ExamGecko
Question list
Search
Search

Related questions











Question 204 - PCNSE discussion

Report
Export

Given the screenshot, how did the firewall handle the traffic?

A.
Traffic was allowed by policy but denied by profile as encrypted.
Answers
A.
Traffic was allowed by policy but denied by profile as encrypted.
B.
Traffic was allowed by policy but denied by profile as a threat
Answers
B.
Traffic was allowed by policy but denied by profile as a threat
C.
Traffic was allowed by profile but denied by policy as a threat.
Answers
C.
Traffic was allowed by profile but denied by policy as a threat.
D.
Traffic was allowed by policy but denied by profile as a nonstandard port.
Answers
D.
Traffic was allowed by policy but denied by profile as a nonstandard port.
Suggested answer: B

Explanation:

The screenshot shows the threat log which records the traffic that matches a threat signature or is blocked by a security profile. The log entry indicates that the traffic was allowed by the security policy rule "Allow-All" but was denied by the vulnerability protection profile "strict" as a threat. The threat name is "Microsoft Windows SMBv1 Multiple Vulnerabilities (MS17-010: EternalBlue)" and the action is "reset-both" which means that the firewall reset both the client and server connections.Reference: : https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog- for-monitoring/syslog-field-descriptions/threat-log-fields

asked 23/09/2024
gareth warner
21 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first