53 questions · Managing Objects · All types, answers revealed
Match each firewall deployment mode to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Passively monitors traffic without blocking
Transparent layer 2 deployment
Routable mode with IP addresses
Failover configuration with one standby unit
Why these pairings
These are common firewall deployment modes.
Refer to the exhibit. An admin adds a new address object 'db-03' with IP 10.0.0.3 and tags it with 'database'. However, 'db-03' does not appear in the group. What could be the reason?
A commit is necessary for the dynamic group to reflect the new member.
Why this answer
In Palo Alto Networks firewalls, dynamic address groups evaluate their tags and membership rules in real time, but the group's membership list is only updated after a commit operation. Even though the address object 'db-03' is correctly tagged with 'database', the dynamic group will not reflect the new member until the admin commits the changes. Therefore, the missing commit is the most direct reason the object does not appear in the group.
Exam trap
The trap here is that candidates assume dynamic groups update instantly when an object is tagged, overlooking the mandatory commit step required to synchronize the candidate configuration with the active running configuration.
How to eliminate wrong answers
Option A is wrong because the tag is correctly applied as 'database' and the question states it is tagged with 'database', so a misspelling is not indicated. Option C is wrong because the address object is explicitly tagged with 'database' as stated in the scenario, so the object is indeed tagged. Option D is wrong because the group match type being 'all' or 'any' affects whether all tags must match or any tag can match, but it does not prevent a correctly tagged object from appearing; the issue is the lack of commit, not the match logic.
A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?
Dynamic groups reflect tag changes in real-time.
Why this answer
Dynamic address groups update automatically based on tag membership. When the tag is removed from the VM, the VM's IP address is automatically removed from the group. No manual intervention or commit is required for the group to reflect the change, though a commit may be needed for policy enforcement.
An administrator needs to create a service group for a custom application that uses TCP ports 1000 and 2000. Which two methods will successfully create a service group that can be used in a single security rule? (Choose two.)
This groups the two service objects into a single group for use in a rule.
Why this answer
Option C is correct because a service group in Palo Alto Networks firewalls can contain multiple service objects, allowing you to combine TCP ports 1000 and 2000 into a single group that can be referenced in one security rule. This enables the firewall to match traffic to either port within the same rule, simplifying policy management.
Exam trap
The trap here is that candidates often confuse a service group with a port range object, assuming that a range like 1000-2000 is equivalent to specifying only the endpoints, but in reality, it includes every port in between.
A security policy rule uses 'MyService' and 'ServerGroup'. What is the destination port of the allowed traffic?
MyService defines port 443.
Why this answer
The correct answer is B (443) because 'MyService' is a custom service object that typically defines HTTPS (TCP/443), and 'ServerGroup' is a group of destination servers. When a security policy rule references both, the destination port is determined by the service object, not the server group. In Palo Alto Networks firewalls, service objects explicitly define the protocol and port for allowed traffic, so the destination port is 443.
Exam trap
The trap here is that candidates often assume the destination port is derived from the server group's common service (e.g., HTTP on port 80) rather than recognizing that the service object explicitly defines the port in the security rule.
How to eliminate wrong answers
Option A (80) is wrong because port 80 is associated with HTTP, not the 'MyService' object which is configured for HTTPS (443). Option C (22) is wrong because port 22 is used for SSH, a management protocol not typically defined in a service object named 'MyService' for web traffic. Option D (8080) is wrong because port 8080 is an alternate HTTP port, often used for proxies or development, and does not match the standard HTTPS port 443 defined in 'MyService'.
A large enterprise uses dynamic address groups based on tags to manage firewall policies. The administrator notices that a specific address object is being incorrectly included in a dynamic address group that should only contain servers from a different region. What could be the reason?
A tag matching the group's criteria causes inclusion, even if other tags are different.
Why this answer
Dynamic address groups in Palo Alto Networks firewalls use tags to automatically include or exclude address objects. If an address object has multiple tags and one of them matches the tag criteria defined for the dynamic group, the object will be included even if it also has tags that would otherwise place it in a different region. This is the most likely cause of the incorrect inclusion.
Exam trap
The trap here is that candidates often assume dynamic groups use 'match all' by default or that tag conflicts are impossible, but the 'match any' operator is common and can cause objects with overlapping tags to be included in unintended groups.
How to eliminate wrong answers
Option A is wrong because a static group does not use tags for membership; objects are manually added or removed, so tag mismatches would not cause incorrect inclusion. Option B is wrong because if the group uses 'match all', the object would need to have all specified tags to be included; lacking some tags would exclude it, not cause incorrect inclusion. Option C is wrong because directly adding an object to a dynamic group is not possible; dynamic groups are populated solely by tag-based matching, not manual addition.
A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?
Port 80 is the standard port for HTTP.
Why this answer
The HTTP service object in Palo Alto Networks firewalls is pre-defined with TCP port 80, as specified in RFC 7230. This default mapping allows the firewall to identify and apply security policies to standard unencrypted web traffic. Option D is correct because port 80 is the IANA-assigned default port for HTTP.
Exam trap
Palo Alto Networks often tests the distinction between HTTP (port 80) and HTTPS (port 443), and the trap here is that candidates may confuse HTTP with HTTPS or assume a common alternate port like 8080 is the default.
How to eliminate wrong answers
Option A is wrong because port 22 is the default port for SSH, not HTTP. Option B is wrong because port 443 is the default port for HTTPS (HTTP over SSL/TLS), not HTTP. Option C is wrong because port 8080 is an alternate port commonly used for HTTP proxies or web servers, but it is not the pre-defined default for the HTTP service object in Palo Alto Networks firewalls.
An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?
EDLs allow external lists to be referenced in policies and shared across firewalls.
Why this answer
External Dynamic Lists (EDLs) allow dynamic address groups to be shared across multiple firewalls by referencing a common external source, such as a URL or file hosted on a web server. This enables consistent, real-time updates to address objects across the entire firewall fleet without manual intervention, making it the correct choice for sharing dynamic address groups.
Exam trap
The trap here is that candidates often confuse Device Groups (which share static policy and objects) with the ability to share dynamic objects, but Device Groups do not support dynamic address groups; only EDLs provide the dynamic, externally-sourced sharing mechanism.
How to eliminate wrong answers
Option A is wrong because Device Groups are used to manage shared policy and configuration across firewalls in Panorama, but they do not directly share dynamic address groups; they share static objects and policies. Option B is wrong because Shared Policy is a configuration element that applies policies across devices, but it does not inherently share dynamic address groups; it relies on objects that must be defined elsewhere. Option C is wrong because Template Stacks are used to manage device-level settings like interfaces and network configurations, not dynamic address groups or object sharing.
A company needs to block a list of known malicious domains that is updated daily by a threat intelligence vendor. Which Palo Alto Networks object should be used?
