PCNSE Network Segmentation and Zone Security 1 — Questions and Answers
Question 1: What is the primary purpose of security zones in Palo Alto Networks firewalls?
- To assign bandwidth limits to interfaces
- To logically group interfaces and enforce policy between groups (Correct answer)
- To configure routing protocols
- To define NAT address pools
Correct answer: To logically group interfaces and enforce policy between groups
Security zones logically group network interfaces, and all traffic between zones is subject to security policy inspection and enforcement.
Question 2: In Palo Alto Networks, what type of zone is used for traffic originating from or destined to the firewall itself?
- Layer 3 Zone
- Tap Zone
- Virtual Wire Zone
- Functional Zone (MGT) (Correct answer)
Correct answer: Functional Zone (MGT)
The functional zone (management zone) covers traffic to and from the firewall's own services; intrazone traffic to the firewall's management plane is handled separately from regular data plane zones.
Question 3: Which zone type allows a Palo Alto firewall to monitor traffic passively without being in the traffic path?
- Layer 3
- Layer 2
- Tap (Correct answer)
- Virtual Wire
Correct answer: Tap
A Tap zone connects to a SPAN or mirror port, allowing the firewall to inspect a copy of traffic without being inline, enabling visibility without policy enforcement.
Question 4: What is the default action for traffic between two different security zones if no matching security policy rule exists?
- Allow all traffic
- Deny all traffic (implicit deny) (Correct answer)
- Log only without blocking
- Apply default threat profiles
Correct answer: Deny all traffic (implicit deny)
Palo Alto firewalls apply an implicit deny-all rule at the bottom of the security policy, blocking all inter-zone traffic that does not match an explicit allow rule.
Question 5: What is the default behavior for intra-zone traffic (traffic within the same zone) on a Palo Alto firewall?
- Denied by default
- Allowed by default (Correct answer)
- Logged but not inspected
- Sent to a sandbox for analysis
Correct answer: Allowed by default
By default, intra-zone traffic is allowed without inspection; administrators must create explicit deny rules or enable intra-zone security profiles to inspect same-zone traffic.
Question 6: Which zone protection profile feature helps prevent resource exhaustion from SYN flood attacks?
- Reconnaissance Protection
- SYN Cookies (Correct answer)
- Packet Buffer Protection
- Zone ACL
Correct answer: SYN Cookies
SYN Cookies in Zone Protection Profiles defend against SYN flood attacks by generating stateless SYN-ACK responses to validate TCP handshakes before allocating state table entries.
PCNSE Network Segmentation and Zone Security 1
What is the primary purpose of security zones in Palo Alto Networks firewalls?