An administrator has configured a Security policy where the matching condition includes a single application, and the action is deny. If the application's default deny action is reset-both, what…

The correct answer is D. It sends a TCP reset to the client-side and server-side devices. When the Security policy action is set to 'Deny' (as opposed to Drop, Reset Client, or Reset Server), the firewall uses the application's default deny action from the App-ID content database. Since this application's default deny action is 'reset-both,' the firewall sends a TCP…

Submitted by tom_us· Apr 18, 2026Securing Traffic

Question

An administrator has configured a Security policy where the matching condition includes a single application, and the action is deny. If the application's default deny action is reset-both, what action does the firewall take?

Options

AIt silently drops the traffic.
BIt silently drops the traffic and sends an ICMP unreachable code.
CIt sends a TCP reset to the server-side device.
DIt sends a TCP reset to the client-side and server-side devices.

How the community answered

(28 responses)

A
4% (1)
B
4% (1)
D
93% (26)

Explanation

When the Security policy action is set to 'Deny' (as opposed to Drop, Reset Client, or Reset Server), the firewall uses the application's default deny action from the App-ID content database. Since this application's default deny action is 'reset-both,' the firewall sends a TCP RST packet to both the client and the server. This is different from 'Drop,' which silently discards the packet; 'Reset Client,' which sends a TCP RST only to the client; and 'Reset Server,' which sends a TCP RST only to the server. The 'Deny' action is essentially a pointer to the application-defined behavior.

Topics

#Security Policy#Application Deny Action#TCP Reset#Traffic Enforcement

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice