PCNSA Policy Evaluation and Management Practice Question

Correct answer & explanation

The recommended best practices are placing more specific rules above more general rules (B) and using security profile groups to consistently apply security profiles (E). Placing specific rules first ensures that the most granular match criteria are evaluated before broader rules, which aligns with the firewall's first-match logic. Security profile groups allow you to define a set of profiles (antivirus, anti-spyware, vulnerability protection, etc.) and apply them consistently across multiple rules, simplifying management and reducing misconfigurations. Option A is incorrect because disabling logging for frequently matched rules would hinder visibility into allowed traffic and potentially mask malicious activity. Option C is incorrect because creating a rule for each application leads to excessive rules, making management complex and increasing the chance of errors; Palo Alto Networks recommends grouping applications with similar characteristics. Option D is incorrect because the 'intrazone-default' rule is a built-in rule that by default allows all intrazone traffic; it should not be modified to allow traffic, as it is intended for logging or dropping unwanted intrazone traffic according to best practices.