Network Segmentation and Zone Security Flashcards

What is the purpose of a Virtual Wire (vwire) deployment mode in Palo Alto Networks?

Answer: To insert the firewall transparently into an existing network segment without IP addressing changes

Virtual Wire mode inserts the firewall transparently between two network points without requiring IP address changes, making it easy to deploy inline without network redesign.

Which Palo Alto Networks feature uses tags to dynamically update security policy membership based on VM or workload attributes?

Answer: Dynamic Address Groups (DAG)

Dynamic Address Groups automatically update their membership based on tags registered by VM monitoring or the XML API, enabling policy that follows workloads in dynamic cloud environments.

In a multi-vsys Palo Alto firewall, what is the function of a Virtual System (vsys)?

Answer: To create separate, isolated firewall instances on a single physical device

Virtual Systems allow a single Palo Alto firewall to operate as multiple independent logical firewalls, each with its own zones, policies, and administrators.

What is the primary security benefit of micro-segmentation in a data center environment?

Answer: It limits lateral movement by isolating workloads and applying policy between them

Micro-segmentation prevents attackers from moving laterally between workloads by enforcing security policies on east-west traffic between individual servers or VMs.

Which Palo Alto Networks feature provides packet buffer protection against single-session flood attacks that bypass rate limiting?

Answer: Zone Protection Profile - Packet Buffer Protection

Packet Buffer Protection in Zone Protection Profiles detects and mitigates attacks that consume firewall packet buffer resources, even from a single session, protecting against buffer exhaustion.

In a Palo Alto firewall, which object type allows you to reference multiple IP addresses or address ranges with a single name for use in security policy?

Answer: Address Object

Address Objects are named references to IP addresses, subnets, or ranges that can be reused across multiple security policy rules, simplifying management.