ExamGecko
Question list
Search
Search

Related questions











Question 372 - PCNSE discussion

Report
Export

What happens when the log forwarding built-in action with tagging is used?

A.
Destination IP addresses of selected unwanted traffic are blocked. *
Answers
A.
Destination IP addresses of selected unwanted traffic are blocked. *
B.
Selected logs are forwarded to the Azure Security Center.
Answers
B.
Selected logs are forwarded to the Azure Security Center.
C.
Destination zones of selected unwanted traffic are blocked.
Answers
C.
Destination zones of selected unwanted traffic are blocked.
D.
Selected unwanted traffic source zones are blocked.
Answers
D.
Selected unwanted traffic source zones are blocked.
Suggested answer: A

Explanation:

When using the log forwarding built-in action with tagging in Palo Alto Networks firewalls, the primary purpose is to dynamically respond to threats or unwanted traffic identified by the firewall's threat detection mechanisms. The action involves tagging the IP address associated with the unwanted traffic and then using that tag in dynamic security policies to block or manage the traffic.

A) Destination IP addresses of selected unwanted traffic are blocked:

When the tagging action is used, the firewall tags the IP addresses involved in the unwanted traffic (which could be the source or destination IP addresses, but in many configurations, the focus is on the source of the attack). These tags can then be referenced in Dynamic Address Groups (DAGs) within security policies. Consequently, any traffic coming from or going to these tagged IP addresses can be blocked or subjected to specific security rules, effectively mitigating the threat or unwanted behavior.

This approach allows for automated, real-time responses to identified threats, enhancing the security posture by quickly adapting to emerging threats without manual intervention.

asked 23/09/2024
PANAGIOTIS SYKAS
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first