A client has a sensitive application server in their data center and is particularly concerned about session flooding because of denial-of-service attacks. How can the Palo Alto Networks NGFW be…

Question

Options

• AAdd an Anti-Spyware Profile to block attacking IP address
• BDefine a custom App-ID to ensure that only legitimate application traffic reaches the server
• CAdd QoS Profiles to throttle incoming requests
• DAdd a tuned DoS Protection Profile

• A
  2% (1)
• B
  12% (5)
• C
  7% (3)
• D
  78% (32)

Explanation

DoS Protection Profiles on Palo Alto Networks NGFWs are purpose-built to defend against session flooding attacks, and they can be tuned to detect and block floods originating from a single source IP (using "aggregate" vs. "classified" thresholds). When you apply a DoS Protection Profile in a DoS Protection Policy, you set per-source rate limits that trigger SYN cookies, drop packets, or block the offending IP once thresholds are exceeded - exactly what the scenario requires.

Why the distractors are wrong:

• A (Anti-Spyware Profile): Anti-Spyware detects command-and-control traffic and malware callbacks - it has no mechanism to rate-limit or block session floods.
• B (Custom App-ID): App-ID classifies application traffic for policy enforcement; it cannot throttle or cap session rates from a single source.
• C (QoS Profiles): QoS manages bandwidth allocation and traffic prioritization, not connection/session flood mitigation - it would slow traffic but not block an attacker.

Memory tip: Think DoS Profile = "Dos" (doing) the rate-limiting. Any time a question mentions flood, rate limiting per IP, or DoS/DDoS defense, the answer will involve a DoS Protection Profile, not Anti-Spyware (malware), App-ID (classification), or QoS (bandwidth shaping).

No community discussion yet for this question.