Managing Objects practice questions

An administrator needs to block traffic from a specific internal IP address to the internet. Which object type should be used in the security policy source field?

Trap 1: Tag

Tags are metadata, not used for source matching in policies.

Trap 2: Address group

Address groups are used for multiple addresses, not a single IP.

Trap 3: Region

Regions are geographical groupings, not for a single IP.

A
Address object
Address object directly defines a specific IP address.
B
Tag
Why wrong: Tags are metadata, not used for source matching in policies.
C
Address group
Why wrong: Address groups are used for multiple addresses, not a single IP.
D
Region
Why wrong: Regions are geographical groupings, not for a single IP.

Read the full VPN explanation →

Question 2mediummultiple choice

A company has multiple branch offices that use overlapping private IP ranges (192.168.0.0/16). To avoid conflicts when these branches connect to the data center via IPsec, the administrator needs to translate branch source IPs to unique addresses. Which object type is best suited for this task?

Trap 1: External dynamic list

EDLs provide IP feeds, not NAT addresses.

Trap 2: Service group

Service groups define port/protocol sets, not translation addresses.

Trap 3: IPsec Crypto profile

Crypto profiles define encryption settings, not NAT addresses.

A
NAT address pool
NAT address pool specifies the translated IP addresses.
B
External dynamic list
Why wrong: EDLs provide IP feeds, not NAT addresses.
C
Service group
Why wrong: Service groups define port/protocol sets, not translation addresses.
D
IPsec Crypto profile
Why wrong: Crypto profiles define encryption settings, not NAT addresses.

Question 3hardmultiple choice

During a security audit, an administrator notices that a security policy rule uses an address group that includes an FQDN object. The FQDN resolves to multiple IP addresses that change frequently. What is the best practice for ensuring the firewall uses the current resolved IPs without manual intervention?

Trap 1: Use a region object instead

Regions are geographical, not suitable for FQDNs.

Trap 2: Create a dynamic address group with a tag-based filter

Dynamic groups filter based on tags, not FQDN resolution.

Trap 3: Manually add all possible IP addresses to an address group

Not scalable and misses new IPs.

A
Use a region object instead
Why wrong: Regions are geographical, not suitable for FQDNs.
B
Create a dynamic address group with a tag-based filter
Why wrong: Dynamic groups filter based on tags, not FQDN resolution.
C
Use an FQDN object in the address group; the firewall resolves it automatically
FQDN objects automatically resolve and update IPs.
D
Manually add all possible IP addresses to an address group
Why wrong: Not scalable and misses new IPs.

Question 4mediummultiple choice

An administrator wants to allow only specific applications (e.g., web-browsing, ssl) from the internal network to the internet. Which object type should be used in the security policy application field?

Trap 1: Application filter

Filters are for broad categories, not specific apps.

Trap 2: Application group

Groups are for multiple applications, but the question implies specific applications.

Trap 3: Service object

Service objects define ports/protocols, not applications.

A
Application object
Application objects define specific applications like web-browsing.
B
Application filter
Why wrong: Filters are for broad categories, not specific apps.
C
Application group
Why wrong: Groups are for multiple applications, but the question implies specific applications.
D
Service object
Why wrong: Service objects define ports/protocols, not applications.

Question 5mediummulti select

Which TWO statements about External Dynamic Lists (EDLs) are true?

Trap 1: EDLs have a fixed refresh interval that cannot be changed.

The refresh interval is configurable.

Trap 2: EDLs must be manually updated by an administrator.

EDLs are automatically refreshed from an external source.

Trap 3: EDLs allow the administrator to add individual IPs directly via the…

EDLs are read-only in the GUI; IPs cannot be added manually.

A
EDLs can be used in security policy source and destination fields.
EDLs can be used as address objects in policies.
B
EDLs have a fixed refresh interval that cannot be changed.
Why wrong: The refresh interval is configurable.
C
EDLs must be manually updated by an administrator.
Why wrong: EDLs are automatically refreshed from an external source.
D
EDLs support both IP addresses and URLs.
EDLs can contain IPs, URLs, or domains.
E
EDLs allow the administrator to add individual IPs directly via the GUI.
Why wrong: EDLs are read-only in the GUI; IPs cannot be added manually.