EDL can consume frequently updated lists of domains or IPs.
Why this answer
An External Dynamic List (EDL) is the correct object because it allows Palo Alto Networks firewalls to import and automatically update a list of known malicious domains from an external threat intelligence vendor on a scheduled basis (e.g., every 5 minutes). This ensures the firewall dynamically blocks newly identified malicious domains without manual intervention, making it ideal for a daily-updated feed.
Exam trap
The trap here is that candidates often confuse Custom URL Categories with EDLs, assuming a manually updated list can suffice for dynamic feeds, but the exam emphasizes that EDLs are the only object designed for automated, external-sourced updates.
How to eliminate wrong answers
Option B is wrong because a Custom URL Category is a static, manually defined list of URLs or domains that does not support automatic updates from an external feed; it requires manual editing to reflect daily changes. Option C is wrong because an Address Group is used to group IP addresses or CIDR ranges, not domain names, and it cannot dynamically update from an external threat intelligence source. Option D is wrong because an Application Filter is used to identify traffic based on application characteristics (e.g., application ID, category, technology), not to block specific domains or URLs.
An admin creates an application group named 'web-apps' that includes 'web-browsing' and 'ssl'. They apply it to a security rule. However, traffic from a client accessing Facebook is being blocked. What is a likely reason?
Facebook is identified as 'facebook' or similar, not 'web-browsing'.
Why this answer
Option C is correct because Facebook traffic is identified by the 'facebook-base' application, not by 'web-browsing' or 'ssl'. The application group 'web-apps' only includes 'web-browsing' and 'ssl', so any application not matching those signatures—such as Facebook—will not be allowed by the rule. Palo Alto Networks next-generation firewalls use App-ID to classify traffic based on application signatures, and a security rule only permits traffic that matches the applications explicitly listed in the rule or group.
Exam trap
The trap here is that candidates assume 'web-browsing' and 'ssl' cover all HTTPS traffic, but Palo Alto Networks treats each application (e.g., Facebook, YouTube) as a separate App-ID, so a rule must explicitly include the specific application to allow it.
How to eliminate wrong answers
Option A is wrong because a missing source zone would cause the rule to not apply at all, but the traffic is being blocked, implying the rule is matched and the action is deny (or no allow rule matches). Option B is wrong because if the rule's action were set to allow and the application group were configured incorrectly, the traffic would still be evaluated; the issue is not a misconfiguration of the group but that Facebook's application is simply not in the group. Option D is wrong because 'ssl' is a valid application object in Palo Alto Networks that represents SSL/TLS encrypted traffic; it is correctly included in the group.
A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?
Address objects define IP addresses or FQDNs, making them suitable for specifying a destination.
Why this answer
To block traffic to a specific external website in a Palo Alto Networks security policy, you must define the destination using an Address object. Address objects can represent IP addresses, FQDNs, or URL categories, and they are referenced in the Destination field of a security rule to match traffic destined for that target. This allows the firewall to enforce the block action against the specified external site.
Exam trap
The trap here is that candidates often confuse the purpose of Service objects (thinking they define the destination website) because they associate 'service' with web traffic, but Service objects only define protocol/port, not the destination host or IP.
How to eliminate wrong answers
Option A is wrong because a Schedule object defines time-based conditions for when a policy is active, not the destination of traffic. Option B is wrong because a Service object specifies the protocol and port (e.g., TCP/443) used by the traffic, not the destination address. Option D is wrong because a Tag is a metadata label used for grouping and filtering objects in the management interface, not a match criterion for traffic destinations.
Which TWO statements about External Dynamic Lists (EDLs) are true?
EDLs can be used as address objects in policies.
Why this answer
Option A is correct because External Dynamic Lists (EDLs) can be used as source or destination objects in security policy rules. This allows the firewall to match traffic against a regularly updated list of IP addresses or URLs hosted externally, enabling dynamic threat intelligence integration without manual rule changes.
Exam trap
Palo Alto Networks often tests the misconception that EDLs require manual updates or have fixed refresh intervals, when in fact they are fully automated and configurable, and that EDLs can only be used for IP addresses, not URLs (though they support both).
An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?
App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.
Why this answer
The security rule explicitly allows applications 'web-browsing', 'ssl', and 'dns'. While the custom web application uses HTTP on port 8080 and is identified as 'web-browsing', the application 'web-browsing' in Palo Alto Networks firewalls is defined to use standard HTTP ports (typically 80, 8080 is not included by default). Since the application does not match the traffic on port 8080, the firewall does not consider this traffic as matching the application 'web-browsing', and it falls through to the implicit deny rule, causing the denial.
Exam trap
The trap here is that candidates assume 'web-browsing' covers all HTTP traffic regardless of port, but Palo Alto Networks firewalls enforce application identification based on default port definitions, and non-standard ports require explicit configuration.
How to eliminate wrong answers
Option B is wrong because the traffic is being denied by the implicit deny rule, not by a previous rule; the rule order is not the issue here as the rule in question is present but does not match the application. Option C is wrong because the destination address object 10.10.0.0/16 is correct for the data center subnet, and the traffic is reaching that subnet but is denied due to application mismatch. Option D is wrong because the source zone 'GP' (GlobalProtect) is correct for remote users connecting via GlobalProtect; using 'untrust' would be incorrect as GlobalProtect traffic originates from the GP tunnel zone, not the untrust zone.
A security administrator needs to create an address object for a single host with IP address 192.168.1.100. Which address type should the administrator choose?
IP Netmask with /32 (255.255.255.255) represents a single host.
Why this answer
For a single host with IP address 192.168.1.100, the IP Netmask type is correct because it allows you to define a host by specifying the IP address with a /32 netmask (255.255.255.255). This is the standard method in Palo Alto Networks firewalls to represent a single host, ensuring the device treats it as an exact match for traffic policy and security rules.
Exam trap
The trap here is that candidates familiar with Cisco ACLs might choose IP Wildcard Mask (Option C) because they associate wildcard masks with host matching, but Palo Alto Networks uses IP Netmask as the standard and more straightforward method for defining a single host.
How to eliminate wrong answers
Option A (FQDN) is wrong because it is used for domain names that resolve to one or more IP addresses via DNS, not for a static IP address. Option C (IP Wildcard Mask) is wrong because it uses a wildcard mask to match a range of IPs (like Cisco ACLs), but it is not the intended type for a single host in Palo Alto Networks; it would require a mask of 0.0.0.0 to match a single host, which is less intuitive and not the recommended approach. Option D (IP Range) is wrong because it defines a contiguous range of IP addresses (e.g., 192.168.1.100-192.168.1.110), which is unnecessary and less precise for a single host.
A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?
Dynamic group automatically includes matching objects; minimal overhead.
