What do you configure if you want to set up a group of objects based on their ports alone?

Question

Options

• Aaddress groups
• Bcustom objects
• Capplication groups
• Dservice groups

• A
  5% (1)
• C
  5% (1)
• D
  89% (17)

Explanation

Service groups are the correct answer because a "service" in firewall terminology refers to a port/protocol combination (e.g., TCP/443, UDP/53), and service groups let you bundle multiple such port definitions into a single reusable object for policy configuration.

Why the distractors are wrong:

• A. Address groups - these group IP addresses or subnets, not ports.
• B. Custom objects - these define patterns (like data patterns or URL categories), not port-based groupings.
• C. Application groups - these group applications by their app-ID signatures (e.g., all streaming apps), which goes beyond ports and uses behavioral/protocol analysis.

Memory tip: Think "service = port." Just as a network service (HTTP, DNS, FTP) is defined by its port, a service object in firewall policy represents a port/protocol pair - so grouping by port = service group.

No community discussion yet for this question.