Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Indeed, the doc says "existing sessions and global", but in reality, PBP applies to existing and new sessions. PBP measures Connections per seconds and can drop packets of new sessions or discard existing sessions should they consume too many buffers. Basically, the doc is wrong, but for the PCNSE, we should of course answer "While zone and DoS protection apply to new sessions (connections) and are granular, Packet Buffer Protection applies to existing sessions and is global." If only globally applied, PBP drops packets using RED. When applied in a zone, it can also block (with the "block countdown threshold") for an amount of time
PBP applies to existing sessions. It is enabled globally and if enabled globally can also be applied to zones.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection Yes, Buffer Protection can apply on each zone. But from doc it said "You must enable Packet Buffer Protection globally in order for it to be active in zones." So there must be a global rule already being made. Thus I chose B.