes the reference.
B.The object is moved to a trash folder, and the policy continues to function using a cached copy.
C.The object is deleted, but the policy rule becomes invalid and stops matching traffic.
D.The deletion is blocked, and the administrator must remove the object from all policies first.
AnswerD

Strata Cloud Manager enforces referential integrity. When an object is referenced by a policy, deletion is blocked. The administrator must edit the policy to remove the reference before the object can be deleted. This prevents accidental policy breakage and maintains configuration consistency.

Why this answer

Strata Cloud Manager blocks the deletion of an object that is referenced in a security policy. The administrator must first remove the object from all policies, then delete it. This referential integrity check prevents accidental policy misconfigurations and ensures that policies always reference valid objects.

Exam trap

The trap here is assuming that deletion is allowed and that the system automatically cleans up references, which it does not.

Practice this question →
83
Multi-Selectmedium

When managing objects in SCM, which actions can be performed on tags? (Choose TWO)

Select 2 answers
A.Assigning a color
B.Defining an IP range
C.Defining a port protocol
D.Applying to objects for organization
E.Creating a security policy
AnswersA, D

Tags in SCM support metadata such as a colour label, letting administrators visually group and distinguish objects within the shared policy structure. Assigning a colour is a supported tag action, alongside naming and description, and it aids rapid identification across folders and snippets.

Why this answer

Option A (Assigning a color) is correct because Palo Alto Networks SCM (Strata Cloud Manager) allows administrators to assign a color to a tag, which serves as a visual label for quick identification and filtering of tagged objects. Option D (Applying to objects for organization) is correct because tags are metadata labels that can be attached to objects such as addresses, address groups, and policies to categorize, group, and organize them logically within SCM. Options B and C are incorrect because IP ranges and port protocols are attributes of address objects and service objects respectively, not of tags.

Option E is incorrect because a security policy is a separate rule construct that can reference tags, but tags themselves do not create security policies.

Practice this question →
84
Multi-Selectmedium

Which elements are required when creating a new custom Service Object? (Choose THREE)

Select 3 answers
A.Protocol
B.Tag
C.Port
D.Name
E.Description
AnswersA, C, D

A custom Service Object must define the protocol it represents, since the protocol determines whether destination port fields apply. Without a protocol value the object cannot be matched against traffic, so Protocol is a mandatory element when creating one.

Why this answer

When creating a custom Service Object, the Protocol (A) is required because the firewall must know which IP protocol (e.g., TCP, UDP, ICMP) the service uses to match traffic correctly. The Port (C) is required because a service object defines the destination port (or port range) that the protocol operates on, such as TCP/443. The Name (D) is required because every service object must have a unique identifier used to reference it in security policy rules.

Tag (B) is optional metadata used for grouping or filtering objects and is not mandatory for creation. Description (E) is also optional documentation and is not required for the object to function.

Practice this question →
85
MCQeasy

Which of the following is NOT a valid type of address object?

A.FQDN
B.IP Netmask
C.IP Range
D.IP Protocol
AnswerD

An address object represents a network host, range, subnet or FQDN used in security policy rules. IP Protocol is a transport-layer protocol identifier (TCP, UDP, ICMP), not an address, so it cannot be defined as an address object in a firewall configuration.

Why this answer

Palo Alto Networks supports IP Netmask, IP Range, and FQDN objects. IP Protocol is not an address object type.

Practice this question →
86
MCQmedium

A network security analyst is configuring a rule that must permit outbound traffic to any IP address within the range 172.20.0.0 through 172.20.255.255. Instead of creating 256 separate address objects, the analyst wants to define a single object. Which object type should be used?

A.IP Range object
B.Address Group
C.Dynamic Address Group
D.FQDN object
AnswerA

An IP Range object allows a start and end IP address to be specified, covering the entire contiguous block from 172.20.0.0 to 172.20.255.255 in one object. This is the correct choice because the requirement is a contiguous range that is not easily expressed as a single CIDR (it spans multiple /24 networks). The firewall expands the range internally, so a single object reference in policy is sufficient.

Why this answer

The requirement is to represent a contiguous block of IP addresses that does not align to a single CIDR prefix. An IP Range object is designed exactly for this purpose, allowing a start and end address to be defined in one object. Address Groups, FQDN objects, and Dynamic Address Groups serve different purposes and cannot statically define such a range.

Exam trap

The trap here is assuming that any object containing multiple addresses is an Address Group, when the scenario actually requires a single object that natively defines a contiguous IP range.

