Exam PCNSE topic 1 question 413 discussion

A: is sure correct. C: will only be correct if the operator between 192.168.0.0/16 & 10.0.0.0/8 is an "OR" and not an "AND" source can't be from both subnets, it's either or, not both

Sadly, none of these choices are technically correct. @obatel pointed out that the RFC 1918 filter uses AND condition instead of OR @BTSeeYa pointed out that A stated 'all traffic' instead of 'all traffic logs' A would be correct if they say 'all traffic logs' instead of simply 'all traffic' B would be correct if they said email instead of Panorama C would be correct if the RFC 1918 filter used OR instead of AND D would be correct if they change the subnet to one that fell within the RFC 1918 filter AND if they referred to 'traffic logs' Since A and C are the closest to correct choices, I guess that's what I'd choose on the test? [i just hope I don't see too many questions like this one on my test]

A isn't even technically correct, the way they have the answer written. These test makers need to do better. Instead of "All traffic", it should say "All Traffic logs". The way they wrote that suggests that all logs would be sent to the Syslog server.

There must be a typo with D. They probably want to say 172.16/24. In which case, A and D would be correct

A, C are correct

Only A is correct. All the others are wrong.

A and C are correct: A-192.168.100.0/24 are send to Syslog. C-RFC 1918 defines private IP addressing, so Private subnets are sending to PN/Cortex DL.

AC B is not correct as it is sent externally not to Panorama D is not correct as it is 172.12 (not 172.16)

That's right. Good catch, obatel.