PCNSE · Question #228
Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)
The correct answer is B. The traffic is offloaded. C. The traffic does not match the packet capture filter. Two conditions that block packet capture from recording traffic: (1) Traffic offloading - when sessions are offloaded to hardware (e.g., NPU/FPGA fast-path processing), the packets bypass the software data-plane CPU where the capture engine runs, making them invisible to…
Question
Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)
Options
- AThe firewall is in multi-vsys mode.
- BThe traffic is offloaded.
- CThe traffic does not match the packet capture filter.
- DThe firewall's DP CPU is higher than 50%.
How the community answered
(43 responses)- A5% (2)
- B86% (37)
- D9% (4)
Explanation
Two conditions that block packet capture from recording traffic: (1) Traffic offloading - when sessions are offloaded to hardware (e.g., NPU/FPGA fast-path processing), the packets bypass the software data-plane CPU where the capture engine runs, making them invisible to tcpdump-style captures; (2) Packet capture filters - if the administrator has configured capture filters (by source IP, destination IP, port, etc.), only traffic matching those filters is captured; non-matching traffic passes through without being recorded. Multi-vsys mode does not inherently prevent capture (you just need to specify the vsys context). A DP CPU above 50% does not disable packet capture - there is no such threshold in PAN-OS.
Topics
Community Discussion
No community discussion yet for this question.