Tap Interfaces Considerations – If you use a Tap interface to gain visibility into DHCP traffic that the firewall doesn’t ordinarily see, consider the following: Place the tap “north” of any routed boundary where DHCP is configured. This will ensure that the captured traffic is unicast rather than broadcast. (If the firewall with the Tap interface is in the same broadcast domain as the switch that’s mirroring traffic to it, enable DHCP Broadcast Session at DeviceSetupSession.) Use Cases for Tap interfaces Evaluations Networks where DHCP is configured on a device “south” of the firewall Monitor networks that don’t naturally traverse the firewall

answer is A. DHCP server, DHCP client and FW on the same broadcast domain means that a VWire interface will only catch the broadcast packets (not the unicast) and will still generate EALs. For a Tap interface to catch the 4 DHCP packets, the switch needs to mirror the traffic.

Has anybody recently taken the PCNSE exam? Are there any questions on the exam that are under #300 on the study guide?

Has anybody recently taken the PCNSE exam? Are there any questions that are under #300 on the study guide?

As question states, the firewall is not in the traffic path. Tap is the interface that can receive traffic to identification.

The question stated "not in line of any DHCP traffic". For Vwire interfaces "Ensure the Virtual Wire is in the path for DHCP traffic. This traffic can be either broadcast or unicast." Tap interface use case "Monitor networks that don’t naturally traverse the firewall". D has to be the right answer.

A, sure

"Virtual Wire: When the firewall has Virtual Wire interfaces with multicast firewalling enabled, it generates Enhanced Application logs (EALs) for broadcast DHCP sessions." https://docs.paloaltonetworks.com/iot/iot-security-admin/get-started-with-iot-security/firewall-deployment-for-dhcp-visibility/firewall-deployment-options-for-iot-security

A. Virtual Wire: When the firewall has Virtual Wire interfaces with multicast firewalling enabled, it generates Enhanced Application logs (EALs) for broadcast DHCP sessions.

Vwire interface https://docs.paloaltonetworks.com/iot/iot-security-admin/get-started-with-iot-security/firewall-deployment-for-dhcp-visibility/firewall-deployment-options-for-iot-security