PCNSE · Question #218
VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be…
The correct answer is D. Replay. The attack described is a replay attack - a threat actor captures legitimate encrypted VPN packets and retransmits them later to impersonate an authorized user or disrupt the session. IPSec (used in Palo Alto VPN tunnels) includes a built-in Replay Protection mechanism that…
Question
VPN traffic intended for an administrator's Palo Alto Networks NGFW is being maliciously intercepted and retransmitted by the interceptor. When creating a VPN tunnel, which protection profile can be enabled to prevent this malicious behavior?
Options
- AZone Protection
- BDoS Protection
- CWeb Application
- DReplay
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- D89% (24)
Explanation
The attack described is a replay attack - a threat actor captures legitimate encrypted VPN packets and retransmits them later to impersonate an authorized user or disrupt the session. IPSec (used in Palo Alto VPN tunnels) includes a built-in Replay Protection mechanism that assigns a sequence number to each packet and maintains an anti-replay window. When this profile is enabled on the IKE gateway or IPSec tunnel, the NGFW rejects any packet whose sequence number has already been processed, rendering captured-and-retransmitted packets harmless. Zone Protection guards against flood/reconnaissance attacks; DoS Protection limits session rates; Web Application profiles are WAF-related and irrelevant to VPN.
Topics
Community Discussion
No community discussion yet for this question.