PCNSA · Question #196
An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration. What should the administrator do?
The correct answer is A. change the logging action on the rule. The administrator should change the logging action on the intrazone-default rule to enable visibility for troubleshooting, as by default this rule permits traffic without logging it.
Question
An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration. What should the administrator do?
Options
- Achange the logging action on the rule
- Breview the System Log
- Crefresh the Traffic Log
- Dtune your Traffic Log filter to include the dates
How the community answered
(16 responses)- A81% (13)
- B6% (1)
- C13% (2)
Why each option
The administrator should change the logging action on the intrazone-default rule to enable visibility for troubleshooting, as by default this rule permits traffic without logging it.
The intrazone-default rule, in its default configuration, allows traffic without logging it; therefore, to troubleshoot traffic matching this rule, the administrator must modify the rule's logging action to enable logging. This will then allow the traffic to appear in the traffic logs for review.
Reviewing the System Log is incorrect because system logs record device-specific events, not traffic flow matching security policy rules.
Refreshing the Traffic Log will only update the display of already logged traffic and will not cause traffic that was never logged to appear.
Tuning a Traffic Log filter only refines the view of existing logs and cannot enable logging for traffic that was not configured to be logged.
Concept tested: Intrazone-default rule logging
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/security-policy/security-policy-rules/intra-zone-default-rule
Topics
Community Discussion
No community discussion yet for this question.