Practice this question →
87
MCQeasy

An administrator is creating a new Service Object to represent a custom application that uses TCP port 8443. The application is used by multiple departments and will be referenced in several security policies. Which of the following is the correct way to create this Service Object?

A.Create a Service Object with protocol ICMP and type 8443.
B.Create a Service Object with protocol UDP and destination port 8443.
C.Create a Service Object with protocol TCP and source port 8443.
D.Create a Service Object with protocol TCP and destination port 8443.
AnswerD

A Service Object is defined by protocol and port. For a custom application using TCP port 8443, specifying TCP and destination port 8443 correctly identifies the service. This object can then be reused in policies, ensuring consistent enforcement. The destination port is the standard way to define the service port for TCP.

Why this answer

A Service Object must accurately reflect the protocol and port used by the application. Since the custom application uses TCP port 8443, the object should be defined with protocol TCP and destination port 8443. This ensures that policies referencing the object will correctly identify and control the traffic.

Other protocols or port directions would not match the application's traffic.

Exam trap

The trap here is mixing up source and destination ports, or selecting the wrong protocol, which are common mistakes when defining Service Objects.

Practice this question →
88
MCQmedium

A network security analyst is configuring an object in Strata Cloud Manager (SCM) to represent a partner company's web portal that is reachable at portal.example.com and resolves to several changing public IP addresses. The analyst wants the security policy to remain valid even when the partner rotates its DNS records. Which object type should the analyst create to satisfy this requirement?

A.Dynamic Address Group with a tag filter
B.Static Address Group containing the current IP addresses
C.IP Netmask Address object
D.FQDN Address object
AnswerD

An FQDN Address object stores a fully qualified domain name and is resolved by the firewall at policy evaluation time, so when the partner rotates DNS records the policy automatically uses the updated IP addresses. This keeps the security policy valid without manual edits or object recreation, which is exactly what the scenario requires.

Why this answer

An FQDN Address object is the right fit because it resolves a hostname to IP addresses at policy evaluation time, so DNS changes by the partner are absorbed automatically. Static address types and tag-driven dynamic groups do not perform DNS resolution, meaning they would require manual updates and could break the security policy when the partner's records change.

Exam trap

The trap here is assuming that any object resolving a hostname must be a Dynamic Address Group, when FQDN Address objects are the type that actually performs DNS resolution.

Practice this question →
89
MCQeasy

Which of the following is an example of a 'Service' object?

A.10.0.0.1
B.TCP/80
C.Marketing_Dept
D.USA_Region
AnswerB

A Service object is defined by its port and transport protocol pairing, so TCP/80 identifies the service listening on port 80. This contrasts with Host and Network objects, which are defined by IP addressing rather than protocol-port combinations.

Why this answer

HTTP, HTTPS, and SSH are common services defined as objects specifying the protocol and port.

Practice this question →
90
Multi-Selectmedium

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Select 2 answers
A.They automatically inherit tags from the policy rule they are applied to.
B.They allow the use of port ranges, such as 1000-2000.
C.They are globally unique across all Device Groups.
D.They support the definition of both TCP and UDP ports in a single object.
E.They can be added to Service Groups to simplify policy rulebases.
AnswersB, E

Service Objects define protocol and port criteria, and they support port ranges such as 1000-2000 rather than only single ports. This range capability is a defining characteristic, letting one object represent a contiguous span of ports.

Why this answer

Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly.

Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.

Practice this question →
91
Multi-Selecthard

What are the primary characteristics of Service Groups? (Choose TWO)

Select 2 answers
A.They are used to bundle multiple service objects
B.They are only for inbound traffic
C.They allow mixing of TCP and UDP services
D.They contain only one service
E.They must have a unique color
AnswersA, C

Service Groups exist precisely to bundle multiple service objects into a single referenced entity, so a policy rule can match many ports and protocols without listing each service individually. This aggregation satisfies the question's requirement that groups hold service objects as members.

Why this answer

Service Groups are logical containers that bundle multiple service objects (individual TCP/UDP port definitions) into a single referenced object, so option A is correct because their core purpose is to aggregate several service objects for use in a single security policy rule. Option C is also correct because a service group can contain both TCP and UDP service members simultaneously, letting one policy rule match traffic on mixed protocols and ports. Options B, D, and E are incorrect: service groups are not restricted to inbound traffic (they can be referenced in any policy direction), they are not limited to a single service (that contradicts their aggregation purpose), and they have no requirement for a unique color, which is not a property of service group objects.

