Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.
A Security policy rule is configured with a Vulnerability Protection Profile and an action of `Deny`. Which action will this cause configuration on the matched traffic?
A.
The configuration is invalid. The Profile Settings section will be grayed out when the Action is set to ג€Denyג€.
B.
The configuration will allow the matched session unless a vulnerability signature is detected. The ג€Denyג€ action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
C.
The configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.
D.
The configuration is valid. It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to ג€Denyג€.
D is correct
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/security-profiles.html
First note in above link states:
"Security profiles are not used in the match criteria of a traffic flow. The security profile is applied to scan traffic after the application or category is allowed by the security policy."
The first thing the firewall checks per it's flow is the security policy match and action. The Security Profile never gets checked if a match happens on a policy set to deny that match.
it is kind of burdening the firewall resource by allowing the traffic payload to be scanned once the traffic is denied to get a network service so the answer should be A or the question it self is doubting is weather the action "Deny" is it for the security rule or is it for the security profile ? if it is for the security profile it should be "Drop"
If a traffic flow matches a security policy whose action is set to Deny, it doesn't matter what security profiles are configured within the policy, cause the traffic will be dropped regardless.
D is correct.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/security-policy/components-of-a-security-policy-rule
Provide additional protection from threats, vulnerabilities, and data leaks. Security profiles are evaluated only for rules that have an allow action.
D is correct : "Blocks traffic and enforces the default Deny Action defined for the application that is being denied.."
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/security-policy/security-policy-actions
Agreed. Failed Exam today. Only had about 8 questions from this dump. They are shifting to focus to Panaorama Deployment, Device Groups and Template stacks, UserID and mapping, Certificate questions and SSL decryption and SD-WAN. There is some Prisma on there, as well. You may not pass if you rely on this.
A is the right answer, Vulnerability profile can only be checked if the traffic is allowed. there is no reason for a firewall to check traffic for vulnerability when it has been denied and will be dropped.
this traffic will not make it through the slow path of traffic flow in palo alto and so no session will be created because the traffic is DENIED!!!
D, the security policy is set to deny, this is enough not to allow the oacket, considering the polcy evaluation order, where security profiles get evalauted last, really the sec profile is not relevant as the packet is already denied
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
bbud55
Highly Voted 3 years, 1 month agoMarshpillowz
Most Recent 3 months agoavator
4 months, 1 week agoChris71Mach1
1 year, 3 months agoKuronekosama
1 year, 7 months agoPakawat
1 year, 9 months agoMeko
1 year, 10 months agodatz
1 year, 11 months agotururu1496
2 years, 1 month agobigdaddy_69
2 years, 3 months agoBighize
2 years, 5 months agoKane002
2 years, 5 months agoNNgiggs
2 years, 6 months agor0ze
2 years, 6 months agoCeejer
2 years, 7 months agoSMahaldar
2 years, 9 months agoPrutser2
2 years, 10 months ago