PCNSA Question #259: Real Exam Question with Answer & Explanation

Question

What are two valid selections within a Vulnerability Protection profile? (Choose two.)

Options

• Adeny
• Bdrop
• Cdefault
• Dsinkhole

Explanation

Within a Vulnerability Protection profile, two valid actions that can be configured for vulnerability signatures are 'drop' and 'default'. 'Drop' explicitly discards malicious packets, while 'default' uses the pre-defined Palo Alto Networks action for that specific vulnerability signature.

Common mistakes.

• A. "deny" is a common action in security policies (e.g., Security Rules), but it is not a direct action option within a Vulnerability Protection profile for individual signatures; "drop" or "reset" are more common for threat prevention.
• D. "sinkhole" is an action typically found in DNS Security profiles or Anti-Spyware profiles to redirect malicious DNS requests to a blackhole IP, not a direct action for vulnerability protection signatures.

Concept tested. Vulnerability Protection profile actions

Reference. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/configure-vulnerability-protection/vulnerability-protection-profile-actions

No community discussion yet for this question.