PCNSE Firewall Technology and Architecture Flashcards

Which Palo Alto Networks firewall component is responsible for identifying applications regardless of port or protocol?

Answer: App-ID

App-ID uses multiple classification mechanisms including application signatures, protocol decoding, and behavioral analysis to identify applications independent of port or protocol.

In a Palo Alto Networks firewall, what is the purpose of the Security Policy Optimizer?

Answer: To migrate legacy rules to App-ID based rules

Security Policy Optimizer identifies port-based rules and helps migrate them to application-based rules to improve security posture.

What happens to traffic matching a Security policy rule with action 'drop' versus 'deny' on a Palo Alto Networks firewall?

Answer: Drop silently discards without TCP RST; deny sends a TCP RST to the client

The 'drop' action silently discards packets while 'deny' sends a TCP RST or ICMP unreachable to notify the sender.

Which zone type on a Palo Alto Networks firewall is used to inspect traffic that originates and terminates on the firewall itself?

Answer: Loopback zone

The loopback zone handles traffic that originates or terminates on the firewall itself, such as management services hosted on the device.

What is the function of the Palo Alto Networks 'Commit' operation in relation to the candidate configuration?

Answer: It validates and activates the candidate configuration replacing the running configuration

A commit validates the candidate configuration for errors and then activates it, making it the new running configuration.

In Palo Alto Networks firewall architecture, which plane handles the actual packet forwarding and security policy enforcement?

Answer: Data plane

The data plane (also called the forwarding plane) performs packet processing, App-ID, Content-ID, and policy enforcement at line rate.

Which feature in Palo Alto Networks firewalls allows you to define which applications are permitted within a parent application tunnel like SSL?

Answer: SSL Decryption with App-ID

SSL Decryption combined with App-ID allows the firewall to decrypt SSL traffic and then apply App-ID to identify and control applications running inside the SSL tunnel.

What is the maximum number of virtual systems (vsys) supported on the Palo Alto Networks PA-7080 platform?

Answer: 125

The PA-7080 supports up to 125 virtual systems, making it suitable for large multi-tenant deployments.

In Palo Alto Networks NGFW, what does 'positive enforcement model' mean?

Answer: Only explicitly allowed traffic is permitted; all else is denied

The positive enforcement model means the firewall denies all traffic by default and only permits traffic that matches an explicit allow rule.

Which Palo Alto Networks feature provides Layer 2 segmentation by forwarding traffic based on MAC addresses without routing?

Answer: Layer 2 deployment mode

Layer 2 deployment mode enables the firewall to act as a transparent bridge, forwarding traffic based on MAC addresses within the same broadcast domain.

When configuring High Availability (HA) on Palo Alto Networks firewalls, what is the purpose of the HA2 link?

Answer: Session state and table synchronization

The HA2 link synchronizes session tables, forwarding tables, and IPsec SA information between active and passive peers to enable seamless failover.

Which Palo Alto Networks NGFW feature uses machine learning to create behavioral models for detecting unknown malware?

Answer: WildFire

WildFire uses machine learning and dynamic analysis in a cloud-based sandbox to detect and generate protections for previously unknown malware.

In a Palo Alto Networks Active/Passive HA pair, which peer processes and forwards traffic during normal operation?

Answer: Only the active peer

In Active/Passive HA, only the active peer processes and forwards traffic; the passive peer stays synchronized and ready to take over if the active peer fails.

What is the role of the Network Processing Card (NPC) in Palo Alto Networks chassis-based firewalls like the PA-7000 series?

Answer: It performs network I/O and initial packet processing

NPCs in chassis-based firewalls handle network I/O, perform initial packet classification, and distribute traffic to Security Processing Cards (SPCs).

Which Palo Alto Networks feature enables the firewall to identify users even when they authenticate through a proxy or Citrix environment?

Answer: Terminal Services Agent (TSA)

The Terminal Services Agent maps individual user traffic on shared-IP environments like Citrix or RDS by tracking port ranges assigned to each user.

In Palo Alto Networks firewall, what is 'single-pass parallel processing' (SP3)?

Answer: Analyzing the packet once while simultaneously performing all security functions

SP3 architecture analyzes network traffic in a single pass, simultaneously applying App-ID, User-ID, Content-ID, and policy enforcement without multiple scanning passes.

When using Palo Alto Networks URL Filtering with the 'continue' action for a URL category, what happens?

Answer: The user sees a page asking them to confirm they want to proceed

The 'continue' action presents the user with a response page requiring them to click through to acknowledge the policy before accessing the site.

What is the purpose of Palo Alto Networks 'Application Override' policy?

Answer: To override App-ID and classify traffic as a custom application

Application Override policies force the firewall to classify traffic as a specified custom application, bypassing App-ID's standard identification mechanism.

In Palo Alto Networks firewalls, what is the difference between an 'address object' and an 'address group'?

Answer: Address objects define individual IPs/ranges/FQDNs; address groups combine multiple address objects

Address objects define a single IP, range, subnet, or FQDN, while address groups aggregate multiple address objects for simplified policy management.

Which Palo Alto Networks security profile type inspects traffic for known exploit attempts and vulnerability attacks?

Answer: Vulnerability Protection profile

Vulnerability Protection profiles detect and block exploit attempts targeting known software vulnerabilities using IPS signatures.