Palo Alto Networks Exam PCNSA Topic 2 Question 60 Discussion

Actual exam question for Palo Alto Networks's PCNSA exam

Question #: 60
Topic #: 2

[All PCNSA Questions]

Which two options does the firewall use to dynamically populate address group members? (Choose two.)

AIP Addresses

BTags

CMAC Addresses

DTag-based filters

Show Suggested Answer

Suggested Answer: B, D

A dynamic address group populates its members dynamically using look ups for tags and tag-based filters. Tags are metadata elements or attribute-value pairs that are registered for each IP address. Tag-based filters use logical and and or operators to match the tags and determine the membership of the dynamic address group. For example, you can create a dynamic address group that includes all IP addresses that have the tags ''web-server'' and ''linux''. You can also use static tags as part of the filter criteria.Reference:Policy Object: Address Groups,Use Dynamic Address Groups in Policy,Statics vs. Dynamic Address Objects Groups

by Loren at Apr 08, 2024, 08:28 AM

Limited Time Offer

25%

Off

Get Premium PCNSA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Launa

7 months ago

I'm not sure about that, David. I think MAC Addresses are not typically used for that purpose.

upvoted 0 times

...

Aide

7 months ago

I think MAC Addresses should be one of the options used by the firewall for dynamic population.

upvoted 0 times

...

Portia

7 months ago

You're right, Tags are another option for the firewall to use.

upvoted 0 times

...

Shayne

8 months ago

I believe Tags can also be used to dynamically populate address group members.

upvoted 0 times

...

Launa

8 months ago

I agree with IP Addresses are commonly used for that purpose.

upvoted 0 times

...

Portia

9 months ago

I think the firewall uses IP Addresses to dynamically populate address group members.

upvoted 0 times

...

Kathrine

9 months ago

Haha, yeah, the MAC addresses are a bit of a wild card here. I'm pretty sure the firewall doesn't care about those. And the tag-based filters, that's just the firewall's way of saying 'let me do all the work for you'.

upvoted 0 times

...

Regenia

9 months ago

Ooh, I bet the answer is B and C! Tags and MAC addresses. That would make sense for a dynamic address group, right? You could group things based on tags and then include devices based on their MAC addresses.

upvoted 0 times

...

Richelle

9 months ago

You guys are right, IP addresses and tags are definitely the way to go. As for the MAC addresses, I'm pretty sure that's just for local network stuff, not for the firewall. And the tag-based filters, well, that's just a fancy way of saying 'use tags', isn't it?

upvoted 0 times

...

Annalee

9 months ago

Hmm, I don't know. I feel like MAC addresses might also be an option, especially if you're dealing with a more specialized network setup. But I'm not sure if that's really considered 'dynamic' population.

upvoted 0 times

...

Josephine

9 months ago

I agree with Deonna on the IP addresses and tags, but I'm also wondering about the tag-based filters. Isn't that kind of like using the tags to populate the groups?

upvoted 0 times

...

Rosina

9 months ago

Yeah, I agree. IP addresses have to be one of the choices, right? Otherwise, how would you even create an address group in the first place?

upvoted 0 times

...

Deonna

9 months ago

Hmm, this is a tricky one. I'm pretty sure the firewall uses IP addresses and tags to dynamically populate the address group members, but I'm not sure about the MAC addresses. That seems a bit odd to me.

upvoted 0 times

...