nerdexam
Palo_Alto_Networks

PCNSA · Question #46

A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the…

The correct answer is B. Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any. To allow SSH access from the USERS zone to any server in public cloud environments (OUTSIDE zone), the firewall administrator should create a security rule that permits SSH traffic from the USERS zone to the OUTSIDE zone for any destination.

Submitted by rohit_dlh· Apr 18, 2026Securing Traffic

Question

A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS-and the OUTSIDE-zone. What configuration-changes should the Firewall- admin make?

Options

  • ACreate a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a
  • BCreate a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any
  • CIn addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains
  • DIn addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from

How the community answered

(48 responses)
  • A
    13% (6)
  • B
    77% (37)
  • C
    4% (2)
  • D
    6% (3)

Why each option

To allow SSH access from the USERS zone to any server in public cloud environments (OUTSIDE zone), the firewall administrator should create a security rule that permits SSH traffic from the USERS zone to the OUTSIDE zone for any destination.

ACreate a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a

This option describes creating a custom service object but does not specify how this service object would be used in a security rule, making it incomplete for enabling the required access.

BCreate a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from anyCorrect

Creating a security rule that allows traffic from the USERS zone to the OUTSIDE zone, with the application set to SSH and the destination address set to 'any', correctly enables SSH access to all current and future public cloud servers. This approach leverages the default security policy behavior of blocking unspecified traffic, and explicitly allows the desired SSH traffic to the broad OUTSIDE zone.

CIn addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains

Creating a return service object is not necessary for stateful firewalls; return traffic for a permitted session is automatically allowed without an explicit rule for the return path.

DIn addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from

An additional rule from OUTSIDE to USERS for SSH is redundant for establishing an outbound SSH connection from USERS to OUTSIDE, as the firewall maintains session state and allows return traffic automatically.

Concept tested: Palo Alto security policy configuration (outbound access)

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/security-policy/security-policy-rules#id49692482-132a-43cf-9f79-6799341142e0

Topics

#Security Policies#Zone-Based Filtering#SSH#Public Cloud Access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSA Practice