Practice this question →
92
MCQeasy

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

A.The interface must be configured as a DHCP server.
B.The IP address must be defined as a static Address Object.
C.The IP address must have a tag associated with it via registration.
D.The object must be added to a Service Group.
AnswerC

Dynamic Address Groups populate only from tags registered against IP addresses, not from static membership or subnet matching. The tag registration supplies the filter criteria the DAG evaluates, so without a registered tag the group stays empty. This satisfies the stem's prerequisite: the IP must carry a tag via registration.

Why this answer

DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.

Practice this question →
93
Multi-Selecthard

Which of the following are benefits of using Device Groups in SCM? (Choose THREE)

Select 3 answers
A.Local-only access
B.Inheritance of configuration
C.Shared object management
D.Automatic hardware replacement
E.Configuration modularity
AnswersB, C, E

Device Groups let child firewalls inherit policy, objects and settings from parent groups, so configuration defined once cascades down the hierarchy. This inheritance mechanism satisfies the stem's requirement for a benefit of using Device Groups in SCM.

Why this answer

Device Groups in Palo Alto Networks Strata Cloud Manager (SCM) are hierarchical containers that let child folders/devices automatically receive settings defined at a parent level, so option B (Inheritance of configuration) is correct because policies, objects, and profiles flow down the hierarchy without being recreated per device. Option C (Shared object management) is correct because objects such as address objects, tags, and security profiles defined in a Device Group can be referenced by all member devices, eliminating duplicate definitions. Option E (Configuration modularity) is correct because Device Groups let you organize configuration into reusable, layered building blocks (for example, a baseline group plus site-specific groups) that can be mixed and matched across deployments.

Option A (Local-only access) is not a benefit of Device Groups, since Device Groups are precisely a mechanism for centralized, hierarchical management rather than restricting configuration to a single local device. Option D (Automatic hardware replacement) is not a Device Groups feature; hardware replacement/RMA is handled through device onboarding and licensing workflows, not through Device Group membership.

Practice this question →
94
MCQhard

An administrator is creating a new Service Group that will contain several Service Objects for different applications. They want to ensure that the Service Group can be used in a Security Policy to allow traffic for all the services. However, they also want to minimize the number of objects they need to manage. Which of the following is a valid consideration when creating a Service Group?

A.A Service Group can only contain Service Objects of the same protocol (TCP or UDP).
B.A Service Group can only be used in a Security Policy if it contains at least one Service Object with a port range.
C.A Service Group can contain other Service Groups, allowing hierarchical grouping.
D.A Service Group cannot be modified after it is referenced in a Security Policy.
AnswerC

In Palo Alto Networks, Service Groups can contain other Service Groups, enabling nested groups. This allows for hierarchical organization of services, which can simplify management and reduce the number of objects referenced in policies. For example, you could have a group for web services that contains HTTP and HTTPS, and then a higher-level group that includes web services and DNS services. This is a valid and useful feature.

Why this answer

Service Groups can contain other Service Groups, allowing for nested groupings. This hierarchical structure helps organize services and reduce the number of objects referenced in policies. The other options are incorrect: Service Groups can contain mixed protocols, do not require port ranges, and can be modified after being referenced.

Exam trap

The trap here is assuming that Service Groups cannot be nested, but they can, which is a key feature for scalable management.

Practice this question →
95
MCQhard

A NetSec-Analyst is configuring a Dynamic Address Group (DAG) that should include all servers tagged as 'Web'. The analyst notices that some servers with the 'Web' tag are not appearing in the DAG. The tags are applied via a VM monitoring agent. What is the most likely cause?

A.The DAG filter is case-sensitive and the tag is 'web' instead of 'Web'.
B.The VM monitoring agent is not licensed for dynamic address groups.
C.The servers are in a different security zone than the DAG.
D.The DAG filter requires an IP address instead of a tag.
AnswerA

Dynamic Address Group filters are often case-sensitive, so a tag registered as 'web' will not match a filter for 'Web'. This is a common oversight when tags are created manually or by different systems. Ensuring consistent casing resolves the issue.

Why this answer

Dynamic Address Group filters match tags or metadata exactly, including case. If the tag is registered as 'web' but the filter expects 'Web', those servers will not be included. Checking tag casing and consistency is the first troubleshooting step.

Exam trap

The trap here is overlooking case sensitivity in tag matching, assuming tags are case-insensitive when they are not.

Practice this question →
96
MCQmedium

An administrator needs to create a new Security Policy rule that allows HTTP and HTTPS traffic from the internal network to a specific external web server. The internal network is already defined as an Address object, and the external server is defined as an FQDN object. Which additional object is required to complete the rule?