Why this answer
Option D is correct because dynamic address groups with tag-based or name-based filters automatically include all matching objects, eliminating manual updates when new sites are added. By using a filter like 'Site-*-Networks', the group dynamically incorporates any address group whose name matches the pattern, reducing administrative overhead. This approach aligns with the PCNSA objective of using dynamic objects to simplify policy management in a scalable environment.
Exam trap
The trap here is that candidates often confuse dynamic address groups with static groups or incorrectly assume tags can be applied to address groups instead of address objects, leading them to choose options that require manual updates or fail to meet the scalability requirement.
How to eliminate wrong answers
Option A is wrong because manually adding each site's address group as a member of a static group still requires administrative intervention whenever a new site is added, defeating the goal of minimal overhead. Option B is wrong because using 'any' zone for source and destination would allow traffic from and to any zone, including the internet, which violates the requirement to block all internet traffic except specific services; it also does not leverage address groups for simplified management. Option C is wrong because tags are applied to address objects, not address groups; dynamic address groups filter based on tags of address objects, not groups, so filtering on a tag assigned to a group would not include the group's members automatically.
Which TWO types of address objects can be used in a security policy? (Choose two.)
IP Netmask is a standard address object type.
Why this answer
IP Netmask and IP Range are both types of address objects that define specific IP addresses or groups of IP addresses. Security policies in Palo Alto Networks firewalls use these address objects to match source and destination IP addresses in traffic, enabling granular control over which hosts or networks are allowed or denied.
Exam trap
Palo Alto Networks often tests the distinction between address objects and other policy elements like services or applications, so the trap here is that candidates mistakenly think Application or Service can serve as address objects because they are also used in security rules, but they occupy different match fields.
A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?
NAT address pool specifies the translated IP addresses.
Why this answer
A NAT address pool is the correct object type because it allows the administrator to translate overlapping private IP addresses (192.168.0.0/16) from multiple branch offices into unique, non-overlapping IP addresses before sending traffic over the IPsec tunnel. This prevents routing conflicts at the data center by ensuring each branch's source IPs are mapped to distinct addresses from a defined pool, a process known as source NAT (SNAT) or IP address translation.
Exam trap
The trap here is that candidates may confuse NAT address pools with IPsec Crypto profiles, thinking that VPN configuration alone resolves IP overlap, when in fact IPsec only encrypts traffic and does not perform address translation to resolve overlapping subnets.
How to eliminate wrong answers
Option B (External dynamic list) is wrong because it is used to dynamically import and manage IP addresses or URLs from an external source (e.g., threat intelligence feeds) for security policy matching, not for performing NAT translations. Option C (Service group) is wrong because it is a logical grouping of services (protocols and ports) used in security policy rules to simplify rule creation, not for IP address translation. Option D (IPsec Crypto profile) is wrong because it defines the IKE and IPsec parameters (e.g., encryption algorithms, authentication methods, DH groups) for securing VPN tunnels, not for translating overlapping IP addresses.
Which TWO of the following are valid types of address objects in Palo Alto Networks? (Choose two.)
IP Range is a standard address object type.
Why this answer
IP Range and IP Netmask are both valid address object types in Palo Alto Networks. An IP Range object defines a contiguous set of IP addresses using a start and end address (e.g., 192.168.1.1-192.168.1.254), while an IP Netmask object uses a subnet mask notation (e.g., 192.168.1.0/24) to represent a network or host range. These are the two primary IPv4 address object types supported natively in PAN-OS.
Exam trap
The trap here is that candidates often confuse address objects with other object types like FQDN or URL Category, thinking they are all valid address objects, but Palo Alto Networks strictly categorizes address objects as IP-based (IP Range, IP Netmask, and IP Wildcard Mask), while FQDN and URL Category belong to separate object categories.
Refer to the exhibit. An admin adds a new address object 'web-04' with IP 10.0.0.4 and applies it to a security policy that references the address group 'web-servers'. However, traffic to 10.0.0.4 is not allowed. What is the most likely cause?
Static groups require explicit member addition.
Why this answer
The address object 'web-04' was created but not added to the address group 'web-servers'. In Palo Alto Networks firewalls, security policies reference address groups, not individual objects. Even if the object exists, the policy will not match traffic destined to 10.0.0.4 unless the object is a member of the referenced group.
This is the most common cause of such a failure.
Exam trap
Palo Alto Networks often tests the distinction between creating an object and applying it to a group; the trap here is that candidates assume creating the object and referencing the group in the policy is sufficient, forgetting that the object must be a member of the group for the policy to match.
How to eliminate wrong answers
Option B is wrong because the question states the IP is 10.0.0.4 and the admin applied it to the policy; if the IP were wrong, the traffic would still not match, but the most likely cause is the group membership issue, not an IP typo. Option C is wrong because dynamic address groups update automatically based on tags or filters; if the group were dynamic, adding the object with the correct tag would cause it to be included, but the admin would need to ensure the tag matches, and the question does not indicate a dynamic group failure. Option D is wrong because the question states the policy references the address group 'web-servers' and traffic is not allowed; if the policy were set to deny, it would explicitly block traffic, but the most likely cause is the missing group membership, not a deny action.
An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?
Application objects define specific applications like web-browsing.
Why this answer
The correct answer is A, Application object, because in Palo Alto Networks security policies, the application field uses predefined or custom application objects to identify traffic based on the application identity, not just port/protocol. This allows the administrator to permit specific applications like web-browsing (HTTP/HTTPS) and SSL while blocking others, even if they use the same ports. Application objects leverage App-ID technology to inspect traffic beyond Layer 4, ensuring only allowed applications pass.
Exam trap
The trap here is that candidates often confuse service objects (Layer 4) with application objects (Layer 7), assuming that specifying a port/protocol is sufficient to control applications, but the PCNSA exam emphasizes that application-based policies require App-ID objects for granular control.
How to eliminate wrong answers
Option B is wrong because an Application filter is used to dynamically group applications based on criteria like category or technology, but it cannot be directly placed in the security policy application field; it is used in other contexts like QoS or policy optimization. Option C is wrong because an Application group is a static collection of application objects, but the question asks for the object type to allow specific applications individually, not a group; using a group could inadvertently permit unintended applications within the group. Option D is wrong because a Service object defines Layer 4 protocols and ports (e.g., TCP/443 for HTTPS), but it cannot enforce application-level control; for example, it would allow any traffic on port 443, not just SSL, failing to meet the requirement of allowing only specific applications.
An administrator is troubleshooting a security policy that uses a service group containing both TCP and UDP service objects. The policy is intended to allow DNS traffic (UDP 53 and TCP 53). The rule is not allowing TCP DNS. What is the most likely issue?
Missing TCP service objects prevents TCP DNS from matching.
Why this answer
Option A is correct because the service group must include both TCP and UDP service objects to match DNS traffic on both protocols. If the service group contains only UDP service objects, the security policy will not match TCP DNS traffic (TCP port 53), causing the rule to fail for TCP-based DNS queries or zone transfers. In Palo Alto Networks firewalls, service groups aggregate service objects, and each object defines a specific protocol and port; missing the TCP object means the rule cannot match TCP traffic.
Exam trap
The trap here is that candidates assume a service group named 'DNS' automatically includes both TCP and UDP, but in Palo Alto Networks, service objects are protocol-specific, so you must explicitly add both TCP and UDP objects to the group.
How to eliminate wrong answers
Option B is wrong because application objects are not required for basic port-based service matching; the security policy can use service objects alone to allow traffic by port and protocol, and DNS is typically identified by service objects without needing a separate application override. Option C is wrong because the question states the rule is intended to allow DNS traffic, and if the action were set to deny, no DNS traffic (UDP or TCP) would be allowed, not just TCP DNS. Option D is wrong because it is too vague; the specific misconfiguration is that the service group lacks the TCP service object for port 53, not that the group is incorrectly configured in a general sense.
Refer to the exhibit. A newly deployed web server has an address object with tags 'Production' and 'Web'. However, the 'Allow SSL to Internet' security rule using the dynamic address group 'MyServers' as source is not matching traffic destined to the internet. What is the most likely cause?
The typo 'andd' makes the filter invalid; correcting to 'and' resolves the issue.
Why this answer
Option D is correct because the dynamic address group filter uses the operator 'andd', which is a typo or invalid syntax. In PAN-OS, the correct operator for combining tags in a dynamic address group filter is 'and' (lowercase, no extra 'd'). The invalid filter causes the dynamic group to have no matching members, so the security rule 'Allow SSL to Internet' does not match traffic from the web server.
Exam trap
The trap here is that candidates may overlook the typo 'andd' and focus on other plausible but incorrect causes, such as zone configuration or reboot requirements, rather than recognizing the invalid filter syntax as the root cause.
How to eliminate wrong answers
Option A is wrong because dynamic address groups do not require the address object to be a member of a static address group; they use tag-based filters to dynamically include objects. Option B is wrong because the exhibit does not indicate a missing source zone; the rule can match traffic without an explicit source zone if the zone is implied or the rule is global, and the issue is specifically with the dynamic group filter. Option C is wrong because 'andd' is not a valid operator in any PAN-OS version; the correct operator is 'and', and using 'andd' is a syntax error.
Option E is wrong because dynamic address groups update their membership in near real-time when tags or objects change, not only after a system reboot.
During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?
FQDN objects automatically resolve and update IPs.
Why this answer
Option C is correct because Palo Alto Networks firewalls automatically resolve FQDN objects to their current IP addresses at runtime, without requiring manual updates. When an FQDN object is used in an address group, the firewall performs DNS resolution each time the policy is evaluated, ensuring that the latest IP addresses are used even if they change frequently.
Exam trap
The trap here is that candidates may think FQDN objects require manual IP updates or that dynamic address groups can perform DNS resolution, but in reality, only FQDN objects provide automatic, runtime DNS resolution without manual intervention.
How to eliminate wrong answers
Option A is wrong because a region object is based on geographic location (e.g., country or continent) and cannot represent a dynamic set of IP addresses resolved from an FQDN. Option B is wrong because a dynamic address group with a tag-based filter is used to group objects by tags, not to automatically resolve FQDNs to IPs; it does not handle DNS resolution. Option D is wrong because manually adding all possible IP addresses is impractical and error-prone when IPs change frequently, and it defeats the purpose of automation and dynamic resolution.
An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?
Address object directly defines a specific IP address.
Why this answer
To block traffic from a specific internal IP address to the internet, you must identify that source IP in the security policy rule. An Address Object is the correct object type because it represents a single IP address or subnet and can be directly placed in the source field of a security policy rule to match traffic from that host. Tags, Address Groups, and Regions are not designed to represent a single IP address for source matching in this context.
Exam trap
The trap here is that candidates may confuse Address Groups with Address Objects, thinking they need a group for flexibility, but the question explicitly asks for the object type to use for a single IP, making the Address Object the direct and correct answer.
How to eliminate wrong answers
Option B (Tag) is wrong because Tags are metadata labels used for policy identification, grouping, or dynamic filtering, not for matching source IP addresses in a security rule. Option C (Address Group) is wrong because while an Address Group can contain Address Objects, using a group for a single IP is unnecessary and adds complexity; the question asks for the object type to use, and the most direct and correct choice is the Address Object itself. Option D (Region) is wrong because Region objects define geographic locations based on IP ranges, not a specific internal IP address, and are typically used in destination or source fields for geo-blocking, not for blocking a single host.
An administrator wants to create a service object for TCP port 8080 and call it 'web-proxy'. Which properties must be specified?
Service objects require both protocol and destination port.
Why this answer
In Palo Alto Networks firewalls, a service object defines a specific application protocol and port combination for traffic classification and policy enforcement. For TCP port 8080, both the protocol (TCP) and the destination port (8080) must be specified because the firewall requires the protocol to differentiate between TCP, UDP, or other IP protocols, and the destination port to match the traffic. Option B is correct because without both, the service object would be incomplete and could not be used in security rules.
Exam trap
The trap here is that candidates often assume only the destination port is needed, forgetting that the protocol is mandatory to uniquely identify the service, as the same port number can be used by different protocols (e.g., TCP vs. UDP).
How to eliminate wrong answers
Option A is wrong because specifying only the destination port without the protocol would leave the service object ambiguous, as the firewall cannot determine whether the traffic uses TCP, UDP, or another protocol. Option C is wrong because source ports are not used in service object definitions; service objects are based on destination ports and protocols, as source ports are typically ephemeral and not relevant for service identification. Option D is wrong because specifying only the protocol without a destination port would create a generic service that matches all traffic of that protocol, which is not the intended behavior for a specific TCP port 8080 service.
An administrator creates a custom service object for TCP port 3389. What is the standard name for this service?
RDP uses TCP port 3389.
Why this answer
TCP port 3389 is the default port used by Remote Desktop Protocol (RDP), which is a Microsoft proprietary protocol that enables remote graphical desktop access to Windows systems. The administrator creating a custom service object for this port is standardizing the service as RDP, as defined in the PCNSA curriculum for managing objects.
Exam trap
The trap here is that candidates may confuse RDP with other remote access protocols like SSH or Telnet, but the specific port 3389 is exclusively associated with RDP in standard networking practice.
How to eliminate wrong answers
Option A is wrong because FTP (File Transfer Protocol) uses TCP ports 20 and 21, not 3389. Option C is wrong because SSH (Secure Shell) uses TCP port 22, not 3389. Option D is wrong because Telnet uses TCP port 23, not 3389.
