PCNSE Exam - Question 378

Question

A firewall administrator wants to have visibility on one segment of the company network. The traffic on the segment is routed on the Backbone switch. The administrator is planning to apply Security rules on segment X after getting the visibility.

There is already a PAN-OS firewall used in L3 mode as an internet gateway, and there are enough system resources to get extra traffic on the firewall. The administrator needs to complete this operation with minimum service interruptions and without making any IP changes.

What is the best option for the administrator to take?

Examice · Accepted Answer

To achieve visibility on segment X while also planning to apply security rules later, configuring vwire interfaces on the firewall is the best option. Vwire mode allows for the inspection and enforcement of security policies without requiring any changes to the IP configurations. It also minimizes service interruptions since the traffic will simply pass through the firewall, maintaining the existing network routing and structure. This makes it the ideal choice for the administrator's requirements.

scally · Answer

The correct answer is C. As it specifically states in the question that security rules will be applied, VWire is the only method that allows this without making any IP address changes.

nose999 · Answer

Maybe C as security rules will also be applied later

west33637 · Answer

The answer is A. somethings to note - the question says the admin is looking for visibility, with minimal disruption and no IP changes. The firewall is already in L3 mode and acting as a layer internet gateway. Also to note, the question says that the administrator is looking to add security rules AFTER he has gained some visibility. Tap mode is designed specifically for what this question is asking - see the documentation - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/tap-interfaces

melmokad · Answer

to apply Security rules on segment X >> C

dgonz · Answer

A - Tap 
admin just wants to have traffic visibility.

dorf05 · Answer

Key word== The administrator is planning to apply Security rules on segment X after getting the visibility..... and  you  cannot apply security rules on segment X using a TAP mode.

DrNick0 · Answer

Since they want security policies TAP is not an option. TAP is no touch, only see. vwire can 
inspect traffic, security policies, vlans ect. C is correct

happyism · Answer

VirtualWire:

A virtual wire deployment simplifies firewall installation and configuration because you can insert the firewall
into an existing topology without assigning MAC or IP addresses to the interfaces, redesigning the network,
or reconfiguring surrounding network devices. The virtual wire supports blocking or allowing traffic based on
virtual LAN (VLAN) tags. It also supports Security policy rules.

mic_mic · Answer

The administrator needs to complete this operation with minimum service interruptions and without making any IP changes. C is also working, but dus not give  minimum service interruptions.  The administrator is planning to apply Security rules on segment X after getting the visibility. (then he must switch from TAB to VWIRE)   Indeed the question leaves room for speculation
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/configure-interfaces/tap-interfaces

Marbot · Answer

Tap Interface is enough for Planning stage, administrator can create policy in preparation from TAP traffic.
"In addition, when in tap mode, the firewall can also identify threats on your network."
Reference:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/tap-interfaces

certprep2021 · Answer

The administrator wants to have visibility over the network with minimal disruption
So obviously TAP interface gives visibility without interruption

Frightened_Acrobat · Answer

I have to agree with the A team. Here's why.
1) Keyword 'visibility.' This is used to describe the function of the tap interface.
2) Inference is made to the backbone switch, which could easily be tapped.
3) Won't be doing security until 'after' getting visibility.
4) Zero service disruption.
5) Security can be done later on a vwire interface on same firewall.

sov4 · Answer

Gotta be C. The traffic isnt on the firewall yet and so a tap wont help. Only a virtual-wire will allow for visibility, security policy, no IP changes, and low down-time.

piipo · Answer

apply Security rules

franko_72 · Answer

In the exam, July 2023.

34f7d3a · Answer

the answer is A -  A firewall administrator wants to have visibility on one segment of the company network. Guys why don’t you read with understanding?

juan_L · Answer

Careful ! A is correct, vwire must connect 2 interfaces, and requires a topology change. Only  visibility is required for first step. Even more, PAN deployment BPA assumes TAP as first approach, just for gather information and plan future topology and security changes.

TAKUM1y · Answer

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure-interfaces/virtual-wire-interfaces

DLRG · Answer

I think: C:
Keep in mind, however, because the traffic is not running through the firewall when in tap mode it cannot take any action on the traffic, such as blocking traffic with threats or applying QoS traffic control.

ruben_castro81 · Answer

The key word is "after". This question mention: "The administrator is planning to apply Security rules on segment X AFTER getting the visibility"... I think that TAP is the best option

ruben_castro81 · Answer

The key word is "after". This question mention: "The administrator is planning to apply Security rules on segment X AFTER getting the visibility"... I think that TAP is the best option

ChiaPet75 · Answer

I'm on the "C" team. At first I thought the Admin could just "TAP" the backbone switch for visibility, but since the goal is to apply Security rules on the segment that is being monitored, vWire makes the most sense.

electro165 · Answer

TAP Interface: A TAP interface allows you to monitor network traffic without disrupting the existing traffic flow. It operates in a passive mode, where it copies traffic for analysis without impacting the original traffic. This means you can gain visibility into segment X without changing the routing or IP configurations.

Minimum Service Interruptions: Since the TAP interface is passive and does not actively participate in routing or affecting traffic, it minimizes service interruptions. It won't introduce any routing changes or disruptions to segment X.

No IP Changes: The administrator wants to avoid making IP changes, and configuring a TAP interface allows you to do just that. It won't require any IP address changes or reconfiguration of the existing network.

Metgatz · Answer

C - The administrator is planning to apply Security rules on segment X after getting the visibility.

Marshpillowz · Answer

I think C

scanossa · Answer

It needs to apply security policies which TAP can not to so it's C.

0d2fdfa · Answer

security rules will be applied but this is only to monitor the traffic. The least intrusive way is TAP mode.

Alquicerm · Answer

Because of security rules creation it needs to be VWIRE. TAP will gain visibility but you will not be able to create security rules.

CarlosDV06 · Answer

Well, he definitely could use A to monitor the traffic, but you would have to reconfigure the fw to use the vwire to apply security changes. Still you can have the vwire and an initial allow rule for all of the X segment traffic and there you get to have your visibility without disrupting the network.

ALCOSTA35 · Answer

A is wrong because Tap does not allow Sec Pol to be applied to the FW. Only option is C (VWire).

PCNSE Exam - Question 378

Discussion