Font size
WorksheetsLab Exercises Security Policy Rule
Total questions: 15
Worksheet time: 30mins
Refer to the image. A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
Untrust (any) to Untrust (10.1.1.100), web browsing – Allow
Untrust (any) to Untrust (1.1.1.100), web browsing – Allow
Untrust (any) to DMZ (1.1.1.100), web browsing – Allow
Untrust (any) to DMZ (10.1.1.100), web browsing – Allow
A web server is hosted in the DMZ and the server is configured to listen for incoming connections on TCP port 443. Security policies rules allowing access from the Trust zone to the DMZ zone needs to be configured to allow web-browsing access. The web server hosts its contents over HTTP(S). Traffic from Trust to DMZ is being decrypted with a Forward Proxy rule. Which combination of service and application, and order of Security policy rules, needs to be configured to allow cleartext web-browsing traffic to this server on tcp/443?
Rule #1: application: web-browsing; service: application-default; action: allow Rule #2: application: ssl; service: application-default; action: allow
Rule #1: application: web-browsing; service: service-http; action: allow Rule #2: application: ssl; service: application-default; action: allow
Rule # 1: application: ssl; service: application-default; action: allow Rule #2: application: web-browsing; service: application-default; action: allow
Rule #1: application: web-browsing; service: service-https; action: allow Rule #2: application: ssl; service: application-default; action: allow
Which Security policy rule will allow an admin to block facebook-chat but allow Facebook in general?
Deny application facebook-chat and facebook-mail before allowing application facebook-base
Deny application facebook-base on top
Allow application facebook-base on top
Allow application facebook-base before denying application facebook-chat and facebook-mail
Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?
global
intrazone
interzone
universal
Based on the security policy rules shown, ssh will be allowed on which port?
80
53
22
23
Which type of Security policy rule would match traffic flowing between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?
global
intrazone
interzone
universal
Which path in PAN-OS 9.0 displays the list of port-based security policy rules?
Policies> Security> Policy Optimizer> No App Specified
Policies> Security> Policy Optimizer> Port only specified
Policies> Security> Policy Optimizer> Port-based Rules
Policies> Security> Policy Optimizer> Unused Apps
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping. What is the quickest way to reset the hit counter to zero in all the security policy rules?
At the CLI enter the command reset rules and press Enter
Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule
Reboot the firewall
Use the Reset Rule Hit Counter > All Rules option
How do you reset the hit count on a Security policy rule?
Select a Security policy rule, and then select Hit Count > Reset.
Reboot the data-plane.
First disable and then re-enable the rule.
Type the CLI command reset hit count.
Which type of profile must be applied to the Security policy rule to protect against buffer overflows, illegal code execution, and other attempts to exploit system flaws?
URL filtering
vulnerability protection
file blocking
anti-spyware
Which three statements describe the operation of Security policy rules and Security Profiles? (Choose three.)
Security policy rules are attached to Security Profiles.
Security Profiles are attached to Security policy rules.
Security Profiles should be used only on allowed traffic.
Security policy rules inspect but do not block traffic.
Security policy rules can block or allow traffic.
When you have created a Security Policy Rule that allows Facebook, what must you do to block all other web browsing traffic?
Create an additional rule that blocks all other traffic.
When creating the policy, ensure that web-browsing is included in the same rule.
Ensure that the Service column is defined as "application-default" for this Security policy. Doing this will automatically include the implicit web-browsing application dependency.
Nothing. You can depend on PANOS to block the web-browsing traffic that is not needed for Facebook use.
A Security policy rule is configured with a Vulnerability Protection Profile and an action of "Deny". Which action will this cause configuration on the matched traffic?
The configuration is invalid. The Profile Settings section will be grayed out when the Action is set
to “Deny”.
The configuration will allow the matched session unless a vulnerability signature is detected. The “Deny” action will supersede the per-severity defined actions defined in the associated Vulnerability Protection Profile.
The configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will be displayed during a commit.
The configuration is valid. It will cause the firewall to deny the matched sessions. Any configured Security Profiles have no effect if the Security policy rule action is set to “Deny”.
A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone needs to be configured to enable web browsing access to the server.
Which application and service need to be configured to allow only cleartext web-browsing traffic to this server on TCP/8080?
application: web-browsing; service: application-default
application: ssl; service: any
application: web-browsing; service: service-https
application: web-browsing; service: (custom with destination TCP port 8080)
What are the differences between using a service versus using an application for Security Policy match?
Use of a “service” enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an “application” allows the firewall to take immediate action if the port being used is a member of the application standard port list.
There are no differences between “service” or “application”. Use of an “application” simplifies configuration by allowing use of a friendly application name instead of port numbers.
Use of a “service” enables the firewall to take immediate action with the first observed packet based on port numbers. Use of an “application” allows the firewall to take action after enough packets allow for App-ID identification regardless of the ports being used.
Use of a “service” enables the firewall to take action after enough packets allow for App-ID identification.