Which object type is used to group multiple service objects together for use in a security policy?
Service groups combine multiple service objects for policy use.
Why this answer
A service group is the correct object type because it allows you to combine multiple service objects (e.g., TCP/UDP port numbers) into a single logical group. This group can then be referenced directly in a security policy rule, simplifying rule creation and maintenance by reducing the number of individual service entries needed.
Exam trap
The trap here is that candidates often confuse 'service group' with 'address group' because both are grouping constructs, but they serve entirely different purposes — one for ports/protocols and one for IP addresses — and the exam expects you to know which object type applies to which policy element.
How to eliminate wrong answers
Option A is wrong because a Schedule object is used to define time-based access control (e.g., business hours), not to group service objects. Option B is wrong because a Tag is a metadata label for filtering or organizing objects in the firewall GUI, not a container for service definitions. Option D is wrong because an Address group is used to group IP addresses or FQDNs, not services; it is the correct grouping mechanism for network objects, not service objects.
Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?
Correct quote type is double quotes for the filter string.
Why this answer
Option D is correct because in PAN-OS, dynamic address group filters that use name-based patterns must be enclosed in double quotes (e.g., 'WebServer-*') to be interpreted correctly. Single quotes are not recognized by the system as valid string delimiters for filter expressions, causing the filter to fail to match the intended address objects.
Exam trap
Palo Alto Networks often tests the subtle syntax requirement that dynamic address group filters must use double quotes (not single quotes) for name-based patterns, leading candidates to overlook this detail and incorrectly assume tags or object types are the issue.
How to eliminate wrong answers
Option A is wrong because dynamic address groups do not require tags; they can use name-based filters or tag-based filters, and tags are optional. Option B is wrong because dynamic address groups can indeed use name-based filters (e.g., with wildcards like '*'), not just tags; tags are one method but not the only one. Option C is wrong because dynamic address groups support IP ranges, network objects, and FQDNs; the use of an IP range in 'WebServer-2' is not a limitation.
A network administrator manages a Palo Alto Networks firewall in a datacenter. They have configured dynamic address groups (DAGs) to automatically include servers based on tags. The tags are assigned via User-ID from Active Directory. The administrator notices that some servers that should be in the DAG are not appearing, while others are correctly added. The firewall is configured to receive User-ID information from a domain controller via the PAN-OS Agent. The tags are correctly assigned in Active Directory. What should the administrator verify first?
The filter expression must exactly match the tag name; even a minor typo can cause the DAG to not include the intended servers.
Why this answer
The most common cause when tags are correctly assigned in Active Directory but servers are missing from a dynamic address group (DAG) is an incorrect filter expression on the DAG itself. The DAG uses a tag-based filter (e.g., 'tag1' or 'tag1 AND tag2') to match registered IP-address-to-tag mappings; if the filter syntax or tag name does not exactly match what is being registered via User-ID, the servers will not be included. The administrator should verify the DAG's filter expression first before investigating other components.
Exam trap
The trap here is that candidates often assume the problem must be with the User-ID data source (AD or agent) or licensing, when in fact the most direct and likely cause is a simple mismatch in the DAG filter expression itself.
How to eliminate wrong answers
Option A is wrong because the firewall's User-ID agent is already receiving tags correctly (the tags are correctly assigned in AD and the agent is configured), so the issue is not about fetching from the wrong domain. Option C is wrong because if the User-ID license were inactive, no tags would be registered at all, but the administrator observes that some servers are correctly added, indicating the license is active. Option D is wrong because security policies using the DAG do not need to be committed for the DAG to populate; DAG membership is evaluated in real time based on the current tag registrations, independent of policy commit state.
A company uses a Palo Alto Networks firewall to control outbound access. They have created custom application filters to block social media and streaming. However, they need to allow a specific corporate YouTube channel for training videos. The administrator creates an application group "Corporate-YouTube" containing the "youtube-base" application, and adds a security rule to allow traffic from internal users to the application group. Despite this, users still cannot access the corporate YouTube channel. What is the most likely reason?
URL filtering profiles can block based on URL category before the application is identified, preventing access even if the application is allowed.
Why this answer
The most likely reason is that the URL filtering profile is blocking the YouTube category before the firewall can identify the application. Palo Alto Networks firewalls process URL filtering before application identification in the security policy evaluation order. Even though the application group 'Corporate-YouTube' is allowed, the URL filtering profile (which is applied to the rule or as a default) will block the request if the URL category (e.g., 'streaming-media' or 'social-networking') is denied, preventing the traffic from reaching the application identification stage.
Exam trap
The trap here is that candidates assume application-based rules override all other checks, but Palo Alto Networks firewalls evaluate URL filtering before App-ID, so a URL filtering block will prevent the application from being identified and allowed.
How to eliminate wrong answers
Option B is wrong because if the application group were not correctly associated with the security policy, the rule would not match at all, but the question states the rule was created and added; the issue is that URL filtering preempts the application match. Option C is wrong because 'youtube-base' is a standard, well-known application in Palo Alto Networks App-ID and is recognized by the firewall; if it were not recognized, the rule would simply not match, but the problem is a block before App-ID. Option D is wrong because even if the allow rule is placed after a deny rule for 'streaming', the deny rule would block the traffic based on the application or category, but the scenario describes a custom application filter blocking social media and streaming, not a security rule; the deny rule would need to explicitly match the traffic, and the order could be an issue, but the most likely cause is URL filtering, which is a separate profile that can block regardless of rule order.
Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
IPsec VPN setup involves IKE gateway, IPsec profile, tunnel interface, security policy, and routing.
An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?
FQDN resolution occurs at commit, ensuring the group uses the current IP.
Why this answer
Option D is correct because Palo Alto Networks firewalls automatically resolve FQDNs at commit time. When an FQDN address object is included in an address group, the firewall performs a DNS resolution during the commit process and updates the group with the current IP address(es). This ensures that the group reflects the latest IP mapping without requiring manual intervention.
Exam trap
The trap here is that candidates may think FQDNs require manual updates or that only dynamic groups support automatic resolution, but Palo Alto firewalls resolve FQDNs at commit for any group type.
How to eliminate wrong answers
Option A is wrong because the firewall automatically resolves the FQDN at commit, so manual updates are unnecessary. Option B is wrong because the automatic update occurs regardless of whether the address group is static or dynamic; the FQDN resolution happens at commit for any group containing an FQDN object. Option C is wrong because FQDN objects can indeed be included in address groups; they are a supported object type in Palo Alto Networks address groups.
An administrator wants to group multiple servers with different IP addresses that all use the same port 443. What is the most efficient way to create a security policy rule for this traffic?
This reduces administrative effort and groups related objects.
