Which action protects against port scans from the internet?

Question

Options

• AApply App-ID Security policy rules to block traffic sourcing from the untrust zone.
• BAssign Security profiles to Security policy rules for traffic sourcing from the untrust zone.
• CApply a Zone Protection profile on the zone of the ingress interface.
• DAssign an Interface Management profile to the zone of the ingress surface.

• A
  9% (3)
• B
  3% (1)
• C
  85% (28)
• D
  3% (1)

Explanation

Zone Protection profiles are designed specifically for this purpose - they operate at the network zone level on the ingress interface, detecting and blocking reconnaissance techniques like port scans, IP sweeps, and flood attacks before traffic is processed by security policies. Applying one to the zone where internet traffic enters (the untrust zone) stops the scan at the perimeter.

Why the distractors are wrong:

• A (App-ID rules): App-ID identifies applications in established flows - it doesn't protect against port scan probes at the zone level before policies are evaluated.
• B (Security profiles): Security profiles (Vulnerability Protection, Anti-Spyware, etc.) inspect traffic that already passed a Security policy rule; port scans often involve packets that never match a permissive rule in the first place.
• D (Interface Management profile): This controls which management services (SSH, HTTPS, ping) are reachable on the firewall itself - it's for protecting the device's management plane, not the network.

Memory tip: Think of it as layers - Zone Protection guards the door (the zone boundary), while Security policies and profiles guard the rooms (specific traffic flows). Port scans attack the door, so you need the door-level control.

No community discussion yet for this question.