Palo Alto Networks Exam PCNSA Topic 2 Question 60 Discussion

Actual exam question for Palo Alto Networks's Palo Alto Networks Certified Network Security Administrator exam

Question #: 60
Topic #: 2

[All Palo Alto Networks Certified Network Security Administrator Questions]

Which two options does the firewall use to dynamically populate address group members? (Choose two.)

AIP Addresses

BTags

CMAC Addresses

DTag-based filters

Show Suggested Answer

Suggested Answer: B, D

A dynamic address group populates its members dynamically using look ups for tags and tag-based filters. Tags are metadata elements or attribute-value pairs that are registered for each IP address. Tag-based filters use logical and and or operators to match the tags and determine the membership of the dynamic address group. For example, you can create a dynamic address group that includes all IP addresses that have the tags ''web-server'' and ''linux''. You can also use static tags as part of the filter criteria.Reference:Policy Object: Address Groups,Use Dynamic Address Groups in Policy,Statics vs. Dynamic Address Objects Groups

by Loren at Apr 08, 2024, 08:28 AM

Limited Time Offer

25%

Off

Get Premium PCNSA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Richelle

7 hours ago

You guys are right, IP addresses and tags are definitely the way to go. As for the MAC addresses, I'm pretty sure that's just for local network stuff, not for the firewall. And the tag-based filters, well, that's just a fancy way of saying 'use tags', isn't it?

upvoted 0 times

...

Annalee

1 days ago

Hmm, I don't know. I feel like MAC addresses might also be an option, especially if you're dealing with a more specialized network setup. But I'm not sure if that's really considered 'dynamic' population.

upvoted 0 times

...

Josephine

1 days ago

I agree with Deonna on the IP addresses and tags, but I'm also wondering about the tag-based filters. Isn't that kind of like using the tags to populate the groups?

upvoted 0 times

...

Rosina

2 days ago

Yeah, I agree. IP addresses have to be one of the choices, right? Otherwise, how would you even create an address group in the first place?

upvoted 0 times

...

Deonna

2 days ago

Hmm, this is a tricky one. I'm pretty sure the firewall uses IP addresses and tags to dynamically populate the address group members, but I'm not sure about the MAC addresses. That seems a bit odd to me.

upvoted 0 times

...