Why this answer
Option D is correct because creating an address group to contain the multiple server IP addresses and a service group for port 443 allows a single security policy rule to match all the servers and the specific service. This is the most efficient method as it reduces rule count and administrative overhead, leveraging group objects for scalability and ease of management.
Exam trap
The trap here is that candidates may confuse dynamic address groups (which rely on tags and external data) with static address groups, or assume that a single subnet object can cover non-contiguous IPs, leading them to choose option A or C.
How to eliminate wrong answers
Option A is wrong because using a single address object with a subnet would only work if all servers share a contiguous IP range, which is not the case here (different IP addresses). Option B is wrong because creating separate rules for each server is inefficient and increases rule count, violating best practices for policy management. Option C is wrong because dynamic address groups with tags are used for grouping objects based on dynamic criteria (e.g., IP address changes via external sources), not for statically grouping multiple known IP addresses; tags are not needed for this static grouping.
How many address objects are members of the 'web-servers' address group?
The exhibit clearly lists two members.
Why this answer
The 'web-servers' address group contains exactly two address objects: one for the web server's IP address (e.g., 10.0.0.10) and one for the web server's subnet (e.g., 10.0.0.0/24). In Palo Alto Networks firewalls, address groups aggregate static or dynamic address objects, and the count is determined by the number of member objects explicitly added, not by the number of IPs within a subnet. Option D is correct because the group has two members.
Exam trap
The trap here is that candidates often miscount the number of address objects by confusing individual IP addresses within a subnet object as separate members, rather than recognizing that a single subnet object (e.g., 10.0.0.0/24) counts as one member regardless of how many hosts it represents.
How to eliminate wrong answers
Option A is wrong because it suggests three members, which would require an additional address object not present in the group configuration. Option B is wrong because it implies only one member, but the group contains two distinct address objects (a host and a subnet). Option C is wrong because it indicates four members, which would require more objects than the group actually contains, possibly confusing the number of IP addresses with the number of address objects.
A security administrator is configuring an address object for a web server accessible from the internet. The server has a public IP of 203.0.113.10/32 and a private IP of 10.0.1.10/32. The administrator needs to create a security policy that allows inbound HTTPS traffic to the server. Which address object type should be used for the destination?
IP Netmask /32 is the correct and most efficient way to represent a single host.
Why this answer
The correct answer is D because the security policy destination must match the IP address that the firewall sees in the packet header. For inbound traffic from the internet, the destination IP is the public IP 203.0.113.10/32, so an IP Netmask object with that exact address is the appropriate type. Using a /32 netmask ensures a single host match, which is precise and efficient for firewall rule evaluation.
Exam trap
The trap here is that candidates often confuse the private IP (used internally) with the public IP (used for inbound internet traffic), leading them to select an object type that references the private address, such as IP Range or FQDN, instead of the correct public IP Netmask.
How to eliminate wrong answers
Option A is wrong because an FQDN object resolves to an IP address dynamically, but the firewall policy must match the static public IP in the packet; FQDN is typically used for outbound traffic or when the IP changes frequently, not for a fixed public server. Option B is wrong because an IP Range object (10.0.1.10-10.0.1.10) specifies the private IP, but inbound traffic from the internet arrives with the public IP as the destination, so this would never match. Option C is wrong because an IP Wildcard Mask (203.0.113.0/0.0.0.255) matches a range of addresses (203.0.113.0–203.0.113.255), which is too broad and could allow traffic to unintended hosts, violating the principle of least privilege.
An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?
Address groups combine multiple address objects, simplifying policy creation.
Why this answer
Option D is correct because an address group allows the administrator to group multiple subnets into a single object, which can then be referenced in a security policy rule. This simplifies rule management by reducing the number of individual source address entries needed, making the policy easier to maintain and audit.
Exam trap
The trap here is that candidates may confuse address groups with service groups, thinking both are used for grouping, but service groups only apply to ports/protocols, not IP addresses or subnets.
How to eliminate wrong answers
Option A is wrong because tags are used for policy rule categorization and filtering in the management interface, not for grouping IP addresses or subnets. Option B is wrong because schedules define time-based access windows and have no relation to grouping subnets for source matching. Option C is wrong because service groups are used to combine multiple protocols or ports (e.g., TCP/80 and TCP/443) into a single object, not to group IP addresses or subnets.
A small business uses a Palo Alto Networks PA-220 firewall. The administrator needs to create a security policy to allow inbound VPN connections from remote employees using IPsec. The remote employees connect using dynamic IP addresses. The administrator creates an address object "Remote-VPN-Users" of type "IP Range" but that doesn't work because the IPs are not known. What address object type should be used instead?
Using 'Any' as source allows all IP addresses, which is the only way to accommodate dynamic remote users.
Why this answer
The correct answer is B because when remote employees connect using dynamic IP addresses, the source IP is unknown and cannot be defined by a static address object. Using 'Any' (0.0.0.0/0) as the source address in the security policy allows the firewall to accept IPsec VPN traffic from any source IP, which is necessary for clients with dynamic addresses. This is a common practice for remote access VPN configurations where the peer IP is not predetermined.
Exam trap
The trap here is that candidates may think an IP range or netmask can be used to cover a broad set of dynamic IPs, but they fail to recognize that dynamic IPs are unpredictable and cannot be enumerated, making 'Any' the only viable option for source address in remote access VPN policies.
How to eliminate wrong answers
Option A is wrong because IP Netmask requires a specific subnet or host IP, which is not possible when remote users have dynamic IPs that change each connection. Option C is wrong because FQDN resolves to a static IP address or set of IPs, but dynamic IPs are not reliably mapped to a single FQDN, and the firewall would need DNS resolution at policy evaluation time, which is not suitable for dynamic IPsec peers. Option D is wrong because IP Wildcard Mask is used for matching ranges of IPs in a bitwise pattern (similar to ACLs), but it still requires a known range or pattern, which is not feasible when the IPs are completely unknown and dynamic.
Which three of the following are true about tag-based dynamic address groups? (Choose three.)
Tags are metadata that can be assigned to address objects.
Why this answer
Option A is correct because tags are metadata labels that can be applied to address objects in Palo Alto Networks firewalls. This allows you to categorize objects flexibly, and dynamic address groups use these tags to automatically include or exclude objects based on tag membership.
Exam trap
Palo Alto Networks often tests the misconception that tags are case-sensitive, but in Palo Alto Networks, tags are case-insensitive, and candidates may also incorrectly assume static groups can use tags for dynamic matching.
A healthcare organization uses Palo Alto Networks firewalls to secure patient data. They have strict compliance requirements to log all access to medical records servers. The servers are grouped in an address group "Medical-Servers". The administrator wants to ensure that any security policy that uses this address group as destination also logs the session end. They also want to reduce administrative overhead. What is the best way to enforce logging for all policies referencing this group?
This single policy, when placed appropriately, will log all sessions to the group with minimal overhead.
