Exam PCNSA topic 1 question 150 discussion

Actual exam question from Palo Alto Networks's PCNSA

Question #: 150
Topic #: 1

An administrator would like to override the default deny action for a given application, and instead would like to block the traffic and send the ICMP code
`communication with the destination is administratively prohibited`.
Which security policy action causes this?

A. Drop
B. Drop, send ICMP Unreachable
C. Reset both
D. Reset server

Show Suggested Answer

Suggested Answer: B 🗳️

by H3kerman at Nov. 25, 2021, 8:23 p.m.

Comments

Submit Cancel

Catza

5 months ago

Answer is C https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/security-policy/security-policy-actions

upvoted 1 times

Catza

5 months ago

Correction Answer is B - Drop, send ICMP Unreachable

upvoted 1 times

...

LordScorpius

9 months ago

Selected Answer: B

Why not reset? Because "For a TCP session with a reset action, the firewall does not send an ICMP Unreachable response."

upvoted 3 times

...

error_909

9 months, 2 weeks ago

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClltCAC#:~:text=The%20Deny%20action%20will%20tear,packets%20will%20be%20silently%20discarded.

upvoted 1 times

error_909

9 months, 2 weeks ago

Answer is Drop and send icmp unrechable

upvoted 2 times

...

H3kerman

1 year, 1 month ago

Drop Silently drops the traffic; for an application, it overrides the default deny action. A TCP reset is not sent to the host/application. For Layer 3 interfaces, to optionally send an ICMP unreachable response to the client, set Action: Drop and enable the Send ICMP Unreachable check box. When enabled, the firewall sends the ICMP code for communication with the destination is administratively prohibited—ICMPv4: Type 3, Code 13; ICMPv6: Type 1, Code 1.

upvoted 4 times

LuisRG17

1 year ago

I guess that the correct answer is B, because you will drop the request and additional you have to enable Send ICMP Unreachable to send the message

upvoted 3 times

...