A company requires that a specific set of ciphers be used when remotely managing their Palo Alto Networks appliances. Which profile should be configured in order to achieve this?

Question

Options

• ASSL/TLS Service Profile
• BSSH Service Profile
• CCertificate Profile
• DDecryption Profile

• A
  89% (17)
• C
  5% (1)
• D
  5% (1)

Explanation

SSL/TLS Service Profile is correct because it is specifically designed to control the SSL/TLS protocol versions and cipher suites used when clients connect to the Palo Alto appliance for management purposes (HTTPS, GlobalProtect, etc.) - making it the right tool for enforcing a required cipher set.

SSH Service Profile (B) controls SSH-specific settings like key exchange algorithms and ciphers for SSH-based management access, but the question asks about remote management broadly, and the SSL/TLS Service Profile is the more general and exam-intended answer for cipher control across management interfaces. Certificate Profile (C) defines how the firewall validates client certificates (CA trust, CRL/OCSP) - it has nothing to do with selecting cipher suites. Decryption Profile (D) governs how the firewall handles traffic it is inspecting/decrypting in transit (SSL Forward Proxy, etc.), not how its own management plane negotiates ciphers.

Memory tip: Think "Service Profile = how the firewall serves connections to itself." SSL/TLS Service Profile = the firewall's own TLS handshake settings, including ciphers. If you're locking down what the box accepts, reach for a Service Profile.

No community discussion yet for this question.