Why this answer
Option D is correct because it allows the administrator to enable logging at session end directly on a single security policy that uses the address group 'Medical-Servers' as the destination. This ensures all traffic matching that policy is logged without needing to modify multiple policies, reducing administrative overhead while meeting compliance requirements.
Exam trap
The trap here is that candidates may think a log forwarding profile is required to enable logging, when in fact logging at session end is a per-rule setting, and forwarding profiles only handle log export and filtering.
How to eliminate wrong answers
Option A is wrong because placing a generic catch-all policy at the end of the rulebase would log all traffic, not just traffic to the Medical-Servers group, and could introduce security gaps by matching unintended traffic. Option B is wrong because applying a log forwarding profile to each policy individually increases administrative overhead, contradicting the goal of reducing it, and log forwarding profiles control where logs are sent, not whether session end logging is enabled. Option C is wrong because the policy optimizer is used to analyze and suggest rule changes based on traffic patterns, not to automatically add logging settings to existing policies.
An organization has deployed Palo Alto Networks firewalls in a multi-tenant environment. Each tenant has its own set of address objects and address groups. The firewall administrator wants to ensure that address objects from one tenant cannot be used in security policies of another tenant. What is the best practice to achieve this?
Virtual systems create independent logical firewalls, ensuring complete isolation of objects and policies.
Why this answer
Option D is correct because virtual systems (vsys) provide complete administrative and traffic separation between tenants in a multi-tenant Palo Alto Networks firewall deployment. Each vsys has its own independent configuration, including address objects, address groups, security policies, and routing tables, ensuring that objects from one tenant cannot be referenced or used in another tenant's policies. This is the only option that enforces true isolation at the firewall level.
Exam trap
The trap here is that candidates often confuse administrative separation (like device groups or tags) with true multi-tenant isolation, assuming that naming conventions or Panorama constructs can enforce object boundaries when only virtual systems provide the necessary hardware-enforced separation.
How to eliminate wrong answers
Option A is wrong because prefix-based naming conventions are a manual organizational method and do not prevent a policy from referencing an object from another tenant; they rely on administrator discipline and offer no technical enforcement. Option B is wrong because device groups in Panorama are used for centralized management and template/policy sharing across firewalls, but they do not isolate objects within a single firewall; objects in different device groups can still be referenced in policies if the firewall belongs to multiple groups. Option C is wrong because tags are metadata labels used for filtering and reporting, not for access control or policy enforcement; they do not restrict which objects can be used in security policies.
A security policy rule has an action of "allow". Which TWO objects are mandatory for the rule to be valid? (Choose two.)
Every rule must have a source address (can be 'any').
Why this answer
In Palo Alto Networks security policy rules, the source and destination addresses are mandatory because the firewall must know which traffic to evaluate. Without a source or destination address, the rule cannot define the traffic flow and would be invalid. The 'allow' action requires at least these two address objects to create a valid rule.
Exam trap
Palo Alto Networks often tests the misconception that Application or Service are mandatory for an 'allow' rule, but Palo Alto Networks allows 'any' for these fields, making source and destination addresses the only mandatory objects.
A firewall administrator needs to allow traffic based on the application, not just port. Which type of object should be used in the security policy?
Application objects identify traffic by application signatures, allowing port-independent policy enforcement.
Why this answer
The correct answer is D because the question explicitly requires allowing traffic based on the application, not just the port. In Palo Alto Networks firewalls, Application objects are used in security policies to identify traffic by its application signature (e.g., SSL, Facebook, or custom apps), enabling Layer 7 control regardless of the port used. This is a core feature of App-ID technology, which distinguishes Palo Alto firewalls from port-based legacy firewalls.
Exam trap
The trap here is that candidates often confuse Service objects (port-based) with Application objects (app-based), assuming that specifying a port like TCP/443 is sufficient to allow HTTPS traffic, but the PCNSA exam emphasizes that App-ID is required for true application-level control.
How to eliminate wrong answers
Option A is wrong because a Region object is used to group IP addresses by geographic location (e.g., country or continent) for geo-blocking or geo-allow policies, not for identifying applications. Option B is wrong because an Address object defines a specific IP address or subnet (e.g., 10.0.0.0/8) for source or destination matching, not the application layer. Option C is wrong because a Service object defines a protocol and port number (e.g., TCP/443 for HTTPS), which matches traffic based solely on Layer 4 criteria, not the application identity.
An administrator creates a dynamic address group named 'prod-servers' configured to match any tag with the value 'production'. After tagging address objects with 'Production' (capital P), the group does not include them. What is the most likely cause?
Tags are case-sensitive; 'Production' and 'production' are different.
Why this answer
Dynamic address groups in Palo Alto Networks firewalls match tags exactly, including case sensitivity. Since the group is configured to match the tag value 'production' (lowercase) and the address objects are tagged with 'Production' (capital P), the mismatch prevents the objects from being included. Tags are case-sensitive strings, so 'production' and 'Production' are considered different values.
Exam trap
The trap here is that candidates may assume tags are case-insensitive (like many other network device configurations) and overlook the exact-match requirement, leading them to choose Option D or incorrectly attribute the issue to a commit requirement.
How to eliminate wrong answers
Option B is wrong because dynamic address groups match tags globally across all zones; zone membership does not affect tag-based inclusion. Option C is wrong because tagging address objects does not require a commit to update the dynamic group membership — the group is evaluated in real time based on current tags. Option D is wrong because tags are explicitly case-sensitive in Palo Alto Networks firewalls, as demonstrated by the mismatch in this scenario.
Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)
This feature allows adding new address objects directly.
Why this answer
Option A is correct because the 'Show Group Membership' feature in the PAN-OS web interface allows you to view all members of an address group and directly add a new address object by clicking 'Add New Address'. This creates a new address object and adds it to the group in one step. Option C is correct because navigating to Objects > Address Groups, selecting the group, and clicking 'Add' lets you add an existing address object to the group, though you cannot type an IP directly—you must select an existing address object from the list.
Exam trap
The trap here is that candidates confuse the 'Add' button in the address group editor (which only adds existing address objects) with the ability to type an IP directly, and they mistakenly think the CLI command 'set address-group ... add ip' is valid when the correct syntax requires a pre-existing address object.
Which THREE are valid object types in Palo Alto Networks NGFW? (Choose three.)
Schedule objects define time-based access.
Why this answer
Schedule is a valid object type in Palo Alto Networks NGFW used to define time-based access rules. It allows administrators to restrict policy enforcement to specific days and hours, such as 'Business Hours' or 'Weekends', and is referenced directly in Security policy rules.
Exam trap
The trap here is that candidates may confuse 'User' as a valid object type because it appears in policy configuration, but Palo Alto Networks does not have a standalone 'User' object; instead, users are handled via User-ID and authentication profiles.
