Q: 12

Which two components of a Security policy, when configured, allow third-party contractors access to internal applications outside business hours? (Choose two.)

Options

Discussion

Ravi N. Oct 16, 2026 4:12 am

C and D imo, User-ID lets you specify the contractor group and Schedule covers the time restriction (outside business hours). That lines up with what the official Palo Alto study guides mention for controlling both who and when. Seen this in practice exams too, but let me know if I’m missing something.

Nina F. Oct 24, 2026 3:35 am

Guessing C and D are correct, not B. B is a classic distractor but doesn't handle who or when access happens.

Olivia Oct 25, 2026 5:11 pm

C and D. User-ID lets you specify the contractors, Schedule limits access to outside business hours. Makes sense based on policy usage.

Meera Z. Oct 18, 2026 5:48 pm

Does Service (B) ever help with time or user restriction, or is it always just protocol/port?

Drew M. Oct 18, 2026 5:37 am

C/D tbh, Service is tempting but that's only if the question said something about ports or protocols. User-ID and Schedule control user/time, so those are key. Seen similar in practice sets.

ArjunN Oct 13, 2026 11:06 pm

I don’t think it’s A. C and D make more sense since User-ID handles the contractor group and Schedule covers the "outside business hours" part. Not totally sure if Service would ever fit here, but looks like C/D is correct for this scenario.

Ethan Oct 18, 2026 11:41 pm

C/D? Service (B) is tempting but doesn’t control access by user or time, just port/protocol. User-ID (C) and Schedule (D) together lock it down to who and when, which matches the scenario. Seen similar on practice so pretty sure it’s these two.

ArjunI Oct 9, 2026 2:27 am

Seriously Palo Alto wording always messes with me-why not A? App-ID feels like it fits since apps are in scope.

Olivia M. Oct 25, 2026 7:17 am

C/D? User-ID (C) lets the policy target just the third-party contractors, while Schedule (D) sets the after-hours part. I remember similar practice questions focused on these fields in the official study guide. Pretty sure these two are what you need for user/time-based restriction.

Emma A. Oct 26, 2026 3:27 am

C D tbh. User-ID is for identifying those contractors by user, and Schedule limits it to after-hours-so both fit exactly what they're asking. No need for App-ID or Service here since it's about who and when, not what or how. Anyone see it differently?

Be respectful. No spam.

Correct Answer:

C, D

Explanation

To control access based on user identity and time, a Security policy rule must leverage the User-ID and Schedule components. The User-ID feature allows the firewall to identify specific users or groups, such as "third-party contractors," by integrating with directory services. This addresses the "who" part of the requirement. The Schedule object allows the administrator to define specific time windows, such as "outside business hours," during which the policy rule will be active. This addresses the "when" part of the requirement. Combining these two components in a single rule enforces the specified access control.

Why Incorrect

A. App-ID: This component identifies the application (the "what") being accessed, not the user initiating the connection or the time of the connection.
B. Service: This component defines the transport protocol and port number (the "how") for the traffic, not the user or the time of access.

References

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Security Policy Rule Components": This section details the building blocks of a Security policy rule. It explicitly lists "Source User" and "Schedule" as distinct components for controlling access.

Source User: "The user or group that is the source of the traffic. The firewall must be configured to map IP addresses to usernames for this setting to be effective." This directly corresponds to using User-ID to identify the contractors.

Schedule: "The schedule that specifies the days and times the rule is enforced. Select a predefined schedule or select None (the default) to have the rule enforced at all times." This directly corresponds to the Schedule component for time-based control.

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Objects > Schedules": This section describes the creation and application of Schedule objects. It states

"You can apply schedules to security policy rules to control when the rules are active." This confirms the function of the Schedule component for time-based enforcement.

3. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"User-ID": The overview of the User-ID feature explains its purpose: "The User-ID feature of Palo Alto Networks firewalls allows you to configure and enforce firewall policies based on users and groups of users rather than on IP addresses." This confirms User-ID is the correct component for identifying the "third-party contractors" group.

Palo Alto Networks NetSec-Pro Real Exam Questions [October 2026 Update] Quiz

Which two components of a Security policy, when configured, allow third-party contractors access to internal applications outside business hours? (Choose two.)

Premium Access Includes