A.A Dynamic Address Group for the external server
B.An Application object for web-browsing
C.An Address Group containing the internal network and external server
D.A Service object for TCP ports 80 and 443
AnswerD

A Security Policy rule requires a service to define the allowed applications or ports. Since the requirement is HTTP and HTTPS, a Service object that includes TCP ports 80 and 443 is necessary. Without it, the rule would not know which ports to permit. This is the correct additional object to complete the rule.

Why this answer

To complete the Security Policy rule, the administrator must specify the service that matches HTTP and HTTPS. A Service object defining TCP ports 80 and 443 is required. The source and destination are already covered by the existing Address and FQDN objects.

Other object types do not provide the necessary port-based service definition.

Exam trap

The trap here is thinking that an Application object is always needed for web traffic, when in this scenario the rule is port-based and requires a Service object.

Practice this question →
97
MCQmedium

A network security analyst is configuring a new Security Policy rule that must block traffic to a known malicious IP address. During policy creation, the analyst selects the 'Destination Address' field and realizes the malicious IP has not been defined as an Address Object yet. What is the most efficient action the analyst can take directly from the policy rule configuration interface?

A.Use the Object Selector within the Destination Address field to create a new Address Object inline.
B.Type the IP address directly into the Destination Address field, bypassing object creation entirely.
C.Navigate to the Objects tab, create a new Address Object, then return to the policy and select it.
D.Import a pre-existing Address Object from a CSV file using the policy import feature.
AnswerA

The Object Selector embedded in the Destination Address field allows the analyst to create a new Address Object without leaving the policy rule. This inline creation streamlines workflow, reduces errors, and ensures the new object is immediately available for selection. It is the intended efficient method in the NetSec-Analyst platform.

Why this answer

The Object Selector within the Destination Address field enables inline creation of a new Address Object, allowing the analyst to define the malicious IP without leaving the policy rule. This is the most efficient method because it maintains workflow continuity and immediately associates the new object with the rule. Other methods either require navigation away or skip object creation entirely.

Exam trap

The trap here is assuming that creating an object always requires navigating to a separate Objects section, when in fact the policy editor provides an inline Object Selector.

Practice this question →
98
MCQmedium

When you define a 'Service Group', can you include both TCP and UDP services?

A.Yes, you can mix different protocols
B.Only if the firewall supports it
C.No, they must be the same protocol
D.Only if they use the same port number
AnswerA

Service groups are protocol-agnostic regarding their members.

Why this answer

Yes, Service Groups are designed to aggregate different protocols (TCP, UDP, SCTP) into a single service bundle.

Practice this question →
99
MCQhard

Why might an Address Object using an IP Netmask return a validation error even if the IP is valid?

A.The netmask is too small
B.The address is in a private range
C.The IP address bits outside the mask are not zeroed out
D.The address is already in use
AnswerC

An IP Netmask object requires host bits to be zero, representing a true network address. If the supplied IP has bits set outside the mask, validation fails because the address is not a valid network identifier for that mask.

Why this answer

The IP address must match the specified netmask (e.g., 10.1.1.5/24 is invalid because the host bits are set).

Practice this question →
100
MCQhard

In PAN-OS, what is the impact of configuring an FQDN Address Object for a site that uses multiple IP addresses returned via DNS load balancing?

A.The firewall will block all traffic until a single IP is specified.
B.Only the first IP returned by the DNS server is stored.
C.The firewall converts the FQDN to a static object upon the first refresh.
D.The firewall updates the object member list with all IPs returned during periodic refreshes.
AnswerD

FQDN Address Objects resolve the hostname periodically and populate the object with every A/AAAA record returned, so round-robin or load-balanced DNS yields multiple members. The firewall re-resolves on the configured refresh interval, keeping the member list current as records change.

Why this answer

The firewall periodically resolves the FQDN and maintains a list of all returned IPs in the object.

Practice this question →
101
MCQhard

What is the 'Read-Only' state of an object indicating in SCM?

A.The administrator lacks permissions
B.The object is inherited from a parent device group
C.The object is corrupted
D.The object is in use by a rule
AnswerB

Read-Only indicates the object is inherited from a parent device group, so it cannot be edited locally. Changes must be made at the parent level, and the object appears greyed out in the child group's policy view.

Why this answer

An object is read-only if it is inherited from a parent device group, meaning it cannot be modified at the current level.

Practice this question →
← PreviousPage 2 of 2 · 101 questions total

Ready to test yourself?

Try a timed practice session using only Object Configuration Creation And Application questions.

Start 20-question session