A company has a DoS protection profile applied to its DMZ zone. The profile has SYN flood protection set to 'drop' and ICMP flood protection set to 'random early drop'. During a recent attack, the administrator noticed that the SYN flood protection was dropping all new connections, including legitimate ones, causing an outage. What is the most likely reason for this?

The SYN flood threshold was set too low, causing the profile to trigger during normal traffic patterns.

The profile is not applied to the correct zone, so it is processing traffic incorrectly.

The SYN flood action is set to 'drop', which is too aggressive for the environment.

The ICMP flood protection is interfering with the SYN flood protection.

After applying a DoS protection profile to the untrust zone, an administrator wants to verify that the profile is actively mitigating a SYN flood attack. Which monitoring tool or log should the administrator check to confirm the effectiveness of the profile?

Check the system logs for configuration changes to confirm the profile was applied.

Review the traffic logs for entries showing 'drop' or 'random early drop' actions on SYN packets.

Check the configuration audit log to see if the profile is still attached to the zone.

Use the packet capture tool to analyze the raw SYN packets and see if they are being forwarded.

Which type of attack is a DoS protection profile specifically designed to mitigate?

Denial-of-service floods such as SYN and ICMP floods

Malware infections spreading across the network

Unauthorized access attempts via brute force

An administrator is creating a DoS protection profile for a zone that hosts a critical application. The application is known to have occasional legitimate traffic spikes. The administrator wants to ensure that the profile does not drop legitimate traffic during these spikes. What should the administrator do when configuring the flood protection thresholds?

Set the thresholds to the highest possible value to avoid any false positives.

Set the thresholds based on the application's normal traffic baseline, with some headroom for spikes.

Set the thresholds to the lowest possible value to catch any potential attack early.

Set the thresholds to match the maximum capacity of the server to ensure it is never overwhelmed.

Palo Alto NetworksCertified Network Security Analyst

Domain 1Objective 8

1.8 Create and Apply DoS Protection Profiles NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Part of the Object Configuration Creation and Application domain, which accounts for 30% of the NETWORK-SECURITY-ANALYST exam.

18questions here

4free pages

5concepts

30%of the exam

Questions 1–5

1expert · hard
A company has a DoS protection profile applied to its DMZ zone. The profile has SYN flood protection set to 'drop' and ICMP flood protection set to 'random early drop'. During a recent attack, the administrator noticed that the SYN flood protection was dropping all new connections, including legitimate ones, causing an outage. What is the most likely reason for this?
Select an answer first
2application · medium
After applying a DoS protection profile to the untrust zone, an administrator wants to verify that the profile is actively mitigating a SYN flood attack. Which monitoring tool or log should the administrator check to confirm the effectiveness of the profile?
Select an answer first
3foundation · easy
Which type of attack is a DoS protection profile specifically designed to mitigate?
Select an answer first
4application · medium
An administrator is creating a DoS protection profile for a zone that hosts a critical application. The application is known to have occasional legitimate traffic spikes. The administrator wants to ensure that the profile does not drop legitimate traffic during these spikes. What should the administrator do when configuring the flood protection thresholds?
Select an answer first
5foundation · easy
Where can a DoS protection profile be applied on a Palo Alto Networks firewall?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ANALYST” is a trademark of its owner, used for identification only.

1.8 Create and Apply DoS Protection Profiles NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Questions 1–5

After applying a DoS protection profile to the untrust zone, an administrator wants to verify that the profile is actively mitigating a SYN flood attack. Which monitoring tool or log should the administrator check to confirm the effectiveness of the profile?

Which type of attack is a DoS protection profile specifically designed to mitigate?

Where can a DoS protection profile be applied on a Palo Alto Networks firewall?

Keep studying — Object Configuration Creation and Application