An administrator configured a Security policy rule where the matching condition includes a single application and the action is set to deny. What deny action will the firewall perform?

Question

Options

• ADiscard the session's packets and send a TCP reset packet to let the client know the session has
• BDrop the traffic silently
• CPerform the default deny action as defined in the App-ID database for the application
• DSend a TCP reset packet to the client- and server-side devices

• A
  15% (7)
• B
  6% (3)
• C
  77% (37)
• D
  2% (1)

Explanation

When a Security policy rule matches on a specific application and the action is "deny," Palo Alto Networks firewalls defer to the App-ID database, which defines the most appropriate denial mechanism for each application - this could be reset-client, reset-both, or drop, depending on what makes sense for that protocol. This is by design: App-ID already knows how applications behave, so it provides the optimal termination signal rather than applying a one-size-fits-all response.

Why the distractors are wrong:

• A (discard + TCP reset to client) describes the reset-client action specifically - one possible default, but not universally correct for all apps.
• B (silent drop) describes the drop action specifically - again, only the correct default for certain applications.
• D (TCP reset to both sides) describes the reset-both action - yet another specific action, not a universal truth.

All three distractors describe valid deny action types that exist in PAN-OS, but each assumes a fixed behavior. The correct answer acknowledges that the behavior is application-dependent.

Memory tip: Key phrase is "single application" in the matching condition. When App-ID identifies a specific app, trust App-ID to handle the denial - the database that knows the app best also defines how to kill it cleanly. "Specific app → App-ID decides."

No community discussion yet for this question.