nerdexam
Palo_Alto_Networks

PCNSE · Question #136

On March 10, 2016, between 11:00 am and 11:30 am, users reported that web-browsing traffic to the IP address 1.1.1.1 failed. Which filter can be applied to the traffic logs to show how many users…

The correct answer is B. ( time_generated geq `2016/03/10 11:00:00') and ( time_generated leq `2016/03/10 11:30:00'). To filter traffic logs for a specific time range, you need to use geq (greater than or equal to) for the start time and leq (less than or equal to) for the end time.

Submitted by yuki_2020· Apr 18, 2026Operate

Question

On March 10, 2016, between 11:00 am and 11:30 am, users reported that web-browsing traffic to the IP address 1.1.1.1 failed. Which filter can be applied to the traffic logs to show how many users were affected during this time frame?

Options

  • A( time_generated leq `2016/03/10 11:30:00') and ( app is web-browsing )
  • B( time_generated geq 2016/03/10 11:00:00') and ( time_generated leq 2016/03/10 11:30:00')
  • C( time_generated leq 2016/03/10 11:00:00') and ( time_generated geq 2016/03/10 11:30:00')
  • D( time_generated geq 2016/03/10 11:00:00') and ( time_generated leq 2016/03/10 11:30:00')

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    87% (40)
  • C
    4% (2)
  • D
    7% (3)

Why each option

To filter traffic logs for a specific time range, you need to use `geq` (greater than or equal to) for the start time and `leq` (less than or equal to) for the end time.

A( time_generated leq `2016/03/10 11:30:00') and ( app is web-browsing )

This filter only specifies an end time and an application, omitting the crucial start time component necessary to define the required time frame for the issue.

B( time_generated geq `2016/03/10 11:00:00') and ( time_generated leq `2016/03/10 11:30:00')Correct

This filter correctly specifies the time range by ensuring `time_generated` is greater than or equal to the start time (11:00:00) AND less than or equal to the end time (11:30:00), effectively capturing all logs within the reported half-hour window.

C( time_generated leq `2016/03/10 11:00:00') and ( time_generated geq `2016/03/10 11:30:00')

This filter incorrectly reverses the logical order, requiring `time_generated` to be less than or equal to the start time AND greater than or equal to the end time, which would result in no matching logs.

D( time_generated geq `2016/03/10 11:00:00') and ( time_generated leq `2016/03/10 11:30:00')

This option is a duplicate of the correct answer B, providing the same valid filter expression for the specified time range.

Concept tested: Traffic log filtering by time

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitor/use-filters-for-logs.html

Topics

#Log Filtering#Traffic Log Analysis#Time-based Queries

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice