PCNSE · Question #47
Only two Trust to Untrust allow rules have been created in the Security policy - Rule1 allows google-base - Rule2 allows youtube-base The youtube-base App-ID depends on google-base to function. The…
The correct answer is C. Add the DNS App-ID to Rule2. To resolve youtube.com and allow its display, the firewall must permit DNS traffic, as the existing rules only allow Google-base and Youtube-base applications but not the underlying name resolution. Without DNS, the browser cannot find the server.
Question
Only two Trust to Untrust allow rules have been created in the Security policy
- Rule1 allows google-base
- Rule2 allows youtube-base
The youtube-base App-ID depends on google-base to function. The google-base App-ID implicitly browser, they get an error indecating that the server cannot be found. Which action will allow youtube.com display in the browser correctly?
Options
- AAdd SSL App-ID to Rule1
- BCreate an additional Trust to Untrust Rule, add the web-browsing, and SSL App-ID's to it
- CAdd the DNS App-ID to Rule2
- DAdd the Web-browsing App-ID to Rule2
How the community answered
(66 responses)- A2% (1)
- B5% (3)
- C83% (55)
- D11% (7)
Why each option
To resolve youtube.com and allow its display, the firewall must permit DNS traffic, as the existing rules only allow Google-base and Youtube-base applications but not the underlying name resolution. Without DNS, the browser cannot find the server.
Adding SSL App-ID might be necessary for secure communication but does not address the fundamental problem of domain name resolution, which must occur before an SSL connection can be established.
Creating a new rule with web-browsing and SSL App-IDs would allow the web traffic itself, but it still overlooks the critical prerequisite of DNS resolution for the initial connection.
For a browser to access any website like youtube.com, it first needs to resolve the domain name to an IP address, which is handled by DNS. Adding the 'dns' App-ID to a security policy rule allows this essential name resolution traffic to pass through the firewall, enabling the browser to locate the server.
Adding Web-browsing App-ID to Rule2 would allow HTTP/HTTPS traffic for the YouTube application, but it would not enable the initial DNS lookup required to translate youtube.com into an IP address.
Concept tested: App-ID for DNS resolution
Source: https://docs.paloaltonetworks.com/app-id/app-id-overview/what-is-app-id
Topics
Community Discussion
No community discussion yet for this question.