Policy Creation And Application practice questions

Application Filters

Application Filters allow grouping applications by category, subcategory, or technology to enforce policies dynamically.

A QoS profile with a specific class and priority.

A QoS profile defines the class and its priority, which is the classification component that identifies VoIP traffic and assigns it higher scheduling priority than bulk transfers. Without this profile, the firewall cannot distinguish VoIP from file-transfer traffic for prioritisation.

Install the User-ID agent on a Windows server.

Installing the User-ID agent on a Windows server provides the endpoint that reads domain controller security logs and forwards user-to-IP mappings to the firewall. This satisfies the stem's requirement for the Windows-based agent deployment before any mapping can occur.

Enable User-ID on the zone interface.

Enabling User-ID on the zone interface activates user-based policy enforcement on that zone, so the firewall associates traffic with mapped users. This satisfies the stem by ensuring mappings from the Windows agent are actually applied to traffic traversing the interface.

Configure the agent to monitor Security Event Logs on Domain Controllers.

Security Event Logs on Domain Controllers record interactive and network logon events (4624) containing the source IP and account name. Parsing these lets the agent build IP-to-user mappings without endpoint agents, satisfying the requirement to map identities from existing authentication events.

Enable QoS on the egress interface

QoS processing occurs on the egress interface, so enabling QoS there is the prerequisite before any profile, class, or priority can take effect. Without this toggle, configured policies are not applied to outbound traffic, leaving prioritisation inactive.

Static IP

Static IP NAT allows mapping an internal address to an arbitrary external address defined in the translation.

IP-User Mapping

IP-User Mapping determines how the firewall learns user-to-IP bindings, such as from domain controller logs or GlobalProtect, so correct configuration across sites ensures each address resolves to the right identity, satisfying the multi-site mapping requirement.

Group Mapping

Required to pull group membership data.

The session requires allowing the dependent application explicitly

Palo Alto App-ID resolves applications in dependency order: 'ssl' and 'web-browsing' are merely the underlying transport, so the portal's real application is never identified and the session is dropped. Explicitly permitting that dependent application in the security policy satisfies the App-ID dependency requirement.

Policy Rule Groups

Rule groups are designed specifically for grouping and organizing policies.

Deny

The 'Deny' action is the standard action to drop traffic silently.

Decryption Policy

Decryption policies control the decryption of SSL/TLS traffic.

Source Zone match

NAT rules are evaluated against the packet's pre-translation headers, and the source zone is one of the mandatory match criteria. A rule whose source zone does not match the ingress zone is skipped, so the policy never applies to that packet.

Destination Zone match

The destination zone is a mandatory match criterion in the NAT rulebase, evaluated against the packet's original routing before translation. If the destination zone does not match the zone associated with the egress interface, the rule is not applied.

Destination Address match

NAT rule matching uses the packet's original destination address before any translation occurs. If the configured destination address does not match the packet's pre-NAT destination, the rule is skipped, so this condition must be satisfied for the policy to apply.

A dedicated User-ID Agent

The Windows-based User-ID Agent is a dedicated service installed on a domain member server, which queries Microsoft Active Directory security logs and maps IP addresses to user identities. This dedicated agent satisfies the stem's requirement for User-ID integration with Microsoft Active Directory.

The traffic is not hitting the interface with QoS enabled

QoS policies are applied per interface, so traffic egressing an interface without the policy attached is classified and forwarded without shaping or marking. The traffic must traverse the interface where QoS is enabled for the policy to take effect.

The Security policy uses the destination zone of the original packet

Correct, the zone is determined based on the original destination.

Security policy evaluation happens before NAT

Correct, Security policy is matched on the original packet headers.

Deny

Deny is the default behavior for security rules.

Destination NAT

Destination NAT translates the public-facing IP to the DMZ server's private address, allowing inbound internet sessions to reach it. It rewrites the destination header on ingress, which is exactly what publishing an internal server requires.

Source Zone

Source Zone is a required match criterion in a QoS policy, identifying which ingress zone's traffic the class applies to. Alongside it, the policy also needs a matching application or service to classify traffic correctly.

App-ID

App-ID is a required match criterion in a QoS policy, letting the class target specific applications rather than ports. It pairs with Source Zone, so traffic from that zone running the identified application receives the defined bandwidth treatment.

Protocol and Port

An Application Override policy requires protocol and port because it bypasses App-ID signature inspection, forcing traffic to be identified solely by these Layer 4 attributes. Without both, the firewall cannot match the override rule to the session.

Application name

Application Override policies match traffic by application identity rather than port, so the application name is mandatory to identify which signature the firewall should apply. Without it, the policy cannot distinguish the target application from other traffic traversing the same ports.

Source and Destination Zone

Zones are required.

Source Zone

Zones are the first differentiator.

Destination Zone

Zones are essential for policy lookup.

Source Address

Addresses are evaluated after zones.

Configure the User-ID agent in the Device tab

Agent configuration is required.

Enable User Identification on the ingress interface

Interface setting is required.