Network Segmentation and Zone Security Flashcards

What is the purpose of a Vulnerability Protection profile in a Palo Alto security policy?

Answer: To detect and block exploitation attempts targeting network hosts and servers

Vulnerability Protection profiles inspect traffic for exploit signatures and block attempts to exploit known vulnerabilities in servers, applications, and clients.

Which Palo Alto Networks zone type is typically used to connect to an untrusted network such as the internet?

Answer: Untrust Zone

The Untrust zone is the conventional designation for the internet-facing interface, representing untrusted external networks where the strictest policies apply.

What does a DMZ (Demilitarized Zone) in a firewall context represent?

Answer: A network segment that hosts public-facing services, isolated from both the internet and internal network

A DMZ is a network segment between the internet (untrust) and internal (trust) zones that hosts servers needing limited external access, such as web and email servers.

Which Palo Alto Networks feature enables policy enforcement based on the type of application being used, regardless of port?

Answer: App-ID Technology

App-ID classifies traffic by application identity using behavioral analysis, protocol decoding, and signatures, enabling policy enforcement by application regardless of port number.

In Palo Alto Networks, what is the purpose of a Security Policy 'Service' field set to 'application-default'?

Answer: It restricts the allowed ports to those normally used by the identified application

Setting Service to 'application-default' allows the application only on its standard, expected ports, preventing evasion by running applications on non-standard ports.

Which traffic flow direction would require a 'Trust to Untrust' security policy rule on a Palo Alto firewall?

Answer: An internal user browsing the internet

When an internal user in the Trust zone accesses the internet (Untrust zone), the security policy must have a rule permitting Trust-to-Untrust traffic for the desired application.