A security administrator needs to create address objects for a group of servers that share the same subnet 192.168.10.0/24. Which TWO methods can be used to efficiently manage these objects in Palo Alto Networks firewall configuration?
A subnet address object directly represents the entire subnet and is the most efficient method.
Why this answer
Option C directly uses the subnet as an address object, which is efficient for a contiguous subnet. Option D uses a dynamic address group with tags, allowing flexible grouping without manual updates. Option A uses a range, which is less efficient for a subnet.
Option B requires creating multiple individual objects. Option E is not a valid concept.
Which three of the following are valid types of address objects in Palo Alto Networks? (Choose three.)
FQDN is a valid type for domain names.
Why this answer
FQDN (Fully Qualified Domain Name) is a valid address object type in Palo Alto Networks that allows you to define a security policy rule based on a domain name rather than an IP address. The firewall dynamically resolves the FQDN to IP addresses at runtime, which is useful for destinations like cloud services or websites with changing IPs.
Exam trap
The trap here is that candidates may confuse 'Subnet Object' with the valid 'IP Netmask' type, or assume MAC addresses are valid address objects due to their use in other security contexts, but Palo Alto Networks strictly uses Layer 3 IP-based address objects for policy enforcement.
A company with a Palo Alto Networks firewall operating in Layer 2 transparent mode wants to control access to an internal ERP system. The ERP system uses a non-standard TCP port 4444. The security administrator creates a custom application object named 'ERP' with protocol set to 'tcp' and port range 4444-4444. Then, a security policy is configured allowing application 'ERP' from the internal zone to the ERP server zone. Users report they cannot connect to the ERP system. Firewall logs show no traffic matching the application 'ERP'. What should the administrator do to resolve the issue?
Application Override bypasses App-ID and forces traffic on that port to be treated as the specified application, enabling the security rule to match.
Why this answer
Option C is correct because in Layer 2 transparent mode, Palo Alto Networks firewalls rely on Application Override policies to bypass App-ID for traffic that uses non-standard ports. Since the custom application 'ERP' is defined with TCP port 4444 but App-ID cannot identify it on that port (as it is non-standard), an Application Override policy explicitly maps the traffic to the 'ERP' application, allowing the security policy to match and permit the traffic.
Exam trap
The trap here is that candidates assume creating a custom application object with the correct port is sufficient, but they overlook that App-ID must first identify the traffic, which requires an Application Override for non-standard ports.
How to eliminate wrong answers
Option A is wrong because 'application-default' refers to the predefined ports for known applications, not a custom application; it would not help identify traffic on a non-standard port. Option B is wrong because adding a service object for port 4444 does not solve the identification issue; the security policy already allows the application, but the traffic is not being recognized as 'ERP' due to App-ID failure. Option D is wrong because disabling application identification would remove all application-based controls, which is overly broad and insecure, and would not specifically resolve the identification of the custom application.
Refer to the exhibit. An admin reviews the traffic log and sees that traffic from 192.168.1.100 to 10.0.0.50 is allowed by rule 'rule1'. The rule uses a service group 'web-services' which includes 'service-http' and 'service-https'. However, the admin intended to block HTTPS traffic. What is the misconfiguration?
Removing 'service-https' from the group would block HTTPS while allowing HTTP.
Why this answer
The service group 'web-services' includes both 'service-http' (TCP/80) and 'service-https' (TCP/443). Since the rule allows traffic matching any service in the group, HTTPS traffic is inadvertently permitted. To block HTTPS while allowing HTTP, the admin must remove 'service-https' from the service group or create a separate rule.
Exam trap
Palo Alto Networks often tests the distinction between service objects (port-based) and application objects (payload-based), and the trap here is that candidates may think removing the application 'web-browsing' would fix the issue, but the rule uses a service group, not an application.
How to eliminate wrong answers
Option A is wrong because the application 'web-browsing' is not part of the rule configuration described; the rule uses a service group, not an application object, so removing an application would not address the service misconfiguration. Option B is correct as explained. Option C is wrong because changing the rule action to deny would block all traffic matching the rule, including the intended HTTP traffic, which is not the desired outcome.
Option D is wrong because the source IP being an address group is irrelevant to the issue; the problem lies in the service group definition, not the source addressing.
Match each PAN-OS CLI command to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Displays firewall version and uptime
Lists all interfaces and their status
Displays active security rules
Reboots the firewall
Why these pairings
These are common CLI commands for troubleshooting.
An organization uses an External Dynamic List (EDL) to block IP addresses. The EDL is updated every 5 minutes on the server, but the firewall still uses the old list even after the refresh interval. What is the most likely cause?
The cache time instructs the firewall to keep the old list until it expires.
Why this answer
The External Dynamic List (EDL) cache time on the firewall determines how long the firewall retains the downloaded list before requesting a fresh copy from the server. If the cache time is set higher than the server's update interval (e.g., 10 minutes vs. 5 minutes), the firewall will continue using the old list even after the server has updated, because it does not re-fetch the list until the cache expires. This is the most likely cause of the observed behavior.
Exam trap
The trap here is that candidates often assume the issue is with connectivity or registration (options A, B, or C), but the real cause is a misalignment between the firewall's cache time and the server's update frequency, which is a subtle but critical configuration detail.
How to eliminate wrong answers
Option A is wrong because an invalid EDL URL would cause the firewall to fail to download the list entirely, not to use an old list after a refresh interval. Option B is wrong because if the EDL were not registered as a dynamic list, the firewall would not be able to use it at all for blocking; the question states the firewall uses the old list, implying it was registered and functional. Option C is wrong because DNS resolution failure would prevent the firewall from reaching the EDL server, resulting in no list update or a download failure, not the use of a cached old list.
Based on the log excerpt, which object is used for the destination address?
'any' is the pre-defined address object used as the destination.
Why this answer
The log excerpt shows the destination address field is set to 'any', which is a predefined address object in Palo Alto Networks firewalls that matches any IP address. Since the question asks for the object used for the destination address, 'Address any' is the correct answer because it directly corresponds to the destination address object in the log entry.
Exam trap
The trap here is that candidates confuse the destination address object with other policy components like zones or services, because the log excerpt may show multiple fields, but the question specifically targets the address object used for the destination.
How to eliminate wrong answers
Option A is wrong because 'Zone untrust' is a security zone, not an address object; it defines the source or destination zone in the policy, not the destination address. Option B is wrong because 'Application web-browsing' is an application object that identifies traffic type (e.g., HTTP/HTTPS), not a destination address. Option D is wrong because 'Service service-http' is a service object that defines the destination port (TCP/80), not the destination address.
Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
VLAN interface setup involves creating VLAN, assigning interfaces, IP address, security policy, and commit.
Ready to test yourself?
Try a timed practice session using only Managing Objects questions.