PCNSE PCNSE Firewall Technology and Architecture 5

Question 1

Which Palo Alto Networks firewall feature prevents SYN flood attacks by using SYN cookies?

Accepted Answer

Zone Protection profile

Answer

Zone Protection profiles include flood protection settings including SYN cookies that defend against SYN flood attacks at the zone level.

Question 2

In Palo Alto Networks Panorama, what is a 'Device Group' used for?

Accepted Answer

Grouping firewalls for shared policy and object management

Answer

Device Groups in Panorama allow administrators to push shared security policies and objects to groups of managed firewalls.

Question 3

What occurs when a Palo Alto Networks firewall encounters an application that is identified mid-session after initial traffic is classified as 'unknown'?

Accepted Answer

The firewall re-evaluates the session against security policy with the updated App-ID

Answer

When App-ID identifies an application mid-session, the firewall re-evaluates the session against security policies to enforce the correct application-based rule.

Question 4

Which type of NAT on Palo Alto Networks firewalls allows multiple internal hosts to share a single public IP address using port translation?

Accepted Answer

Dynamic IP and Port (DIPP) NAT

Answer

Dynamic IP and Port (DIPP) NAT, also called PAT or overload NAT, translates many-to-one by using unique port numbers to track each internal session.

Question 5

In Palo Alto Networks firewalls, what is the purpose of configuring a 'Null' route or 'discard' interface?

Accepted Answer

To drop traffic matching specific routes without generating ICMP unreachable messages

Answer

A discard (null) route is used to drop traffic destined for specific prefixes silently, commonly used to prevent routing loops or block RFC1918 space from being forwarded to the internet.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE PCNSE Firewall Technology and Architecture 5