5.4 Explain Policy Issue Troubleshooting SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a Palo Alto Networks firewall, when a packet matches a security policy rule, what is the order of evaluation for the rule's match criteria?

   • ASource and destination addresses, then source and destination zones, then user, then application, then service/port.
   • BSource and destination zones, then source and destination addresses, then user, then application, then service/port.
   • CUser, then application, then source and destination zones, then source and destination addresses, then service/port.
   • DApplication, then source and destination zones, then user, then source and destination addresses, then service/port.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network admin notices that a new security policy rule is not being hit, even though the traffic should match it. The rule is placed at the bottom of the policy. What is the most likely reason the rule is not being hit?

   • AThe rule's source and destination are too specific, so the traffic does not match.
   • BThe rule is placed after a broader rule that is matching the traffic first.
   • CThe rule's action is set to 'deny', so it is not being counted as a hit.
   • DThe rule is disabled, so it is not being evaluated.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a Palo Alto Networks SD-WAN environment, how do security policies and SD-WAN forwarding policies interact?

   • ASecurity policies are evaluated first to determine if traffic is allowed, and then SD-WAN policies determine the path for allowed traffic.
   • BSecurity policies and SD-WAN policies are evaluated simultaneously, and the most specific match wins.
   • CSD-WAN policies are evaluated first to determine the path, and then security policies determine if traffic is allowed.
   • DSD-WAN policies override security policies for traffic that matches an SD-WAN rule.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When verifying a security policy rule, which action setting would cause the firewall to drop the traffic and send a TCP reset to the client?

   • ADrop
   • BAllow
   • CReset-client
   • DDeny
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A network administrator notices that traffic from a specific subnet is being silently dropped, with no log entries generated. Which symptom is most commonly associated with a policy misconfiguration in this scenario?

   • ATraffic is being allowed but with altered application behavior, indicating a QoS policy issue.
   • BTraffic is being dropped without any log entries, indicating a deny rule is matching.
   • CTraffic is being allowed but with increased latency, indicating a routing loop.
   • DTraffic is being forwarded to the wrong interface, indicating a routing table misconfiguration.
   Reveal Solution Discussion Select an answer first