nerdexam
Palo_Alto_Networks

PCNSA · Question #140

The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website access any other websites…

The correct answer is D. Create a custom URL category, add *.powerball.com to it and allow it in the Security Profile. To allow access to a specific website while maintaining a block on its broader URL category, the most effective method is to create a custom URL category for the specific site and permit it in a security policy.

Submitted by rohit_dlh· Apr 18, 2026Policy Evaluation and Management

Question

The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website access any other websites also listed in the URL filtering "gambling" category. Which method allows the employees to access the PowerBall Lottery website but without unblocking access to the "gambling" URL category?

Options

  • BManually remove powerball.com from the gambling URL category.
  • CAdd *.powerball.com to the URL Filtering allow list.
  • DCreate a custom URL category, add *.powerball.com to it and allow it in the Security Profile.

How the community answered

(31 responses)
  • B
    10% (3)
  • C
    19% (6)
  • D
    71% (22)

Why each option

To allow access to a specific website while maintaining a block on its broader URL category, the most effective method is to create a custom URL category for the specific site and permit it in a security policy.

BManually remove powerball.com from the gambling URL category.

Manually removing a URL from a pre-defined PAN-DB URL category is not possible, as these categories are maintained and updated by Palo Alto Networks.

CAdd *.powerball.com to the URL Filtering allow list.

Adding `*.powerball.com` to a general URL Filtering allow list might not guarantee precedence over a broader 'gambling' category block, potentially failing to provide the specific exception needed.

DCreate a custom URL category, add *.powerball.com to it and allow it in the Security Profile.Correct

Creating a custom URL category for `*.powerball.com` and then allowing it in a specific security policy rule, placed with higher precedence than the general 'gambling' block, provides the granular control needed to permit the website without unblocking the entire category.

Concept tested: Granular URL filtering exceptions

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/create-a-custom-url-category

Topics

#URL Filtering#Custom URL Categories#Security Policy Exceptions#Policy Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSA Practice