Network Segmentation and Zone Security Flashcards

What is the primary purpose of security zones in Palo Alto Networks firewalls?

Answer: To logically group interfaces and enforce policy between groups

Security zones logically group network interfaces, and all traffic between zones is subject to security policy inspection and enforcement.

In Palo Alto Networks, what type of zone is used for traffic originating from or destined to the firewall itself?

Answer: Functional Zone (MGT)

The functional zone (management zone) covers traffic to and from the firewall's own services; intrazone traffic to the firewall's management plane is handled separately from regular data plane zones.

Which zone type allows a Palo Alto firewall to monitor traffic passively without being in the traffic path?

Answer: Tap

A Tap zone connects to a SPAN or mirror port, allowing the firewall to inspect a copy of traffic without being inline, enabling visibility without policy enforcement.

What is the default action for traffic between two different security zones if no matching security policy rule exists?

Answer: Deny all traffic (implicit deny)

Palo Alto firewalls apply an implicit deny-all rule at the bottom of the security policy, blocking all inter-zone traffic that does not match an explicit allow rule.

What is the default behavior for intra-zone traffic (traffic within the same zone) on a Palo Alto firewall?

Answer: Allowed by default

By default, intra-zone traffic is allowed without inspection; administrators must create explicit deny rules or enable intra-zone security profiles to inspect same-zone traffic.

Which zone protection profile feature helps prevent resource exhaustion from SYN flood attacks?

Answer: SYN Cookies

SYN Cookies in Zone Protection Profiles defend against SYN flood attacks by generating stateless SYN-ACK responses to validate TCP handshakes before allocating state table entries.