nerdexam
Palo_Alto_Networks

PCNSA · Question #215

The compliance officer requests that all evasive applications need to be blocked on all perimeter firewalls out to the internet. The firewall is configured with two zones: 1. trust for internal…

The correct answer is C. Create a deny rule at the top of the policy from trust to untrust over any service and add an D. Create a deny rule at the top of the policy from trust to untrust with service application-default and. To block evasive applications from the internal trust zone to the untrust zone, a deny rule should be created at the top of the security policy, targeting those applications with either 'any' service or 'application-default' service.

Submitted by chen.hong· Apr 18, 2026Securing Traffic

Question

The compliance officer requests that all evasive applications need to be blocked on all perimeter firewalls out to the internet. The firewall is configured with two zones: 1. trust for internal networks 2. untrust to the internet Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two )

Options

  • ACreate a deny rule at the top of the policy from trust to untrust over any service and select
  • BCreate a deny rule at the top of the policy from trust to untrust with service application-default and
  • CCreate a deny rule at the top of the policy from trust to untrust over any service and add an
  • DCreate a deny rule at the top of the policy from trust to untrust with service application-default and

How the community answered

(40 responses)
  • A
    8% (3)
  • B
    18% (7)
  • C
    75% (30)

Why each option

To block evasive applications from the internal trust zone to the untrust zone, a deny rule should be created at the top of the security policy, targeting those applications with either 'any' service or 'application-default' service.

ACreate a deny rule at the top of the policy from trust to untrust over any service and select

A generic deny rule without specifying evasive applications or categories using App-ID would either block too much traffic or fail to specifically target evasive applications.

BCreate a deny rule at the top of the policy from trust to untrust with service application-default and

Similar to A, a deny rule with 'application-default' service but without identifying the specific evasive applications would not meet the compliance request.

CCreate a deny rule at the top of the policy from trust to untrust over any service and add anCorrect

Creating a deny rule with 'any' service allows App-ID to identify and block evasive applications regardless of the port they attempt to use, ensuring comprehensive protection. The rule must explicitly select the evasive applications.

DCreate a deny rule at the top of the policy from trust to untrust with service application-default andCorrect

Configuring a deny rule with 'application-default' service ensures that App-ID identifies and blocks evasive applications on their known standard ports, also requiring explicit selection of these applications in the rule.

Concept tested: App-ID based policy for evasive applications

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/security-policy

Topics

#Security Policy#App-ID#Application Filtering#Evasive Applications

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSA Practice