Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Administrator (PCNSA) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
In Palo Alto’s PAN-OS, if a Security policy is configured with a matching condition that includes a single application and the action is set to drop, the firewall will silently drop the traffic1. This means that a TCP reset is not sent to the host/application1. This action overrides the default deny action of the application, even if it’s set to reset-both1. Therefore, the correct answer is A. It silently drops the traffic.
Deny Action App-IDs are developed with a default deny action that dictates how the firewall responds when the application is included in a Security policy rule with a deny action. The default deny action can specify either a silent drop or a TCP reset. You can override this default action in Security policy.
It's D Reset both= Sends a TCP reset to both the client-side and server-side devices.