Palo Alto Networks Exam NGFW-Engineer Topic 2 Question 7 Discussion

Actual exam question for Palo Alto Networks's NGFW-Engineer exam

Question #: 7
Topic #: 2

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

AFlood Protection

BProtocol Protection

CPacket-Based Attack Protection

DReconnaissance Protection

Show Suggested Answer

Suggested Answer: B

In the context of a Zone Protection profile, Protocol Protection is the section used to configure protections against activities such as spoofed IP addresses and split handshake session establishment attempts. These types of attacks typically involve manipulating protocol behaviors, such as IP address spoofing or session hijacking, and are mitigated by the Protocol Protection settings.

by Shawnna at May 04, 2025, 08:54 PM

Limited Time Offer

25%

Off

Get Premium NGFW-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Shawnda

6 days ago

I agree with Heike, because protecting against spoofed IP addresses and split handshake attempts sounds like packet-based attacks.

upvoted 0 times

...

Amie

7 days ago

Haha, this question is a real 'split handshake' between the options. But I think C is the way to go - can't let those spoofed IPs slip through the cracks!

upvoted 0 times

...

Heike

11 days ago

I think the answer is C) Packet-Based Attack Protection.

upvoted 0 times

...

Corinne

16 days ago

Definitely C, Packet-Based Attack Protection. Gotta love those packet-level defenses, am I right? Keeps the bad guys out and the network secure. *flexes*

upvoted 0 times

...

Harris

27 days ago

Ooh, this is a tricky one. I'm going to go with B, Protocol Protection. Seems like the NGFW would need to analyze the protocol behavior to catch those shenanigans.

upvoted 0 times

Doretha

6 days ago

A) Flood Protection

upvoted 0 times

...

Otis

1 months ago

Hmm, I was leaning towards option D, Reconnaissance Protection. Detecting attempts to map your network and open ports sounds like it would cover those types of attacks, no?

upvoted 0 times

...

Delsie

1 months ago

I think option C is the correct answer. Protecting against spoofed IPs and split handshakes seems like a packet-based attack, so that makes the most sense to me.

upvoted 0 times

Monroe

15 days ago

Yes, option C, Packet-Based Attack Protection, is the correct choice for protecting against those activities.

upvoted 0 times

...

Lorrine

21 days ago

I agree, protecting against spoofed IPs and split handshakes does sound like a packet-based attack.

upvoted 0 times

...

Dick

28 days ago

I think option C is the correct answer.

upvoted 0 times

...