2.5 Create and Apply Policy Based Forwarding (PBF) Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network admin has configured a PBF policy to send traffic from the engineering subnet to a partner's network over a dedicated link. After committing, they notice the traffic is still using the default route. Which step should be taken FIRST to verify the PBF policy is being applied?

   • AReboot the firewall to ensure the PBF policy is loaded
   • BDisable the security policy that might be blocking the traffic
   • CCheck the PBF policy's rule usage and hit count in the firewall's session table or monitor logs
   • DVerify the routing table has a static route for the partner's network
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization uses PBF to send VoIP traffic from a specific subnet (192.168.10.0/24) over a dedicated SIP trunk (next hop 172.16.0.1 via ethernet1/3). They want to ensure that if the SIP trunk becomes unreachable, the traffic automatically falls back to the default route. What must be configured on the PBF policy to enable this failover?

   • AEnable path monitoring on the PBF policy, specifying the monitoring destination as the SIP trunk's next hop (172.16.0.1) and the source as the firewall's egress interface IP
   • BSet the PBF policy to 'enforce symmetric return' and enable 'monitor' on the interface
   • CConfigure a secondary next hop in the PBF policy action
   • DCreate a static route with a lower administrative distance than the PBF policy
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When configuring a PBF policy on a Palo Alto Networks firewall, which elements are required to define the traffic to be forwarded?

   • ASource, destination, and forwarding action
   • BSource, destination, and security profile
   • CSource, destination, and service
   • DSource, destination, and user
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a PBF policy that sends all traffic from the R&D subnet to a cloud provider over a dedicated VPN. The VPN is critical, and the admin wants to ensure that if the VPN tunnel goes down, the traffic is NOT sent over the internet as a fallback, but instead is dropped. Which configuration achieves this?

   • ADo not configure path monitoring; the PBF policy will automatically drop traffic if the next hop is unreachable
   • BCreate a security policy that blocks traffic from the R&D subnet to the cloud provider
   • CEnable path monitoring on the PBF policy and set the 'Action on failure' to 'Drop'
   • DSet the PBF policy's next hop to a null interface
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What happens to traffic that matches a PBF policy when the policy is correctly applied?

   • AIt is forwarded to the specified next hop or egress interface, overriding the routing table
   • BIt is sent to the management plane for inspection
   • CIt is dropped by default
   • DIt is forwarded according to the routing table
   Reveal Solution Discussion Select an answer first