PCNSE · Question #42
A firewall administrator has completed most of the steps required to provision a standalone Palo Alto Networks Next-Generation Firewall. As a final step, the administrator wants to test one of the…
The correct answer is A. test security -policy- match source <ip_address> destination <IP_address> destination port <port. If you know the source or destination IP address, the test command from the CLI will search the security policies and display the best match: > test security-policy-match source <source IP> destination <destination IP> protocol <protocol The output will show which policy rule…
Question
A firewall administrator has completed most of the steps required to provision a standalone Palo Alto Networks Next-Generation Firewall. As a final step, the administrator wants to test one of the security policies. Which CLI command syntax will display the rule that matches the test?
Options
- Atest security -policy- match source <ip_address> destination <IP_address> destination port <port
- Bshow security rule source <ip_address> destination <IP_address> destination port <port number>
- Ctest security rule source <ip_address> destination <IP_address> destination port <port number>
- Dshow security-policy-match source <ip_address> destination <IP_address> destination port <port
How the community answered
(22 responses)- A91% (20)
- B5% (1)
- C5% (1)
Explanation
If you know the source or destination IP address, the test command from the CLI will search the security policies and display the best match: > test security-policy-match source <source IP> destination <destination IP> protocol <protocol The output will show which policy rule will be applied to this traffic match based on the source and destination IP addresses. https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-Which-Security-Policy- Applies-to-a-Traffic-Flow/ta-p/53693
Topics
Community Discussion
No community discussion yet for this question.