1.2 Explain the Functionality of Slow Path and Fast Path for Packet Inspection NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is troubleshooting a throughput issue on a Palo Alto Networks firewall. The engineer observes that a bulk file transfer between two internal servers is consuming far more CPU than expected. The transfer has been running for several minutes and consists of large, unfragmented TCP segments. Which action would most likely reduce the CPU load for this traffic?

   • AIncrease the TCP timeout value for the application to keep the session in the session table longer.
   • BDisable the security policy rule that matches this traffic to bypass inspection entirely.
   • CConfigure the firewall to use a larger MSS value to reduce the number of packets in the transfer.
   • DVerify that the session is being processed on the fast path and not being punted to the slow path for every packet.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does the division between slow path and fast path affect firewall performance?

   • AIt decreases throughput because all packets must go through the slow path for security checks.
   • BIt has no impact on performance because both paths process packets identically.
   • CIt increases latency for all packets because the firewall must check the session table for every packet.
   • DIt increases throughput because the fast path handles the majority of packets with minimal overhead.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is deploying a new firewall to inspect traffic between two data centers. The traffic consists of large file transfers that are expected to run for hours. The administrator wants to maximize throughput for these transfers. What is the most effective way to ensure this traffic is processed efficiently?

   • ADisable the session table so that every packet is treated as a new session.
   • BConfigure the firewall to send all traffic to the slow path for maximum inspection accuracy.
   • CUse a security policy that only inspects the first packet of each session and skips the rest.
   • DEnsure the sessions are established and then allow the firewall to process the bulk of the traffic on the fast path.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a criterion that causes a packet to be processed in the slow path?

   • AThe packet is part of a UDP stream with no payload.
   • BThe packet has a destination IP address that is in the routing table.
   • CThe packet belongs to an existing session with a valid session table entry.
   • DThe packet is the first packet of a new session.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network administrator is explaining the firewall architecture to a colleague. The administrator states that the firewall uses a 'session-based' processing model. What does this mean in the context of slow path and fast path?

   • AThe first packet of a session is processed on the slow path to set up the session, and subsequent packets are processed on the fast path.
   • BAll packets in a session are processed on the same path, either slow or fast, based on the security policy.
   • CEach packet is inspected independently, and the firewall decides which path to use based on the packet's content.
   • DThe firewall alternates between slow and fast path for each packet to balance the load.
   Reveal Solution Discussion Select an answer first