Palo Alto Networks Exam PCNSA Topic 1 Question 74 Discussion

Actual exam question for Palo Alto Networks's PCNSA exam

Question #: 74
Topic #: 1

An administrator should filter NGFW traffic logs by which attribute column to determine if the entry is for the start or end of the session?

AReceive Time

BType

CDestination

DSource

Show Suggested Answer

Suggested Answer: B

The Type attribute column in the NGFW traffic logs indicates whether the log entry is for the start or end of the session. The possible values are START, END, DROP, DENY, and INVALID. The START value means that the log entry is for the start of the session, and the END value means that the log entry is for the end of the session.The other values indicate that the session was terminated by the firewall for various reasons12.Reference:Traffic Log Fields,Session Log Best Practices

by Nikita at Sep 15, 2024, 03:51 PM

Limited Time Offer

25%

Off

Get Premium PCNSA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

My

2 months ago

Hmm, this is a tough one. But I bet the answer involves a 'Start' and 'Stop' designation, not just the columns themselves.

upvoted 0 times

...

Malika

2 months ago

I'm going with A) Receive Time. The timestamp should show when the session started and ended.

upvoted 0 times

Glenn

26 days ago

B) Type might provide some additional context for the session logs.

upvoted 0 times

...

Marcelle

29 days ago

D) Source could help identify the start of the session as well.

upvoted 0 times

...

Yuki

1 months ago

I think C) Destination could also be useful to determine the end of the session.

upvoted 0 times

...

Glendora

1 months ago

I agree, A) Receive Time is the best attribute to filter by for session start and end.

upvoted 0 times

...

Evan

2 months ago

You know, I was just thinking - if the admin can't figure this out, they might as well throw in the NGFW and go back to carrier pigeons.

upvoted 0 times

...

Leanora

2 months ago

D) Source seems more logical to me. The source IP address would indicate the start or end of a session.

upvoted 0 times

Caitlin

29 days ago

D) Source is a good choice, as the source IP address can indicate the beginning or end of a session.

upvoted 0 times

...

Kent

1 months ago

B) Type might also provide valuable information in filtering NGFW traffic logs.

upvoted 0 times

...

Stephaine

1 months ago

A) Receive Time would be more accurate to determine the start or end of a session.

upvoted 0 times

...

Muriel

2 months ago

I think the answer is B) Type. The traffic logs should have a column that indicates whether the entry is for the start or end of a session.

upvoted 0 times

Nieves

2 months ago

C) Destination

upvoted 0 times

...

Marta

2 months ago

B) Type

upvoted 0 times

...

Malcolm

2 months ago

I'm not sure, but I think it's B) Type.

upvoted 0 times

...

Melinda

2 months ago

I agree, it could be D) Source.

upvoted 0 times

...

Justine

2 months ago

I think it might be C) Destination.

upvoted 0 times

...

Isabelle

2 months ago

I believe the answer is A) Receive Time.

upvoted 0 times

...

Lindsey

2 months ago

A) Receive Time

upvoted 0 times

...

Jacki

3 months ago

I think filtering by Source would be the best option because it will show where the session originated from.

upvoted 0 times

...

Merilyn

3 months ago

I disagree, I believe filtering by Type would be more accurate in this case.

upvoted 0 times

...

Hollis

3 months ago

I think we should filter by Receive Time to determine the start or end of the session.

upvoted 0 times

...