Lab Exercises Security Policy Rule

Refer to the image. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?

• Untrust (any) to Untrust (10.1.1.100), web browsing – Allow

• Untrust (any) to Untrust (1.1.1.100), web browsing – Allow

• Untrust (any) to DMZ (1.1.1.100), web browsing – Allow

• Untrust (any) to DMZ (10.1.1.100), web browsing – Allow

A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule. Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to this server on tcp/443?

• Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow

• Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow

• Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow

• Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow

Which Security policy rule will allow an admin to block facebook-chat but allow Facebook in general?

• Deny application facebook-chat and facebook-mail before allowing application facebook-base

• Deny application facebook-base on top

• Allow application facebook-base on top

• Allow application facebook-base before denying application facebook-chat and facebook-mail

Answer explanation

Failed to Block Facebook Chat Consistently - Knowledge Base - Palo Alto Networks

Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?

• global

• intrazone

• interzone

• universal

Answer explanation

What are Universal, Intrazone and Interzone Rules? - Knowledge Base - Palo Alto Networks

Based on the security policy rules shown, ssh will be allowed on which port?

• 80

• 53

• 22

• 23

Which type of Security policy rule would match traffic flowing between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

• global

• intrazone

• interzone

• universal

Answer explanation

What are Universal, Intrazone and Interzone Rules? - Knowledge Base - Palo Alto Networks

Which path in PAN-OS 9.0 displays the list of port-based security policy rules?

• Policies> Security> Policy Optimizer> No App Specified

• Policies> Security> Policy Optimizer> Port only specified

• Policies> Security> Policy Optimizer> Port-based Rules

• Policies> Security> Policy Optimizer> Unused Apps

Answer explanation

Migrate Port-Based to App-ID Based Security Policy Rules (paloaltonetworks.com)

Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping. What is the quickest way to reset the hit counter to zero in all the security policy rules?

• At the CLI enter the command reset rules and press Enter

• Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule

• Reboot the firewall

• Use the Reset Rule Hit Counter > All Rules option

Answer explanation

Creating and Managing Policies (paloaltonetworks.com)

How do you reset the hit count on a Security policy rule?

• Select a Security policy rule, and then select Hit Count > Reset.

• Reboot the data-plane.

• First disable and then re-enable the rule.

• Type the CLI command reset hit count.

Answer explanation

Creating and Managing Policies (paloaltonetworks.com)

Which type of profile must be applied to the Security policy rule to protect against buffer overflows, illegal code execution, and other attempts to exploit system flaws?

• URL filtering

• vulnerability protection

• file blocking

• anti-spyware

Answer explanation

Objects > Security Profiles > Vulnerability Protection (paloaltonetworks.com)