A Security policy rule is configured with a Vulnerability Protection Profile and an action of `Deny". Which action will this cause configuration on the matched traffic?

Question

Options

• AThe configuration is invalid. The Profile Settings section will be grayed out when the Action is set
• BThe configuration will allow the matched session unless a vulnerability is detected. The "Deny"
• CThe configuration is invalid. It will cause the firewall to skip this Security policy rule. A warning will
• DThe configuration is valid. It will cause the firewall to deny the matched sessions. Any configured

• A
  3% (1)
• B
  3% (1)
• C
  6% (2)
• D
  88% (30)

Explanation

The configuration is valid - PAN-OS does not prevent you from attaching a Security Profile to a Deny rule. However, when the Security policy action is set to Deny, the firewall drops the matched traffic immediately without performing content inspection. As a result, the attached Vulnerability Protection Profile is never evaluated or applied. The sessions are simply denied. This is a common exam topic: Security Profiles (Antivirus, Vulnerability Protection, etc.) only take effect on sessions that are allowed by the Security policy action.

No community discussion yet for this question.