1.2 Explain the Functionality of Slow Path and Fast Path for Packet Inspection NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A firewall administrator is troubleshooting an issue where a specific application's traffic is being processed by the slow path, causing high latency. The application uses a proprietary protocol that sends a large number of small packets. The administrator has verified that the sessions are being established correctly. What is the most likely reason the traffic is still being processed by the slow path?

   • AThe application is using a non-standard port, which forces the firewall to use the slow path for all packets.
   • BThe application's traffic is being fragmented, forcing the firewall to reassemble the packets on the slow path.
   • CThe application is using UDP, which is always processed on the slow path.
   • DThe firewall is configured to perform user identification on all traffic, which requires slow path processing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer is monitoring a firewall and notices that a specific session is being processed by the slow path. The session is a long-lived connection to a database server. The engineer wants to understand why this session is not being processed on the fast path. Which characteristic of the traffic would explain this?

   • AThe session is using a non-standard port, which forces slow path processing.
   • BThe session is using UDP, which is always processed on the slow path.
   • CThe session is using TCP, which is always processed on the slow path.
   • DThe session is being inspected for data filtering, which requires slow path processing.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a Palo Alto Networks firewall, what is the fundamental difference between the slow path and the fast path for packet processing?

   • AThe slow path processes packets using hardware offloading, while the fast path uses software-based inspection.
   • BThe slow path handles packets that require deep inspection, while the fast path handles packets that match existing sessions.
   • CThe slow path and fast path are identical in function but differ in the order they process packets.
   • DThe fast path is used for all traffic, while the slow path is only used for management traffic.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security engineer is tuning a firewall that handles a mix of encrypted and unencrypted traffic. The engineer notices that the firewall's dataplane CPU is pegged at 100% during peak hours. The traffic consists of many new HTTPS sessions and a steady stream of large FTP transfers. Which change is most likely to reduce the dataplane CPU load?

   • AIncrease the session timeout for FTP traffic to keep sessions on the fast path longer.
   • BEnable hardware offloading for the FTP traffic to speed up fast path processing.
   • CReduce the number of security policy rules to speed up the policy lookup for new sessions.
   • DDisable SSL decryption for the HTTPS traffic to allow it to be processed on the fast path.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which type of traffic is typically processed by the slow path in a Palo Alto Networks firewall?

   • AThe first packet of a new session that requires session setup.
   • BPackets that are part of a long-lived TCP connection with no security concerns.
   • CPackets that are destined for a destination on the same subnet as the source.
   • DPackets that belong to an existing session and match the session table.
   Reveal Solution Discussion Select an answer first