A firewall administrator is investigating high packet buffer utilization in the company firewall. After looking at the threat logs and seeing many flood attacks coming from a single source that are…

Question

Options

• AApply DOS profile to security rules allow traffic from outside.
• BEnable packet buffer protection for the affected zones.
• CAdd the default Vulnerability Protection profile to all security rules that allow traffic from outside.
• DAdd a Zone Protection profile to the affected zones.

• A
  9% (3)
• B
  84% (27)
• C
  3% (1)
• D
  3% (1)

Explanation

Enabling packet buffer protection globally activates the feature at the device level, but on Palo Alto Networks firewalls, this is only half the configuration - the feature must also be explicitly enabled on each affected zone before it will actually intercept and throttle traffic in those zones. Without zone-level enablement, global activation alone has no enforcement point.

Why the distractors are wrong:

• A (DoS profile on security rules): DoS Protection profiles on security rules address rate-limiting per session/source, which is a different mechanism entirely and does not configure packet buffer protection.
• C (Vulnerability Protection profile): Vulnerability Protection detects and blocks exploits targeting known CVEs - it is the wrong tool for flood-based buffer exhaustion attacks.
• D (Zone Protection profile): Zone Protection profiles handle flood protection (SYN, UDP, ICMP floods) and reconnaissance protection at the zone level, but they are a separate feature from packet buffer protection and would not fix the misconfiguration described.

Memory tip: Think of packet buffer protection as a light switch that requires two flips - the global setting is the breaker box (power available), but the zone-level setting is the wall switch (light actually turns on). If you only flip the breaker, nothing lights up.

No community discussion yet for this question.