Exam PCNSE topic 1 question 20 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 20
Topic #: 1

A user's traffic traversing a Palo Alto Networks NGFW sometimes can reach http://www.company.com. At other times the session times out. The NGFW has been configured with a PBF rule that the user's traffic matches when it goes to http://www.company.com.
How can the firewall be configured automatically disable the PBF rule if the next hop goes down?

A. Create and add a Monitor Profile with an action of Wait Recover in the PBF rule in question.
B. Create and add a Monitor Profile with an action of Fail Over in the PBF rule in question.
C. Enable and configure a Link Monitoring Profile for the external interface of the firewall.
D. Configure path monitoring for the next hop gateway on the default route in the virtual router.

Show Suggested Answer

Suggested Answer: B 🗳️

by tester12 at Sept. 9, 2019, 9:44 p.m.

Comments

Submit Cancel

UFanat

Highly Voted 2 years, 10 months ago

Selected Answer: B

B is a correct one: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-monitor A monitor profile is used to monitor IPSec tunnels and to monitor a next-hop device for policy-based forwarding (PBF) rules. In both cases, the monitor profile is used to specify an action to take when a resource (IPSec tunnel or next-hop device) becomes unavailable. wait-recover—Wait for the tunnel to recover; do not take additional action. Packets will continue to be sent according to the PBF rule. fail-over—Traffic will fail over to a backup path, if one is available. The firewall uses routing table lookup to determine routing for the duration of this session.

upvoted 9 times

...

kerberos

Most Recent 7 months ago

BEHAVIOR OF A SESSION ON A MONITORING FAILURE IF THE RULE STAYS ENABLED WHEN THE MONITORED IP ADDRESS IS UNREACHABLE IF RULE IS DISABLED WHEN THE MONITORED IP ADDRESS IS UNREACHABLE For an established session wait-recover—Continue to use egress interface specified in the PBF rule wait-recover—Continue to use egress interface specified in the PBF rule fail-over—Use path determined by routing table (no PBF) fail-over—Use path determined by routing table (no PBF) For a new session wait-recover—Use path determined by routing table (no PBF) wait-recover—Check the remaining PBF rules. If no match, use the routing table fail-over—Use path determined by routing table (no PBF) fail-over—Check the remaining PBF rules. If no match, use the routing table

upvoted 1 times

...