Palo Alto Networks Exam PCNSA Topic 10 Question 56 Discussion

Actual exam question for Palo Alto Networks's Palo Alto Networks Certified Network Security Administrator exam

Question #: 56
Topic #: 10

[All Palo Alto Networks Certified Network Security Administrator Questions]

Review the Screenshot:

Given the network diagram, traffic must be permitted for SSH and MYSQL from the DMZ to the SERVER zones, crossing two firewalls. In addition, traffic should be permitted from the

SERVER zone to the DMZ on SSH only.

Which rule group enables the required traffic?

AOption A

BOption B

COption C

DOption D

Show Suggested Answer

Suggested Answer: B

Option B enables the required traffic by allowing SSL and web-browsing from UNTRUST to DMZ, denying SSH from UNTRUST to DMZ, allowing MYSQL from DMZ to SERVER, and allowing SSH from SERVER to DMZ. Option A allows SSH from UNTRUST to DMZ, which is not required. Option C denies all the required traffic.Option D denies all traffic from UNTRUST to TRUST, which is irrelevant to the question

https://www.paloaltonetworks.com/services/education/palo-alto-networks-certified-network-security-administrator

by Dorothy at Jan 27, 2024, 08:17 AM

Limited Time Offer

25%

Off

Get Premium PCNSA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Hyun

6 months ago

Hold up, I'm not so sure. Option A also seems to have the required rules, and it's a bit more straightforward. Maybe we should double-check that one as well?

upvoted 0 times

...

I agree, Option C looks like the best fit. The rule group in that option includes the necessary permissions for SSH and MySQL between the DMZ and Server zones, as well as the SSH permission from the Server zone to the DMZ.

upvoted 0 times

...

Vincent

6 months ago

Okay, let's take a closer look. The problem statement says we need to permit SSH and MySQL traffic from the DMZ to the Server zones, and SSH traffic from the Server zone to the DMZ. Based on that, I think Option C might be the correct answer.

upvoted 0 times

Margurite

6 months ago

Alright, Option C it is then. Let's go with that choice.

upvoted 0 times

...

Golda

6 months ago

Option D doesn't mention anything about allowing SSH traffic from Server zones to DMZ, so I still think Option C is the most suitable.

upvoted 0 times

...

Sang

6 months ago

I think Option D might also work, it allows SSH and MYSQL traffic from DMZ to Server zones as well.

upvoted 0 times

...

Mireya

6 months ago

That's true. Option C seems to be the best choice considering both requirements.

upvoted 0 times

...

Mary

6 months ago

Option A only allows SSH and MYSQL traffic from the DMZ to the Server zones, there is no mention of SSH traffic from Server zones to DMZ.

upvoted 0 times

...

Tijuana

6 months ago

But what about Option A? It also allows SSH and MYSQL traffic from DMZ to Server zones.

upvoted 0 times

...

Gerald

6 months ago

I agree, Option C looks like the correct choice.

upvoted 0 times

...

Dorian

6 months ago

Hmm, this is a tricky one. The question is asking about the rule group that enables the required traffic, but the network diagram and the problem statement don't give us a lot of details to work with. I'm a bit unsure about the correct answer.

upvoted 0 times

...

Palo Alto Networks Exam PCNSA Topic 10 Question 56 Discussion

Contribute your Thoughts:

Hyun

Crissy

Vincent

Margurite

Golda

Sang

Mireya

Mary

Tijuana

Gerald

Dorian