nerdexam
Palo_Alto_Networks

PCNSA · Question #19

Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone. Complete the security policy to ensure only Telnet is allowed. Security Policy: Source Zone: Internal to DMZ…

The correct answer is B. Application = `Telnet'. To allow only Telnet, the security policy must explicitly set the Application field to Telnet, leveraging Palo Alto Networks' Application-ID technology.

Submitted by zhang_li· Apr 18, 2026Securing Traffic

Question

Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone. Complete the security policy to ensure only Telnet is allowed. Security Policy: Source Zone:

Internal to DMZ Zone __________services "Application defaults", and action = Allow

Options

  • ADestination IP: 192.168.1.123/24
  • BApplication = `Telnet'
  • CLog Forwarding
  • DUSER-ID = `Allow users in Trusted'

How the community answered

(29 responses)
  • A
    7% (2)
  • B
    86% (25)
  • C
    3% (1)
  • D
    3% (1)

Why each option

To allow only Telnet, the security policy must explicitly set the Application field to `Telnet`, leveraging Palo Alto Networks' Application-ID technology.

ADestination IP: 192.168.1.123/24

Destination IP address defines the target server, but it does not specify or restrict the type of application allowed to communicate with that server.

BApplication = `Telnet'Correct

Palo Alto Networks firewalls use Application-ID to identify applications regardless of port or protocol, so setting `Application = Telnet` ensures that only Telnet traffic is permitted on its default port or any other port it might try to use, making the policy specific and secure.

CLog Forwarding

Log Forwarding is a policy setting for sending logs to an external server, not for defining what traffic is allowed by the policy.

DUSER-ID = `Allow users in Trusted'

USER-ID = `Allow users in Trusted` would specify which users are allowed, but it does not define the application itself or restrict it to Telnet only.

Concept tested: Security policy application identification (App-ID)

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/security-policy/security-policy-rules/security-policy-rule-components

Topics

#Security Policy#Application-ID#Traffic Filtering#Policy Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSA Practice