Read the full DNS explanation →

Question 6hardmultiple choice

An organization has a data center with servers in the 10.10.0.0/16 subnet and remote users who connect via GlobalProtect. The security team wants to ensure that only approved applications (web-browsing, ssl, dns) are allowed from the remote user subnet (172.16.0.0/24) to the data center. They create a security rule with source zone 'GP' (GlobalProtect), destination zone 'DC', source address '172.16.0.0/24', destination address '10.10.0.0/16', application 'web-browsing', 'ssl', 'dns', action 'allow'. After deployment, users complain that they cannot access a custom web application on port 8080, which uses HTTP but the application is identified as 'web-browsing'. The administrator checks the traffic logs and sees that the traffic is being denied by an implicit deny rule. What is the most likely cause?

Trap 1: The rule order is incorrect; a previous rule is denying the traffic.

The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.

Trap 2: The destination address object 10.10.0.0/16 is incorrect.

The subnet appears correct for the data center.

Trap 3: The source zone 'GP' should be 'untrust'.

GlobalProtect typically uses a dedicated zone 'GP'.

A
The application 'web-browsing' does not cover port 8080 traffic.
App-ID identifies traffic based on signatures, not just port. Custom HTTP on 8080 may not match 'web-browsing' signature, so it is not allowed.
B
The rule order is incorrect; a previous rule is denying the traffic.
Why wrong: The logs show implicit deny, which is the default rule at the end, indicating no matching allow rule.
C
The destination address object 10.10.0.0/16 is incorrect.
Why wrong: The subnet appears correct for the data center.
D
The source zone 'GP' should be 'untrust'.
Why wrong: GlobalProtect typically uses a dedicated zone 'GP'.

Question 7mediummultiple choice

Refer to the exhibit. An administrator configured a dynamic address group named 'WebServers-Group' with filter 'WebServer-*'. However, the group does not include the address objects 'WebServer-1' and 'WebServer-2'. What is the most likely reason?

Exhibit

Refer to the exhibit.

deviceconfig {
    devices {
        localhost.localdomain {
            vsys {
                vsys1 {
                    address {
                        entry {
                            @name = "WebServer-1";
                            ip-netmask = "10.0.1.10/32";
                        }
                        entry {
                            @name = "WebServer-2";
                            ip-range = "10.0.1.20-10.0.1.25";
                        }
                        entry {
                            @name = "WebServers-Group";
                            dynamic {
                                filter = "'WebServer-*'";
                            }
                        }
                    }
                }
            }
        }
    }
}

Trap 1: The filter should include a tag condition because dynamic groups…

Tags are not required; name-based filters work with correct syntax.

Trap 2: The dynamic address group cannot use name-based filters; it…

Dynamic address groups can use name-based filters without tags.

Trap 3: The address object 'WebServer-2' uses an IP range, which is not…

Dynamic address groups support IP range objects.

A
The filter should include a tag condition because dynamic groups require tags.
Why wrong: Tags are not required; name-based filters work with correct syntax.
B
The dynamic address group cannot use name-based filters; it requires tags.
Why wrong: Dynamic address groups can use name-based filters without tags.
C
The address object 'WebServer-2' uses an IP range, which is not supported in dynamic address groups.
Why wrong: Dynamic address groups support IP range objects.
D
The filter should use double quotes instead of single quotes around the pattern.
Correct quote type is double quotes for the filter string.

Question 8hardmulti select

Which TWO of the following are valid methods to add an IP address to a pre-existing address group in PAN-OS? (Select two.)

Trap 1: Execute 'set address-group <name> add ip <ip>' in CLI.

CLI syntax uses 'set address' and then 'set address-group' with member.

Trap 2: Use the Panorama template to 'push' the IP address directly into…

Panorama pushes objects, not raw IPs.

Trap 3: Create a tag, assign it to the IP address, and add the tag to the…

Tags are for dynamic groups, not for adding IPs to static groups.

A
Use the 'Show Group Membership' feature and click 'Add New Address' to input the IP.
This feature allows adding new address objects directly.
B
Execute 'set address-group <name> add ip <ip>' in CLI.
Why wrong: CLI syntax uses 'set address' and then 'set address-group' with member.
C
Navigate to Objects > Address Groups, select the group, and click 'Add' to enter the IP address directly.
This creates an inline address entry within the group.
D
Use the Panorama template to 'push' the IP address directly into the group on managed firewalls.
Why wrong: Panorama pushes objects, not raw IPs.
E
Create a tag, assign it to the IP address, and add the tag to the group.
Why wrong: Tags are for dynamic groups, not for adding IPs to static groups.

Read the full VPN explanation →

Question 9hardmultiple choice

A security administrator manages a Palo Alto Networks firewall in a large enterprise. The company has multiple remote sites connected via IPSec VPNs. Each site has its own subnet (e.g., Site A: 10.10.1.0/24, Site B: 10.10.2.0/24). The administrator needs to create a security policy that allows all inter-site traffic but blocks all traffic to and from the internet except for specific services. The administrator wants to use address groups to simplify management. Currently, there are address groups for each site (e.g., 'Site-A-Networks', 'Site-B-Networks') containing the respective subnets. The administrator also has an address group 'Internet-Allow' for allowed external IPs. The policy should have a rule that permits traffic from any site to any other site, and a rule that permits traffic from internal networks to the 'Internet-Allow' group for destination ports 80 and 443. Which of the following approaches best achieves this with minimal administrative overhead?

Trap 1: Create a static address group called 'All-Site-Networks' and…

Static group requires manual updates when sites change.

Trap 2: Create a security rule using the 'any' zone for source and…

Using 'any' would allow traffic to/from internet, violating the requirement.

Trap 3: Assign a tag 'Site-Network' to each site address object, then…

Tags require tagging each object; dynamic group with name filter is simpler.

A
Create a static address group called 'All-Site-Networks' and manually add each site's address group as a member. Then use this group in the inter-site rule.
Why wrong: Static group requires manual updates when sites change.
B
Create a security rule using the 'any' zone for source and destination, and rely on the existing site groups in the rule's source/destination fields.
Why wrong: Using 'any' would allow traffic to/from internet, violating the requirement.
C
Assign a tag 'Site-Network' to each site address object, then create a dynamic address group with filter "'Site-Network'". Use this group in the rule.
Why wrong: Tags require tagging each object; dynamic group with name filter is simpler.
D
Create a dynamic address group with filter "'Site-*-Networks'" to automatically include all site groups that follow the naming convention. Use this group in the rule.
Dynamic group automatically includes matching objects; minimal overhead.

Read the full VPN explanation →

Question 10mediumdrag order

Drag and drop the steps to configure a site-to-site IPsec VPN on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure a VLAN interface on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Match each firewall deployment mode to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Passively monitors traffic without blocking

Transparent layer 2 deployment

Routable mode with IP addresses

Failover configuration with one standby unit

Question 13mediummatching

Read the full NAT/PAT explanation →

Match each PAN-OS CLI command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays firewall version and uptime

Lists all interfaces and their status

Displays active security rules

Reboots the firewall

Question 14easymultiple choice

A network administrator needs to block traffic to a specific external website. Which object type should be used in the security policy to define the destination?

Trap 1: Schedule

Schedules define time-based access, not destinations.

Trap 2: Service

Service objects define ports and protocols, not IP addresses or FQDNs.

Trap 3: Tag

Tags are used for grouping and identification, not for defining destinations.

A
Schedule
Why wrong: Schedules define time-based access, not destinations.
B
Service
Why wrong: Service objects define ports and protocols, not IP addresses or FQDNs.
C
Address
Address objects define IP addresses or FQDNs, making them suitable for specifying a destination.
D
Tag
Why wrong: Tags are used for grouping and identification, not for defining destinations.

Question 15mediummultiple choice

An administrator has created an address group that includes an FQDN address object. When the FQDN's IP address changes, how does the firewall update the group?

Trap 1: The administrator must manually update the address object's IP…

Manual update is not required; the firewall handles resolution.

Trap 2: Only if the address group is dynamic will the update occur…

Dynamic groups are based on tags, not FQDN resolution. FQDN resolution happens regardless.

Trap 3: FQDN objects cannot be included in address groups.

FQDN objects are allowed in static address groups.

