Exam PCNSA topic 1 question 55 discussion

Actual exam question from Palo Alto Networks's PCNSA

Question #: 55
Topic #: 1

A server-admin in the USERS-zone requires SSH-access to all possible servers in all current and future Public Cloud environments. All other required connections have already been enabled between the USERS- and the OUTSIDE-zone. What configuration-changes should the Firewall-admin make?

A. Create a custom-service-object called SERVICE-SSH for destination-port-TCP-22. Create a security-rule between zone USERS and OUTSIDE to allow traffic from any source IP-address to any destination IP-address for SERVICE-SSH
B. Create a security-rule that allows traffic from zone USERS to OUTSIDE to allow traffic from any source IP-address to any destination IP-address for application SSH
C. In addition to option a, a custom-service-object called SERVICE-SSH-RETURN that contains source-port-TCP-22 should be created. A second security-rule is required that allows traffic from zone OUTSIDE to USERS for SERVICE-SSH-RETURN for any source-IP-address to any destination-Ip-address
D. In addition to option c, an additional rule from zone OUTSIDE to USERS for application SSH from any source-IP-address to any destination-IP-address is required to allow the return-traffic from the SSH-servers to reach the server-admin

Show Suggested Answer

Suggested Answer: B 🗳️

by LordScorpius at March 22, 2022, 8:40 p.m.

Comments

Submit Cancel

Alessandro1986

10 months, 3 weeks ago

I Understand that PA NGFW only manage statefull and due it is not necessary create return rules, then a couple of options are my discards and answer chosed is B option.

upvoted 2 times

...

rt_85

1 year, 9 months ago

None of these are good options, guess I'll go with the group. Why would I allow any-any for ssh instead of something more specific with App-ID for the singular user that needs access.

upvoted 4 times

...