Which two options prevent the firewall from capturing traffic passing through it? (Choose two.)

Question

Options

• AThe firewall is in multi-vsys mode.
• BThe traffic is offloaded.
• CThe traffic does not match the packet capture filter.
• DThe firewall's DP CPU is higher than 50%.

• A
  5% (3)
• B
  86% (51)
• D
  8% (5)

Explanation

Offloaded traffic bypasses the firewall's data plane processor entirely - it's handled at the hardware/ASIC level - so the capture engine never sees it, making B correct. C is correct because Palo Alto packet capture relies on user-defined filters (source/destination IP, port, protocol); traffic that doesn't match simply isn't captured by design.

A is wrong because multi-vsys mode doesn't block packet capture - you can still capture traffic within each vsys context; it's an administrative separation, not a capture restriction. D is wrong because there is no CPU threshold that automatically disables packet capture; high DP CPU may degrade performance, but 50% is not a capture-blocking condition.

Memory tip: Think "Off and Out" - traffic that is Offloaded (hardware-fast-pathed) or falls Outside the filter is invisible to the capture engine. Everything else the firewall processes in software is fair game.

No community discussion yet for this question.