A
The administrator must manually update the address object's IP address.
Why wrong: Manual update is not required; the firewall handles resolution.
B
Only if the address group is dynamic will the update occur automatically.
Why wrong: Dynamic groups are based on tags, not FQDN resolution. FQDN resolution happens regardless.
C
FQDN objects cannot be included in address groups.
Why wrong: FQDN objects are allowed in static address groups.
D
The firewall automatically resolves the FQDN at commit and updates the group accordingly.
FQDN resolution occurs at commit, ensuring the group uses the current IP.

Question 16hardmultiple choice

An organization uses multiple firewalls and wants to share dynamic address groups across them. Which feature should be used?

Trap 1: Device groups

Device groups are for Panorama management, not for sharing dynamic address groups directly.

Trap 2: Shared policy

Shared policy is a concept, but EDL is the mechanism for sharing dynamic groups.

Trap 3: Template stacks

Template stacks manage configuration templates, not dynamic address group sharing.

A
Device groups
Why wrong: Device groups are for Panorama management, not for sharing dynamic address groups directly.
B
Shared policy
Why wrong: Shared policy is a concept, but EDL is the mechanism for sharing dynamic groups.
C
Template stacks
Why wrong: Template stacks manage configuration templates, not dynamic address group sharing.
D
External Dynamic Lists
EDLs allow external lists to be referenced in policies and shared across firewalls.

Question 17easymultiple choice

A security policy rule references a service object "HTTP" which is pre-defined. What is the default port for the HTTP service object?

Trap 1: 22

Port 22 is used for SSH.

Trap 2: 443

Port 443 is used for HTTPS, not HTTP.

Trap 3: 8080

Port 8080 is an alternate HTTP port but not the default.

A
22
Why wrong: Port 22 is used for SSH.
B
443
Why wrong: Port 443 is used for HTTPS, not HTTP.
C
8080
Why wrong: Port 8080 is an alternate HTTP port but not the default.
D
80
Port 80 is the standard port for HTTP.

Review the full subnetting walkthrough →

Question 18mediummultiple choice

An administrator needs to allow traffic from multiple subnets to a specific internal server. The subnets are all part of the same address group. Which object would simplify the security policy rule?

Trap 1: Tag

Tags are for grouping and identification, not for defining source addresses.

Trap 2: Schedule

Schedules define time-based access, not addresses.

Trap 3: Service group

Service groups group ports/protocols, not addresses.

A
Tag
Why wrong: Tags are for grouping and identification, not for defining source addresses.
B
Schedule
Why wrong: Schedules define time-based access, not addresses.
C
Service group
Why wrong: Service groups group ports/protocols, not addresses.
D
Address group
Address groups combine multiple address objects, simplifying policy creation.

Question 19hardmultiple choice

A company uses dynamic address groups based on tags. A virtual machine receives the tag "WebServer". After the VM is decommissioned, the tag is removed. What happens to the dynamic address group?

Trap 1: The group retains the IP address until manually removed.

Dynamic groups are automatically updated based on tags.

Trap 2: The group is deleted.

The group remains, only the member IP is removed.

Trap 3: The group requires a commit to update.

The group update is automatic; a commit may be needed for policy, but the group itself updates without commit.

A
The group automatically updates and removes the IP address.
Dynamic groups reflect tag changes in real-time.
B
The group retains the IP address until manually removed.
Why wrong: Dynamic groups are automatically updated based on tags.
C
The group is deleted.
Why wrong: The group remains, only the member IP is removed.
D
The group requires a commit to update.
Why wrong: The group update is automatic; a commit may be needed for policy, but the group itself updates without commit.

Question 20easymultiple choice

Which object type is used to group multiple service objects together for use in a security policy?

Trap 1: Schedule

Schedules define time-based access, not services.

Trap 2: Tag

Tags are used for grouping and identification, not for combining services.

Trap 3: Address group

Address groups group addresses, not services.

A
Schedule
Why wrong: Schedules define time-based access, not services.
B
Tag
Why wrong: Tags are used for grouping and identification, not for combining services.
C
Service group
Service groups combine multiple service objects for policy use.
D
Address group
Why wrong: Address groups group addresses, not services.