Free Palo Alto Networks NetSec-Analyst Exam Questions – 2025

Syslog is the industry-standard protocol for forwarding log messages from network devices to a central logging server, such as a Security Information and Event Management (SIEM) system. Palo Alto Networks firewalls utilize Log Forwarding profiles to direct various log types to a configured Syslog server. While TCP is available for guaranteed delivery, UDP is a very common transport mechanism due to its low overhead, making it efficient for the high volume of logs generated by a firewall. The firewall formats logs into standard Syslog messages, which are then ingested by the SIEM for correlation, analysis, and long-term storage.

B. SMTP: This protocol is used for sending email notifications, not for the continuous, high-volume log streaming required for SIEM integration.

C. SNMP: This is primarily used for network device monitoring and management, sending alerts (traps) rather than detailed, comprehensive log records.

D. FTP: This is a file transfer protocol. It is not a real-time log streaming protocol and is unsuitable for direct, continuous SIEM integration.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Configure Log Forwarding

" it explicitly details the process. "To forward logs to an external service

you must configure a connection between the firewall and a... Syslog server... A Syslog server is typically used to forward logs to a Security Information and Event Management (SIEM) system." The guide then provides instructions for creating a Syslog Server Profile

which includes options for UDP

TCP

and SSL transport. (Reference: Chapter: Monitor > Log Forwarding > Configure Log Forwarding).

2. Palo Alto Networks Documentation - Syslog Server Profile: "The firewall can forward logs to one or more Syslog servers. The firewall uses a Syslog server profile to specify the server IP address

protocol (UDP

TCP

or SSL)

and port number." This confirms Syslog as the designated protocol for this function. (Reference: Device > Server Profiles > Syslog).

SD-WAN functionality on Palo Alto Networks firewalls makes path selection decisions based on real-time network path quality. For applications like video streaming, which are highly sensitive to data loss, the packet loss rate is a critical performance metric. High packet loss directly results in a degraded user experience, causing video artifacts, buffering, and stuttering. An SD-WAN policy for video traffic would use a Path Quality Profile with a stringent packet loss threshold to ensure traffic is routed over the most stable and reliable link, thereby preserving the quality of the stream.

B. Session Timeout: This is a firewall state-table management parameter that determines how long an idle session is maintained; it is not a network path performance metric used for SD-WAN path selection.

C. CPU Utilization: This metric reflects the processing load on the firewall appliance itself, not the quality or performance of the external WAN links that SD-WAN evaluates for path selection.

D. URL Category: This is a traffic identification and policy enforcement criterion. It is used to classify the traffic (e.g., as "streaming-video") so a specific SD-WAN policy can be applied, but it is not the metric used to measure path health.

---

1. Palo Alto Networks

PAN-OS® SD-WAN Administrator’s Guide

Version 10.2

"Path Quality Measurement

" Page 12.

"The firewall measures path quality based on the latency

jitter

and packet loss of the traffic on the link. The firewall uses path quality monitoring to determine the health of the links to an SD-WAN device in a remote site." This document explicitly names packet loss as one of the three core metrics for measuring path quality.

2. Palo Alto Networks

PAN-OS® SD-WAN Administrator’s Guide

Version 10.2

"Configure a Path Quality Profile

" Page 41.

This section details the configuration steps for a Path Quality Profile

which includes setting specific thresholds for "Packet Loss Threshold (%)"

"Latency Threshold (ms)"

and "Jitter Threshold (ms)". This confirms that packet loss is a primary

configurable metric used by the system to make path-forwarding decisions.

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 7

"Multimedia Networking."

This standard university textbook explains the network requirements for multimedia applications. In sections discussing streaming video (e.g.

Section 7.2)

it is established that packet loss is a major impairment

as lost packets can result in missing frames or portions of frames

leading to significant visual degradation. This academic source validates the criticality of minimizing packet loss for video applications.

In the Palo Alto Networks firewall's packet processing sequence (the slow path), a session is first created based on Layer 3/4 information (IP addresses and ports). During this initial security policy lookup, the firewall consults its IP-address-to-user mapping table to identify the user (User-ID). If a potential rule matches based on this known information (zone, IP, port, and user), the session is established. As subsequent packets flow through the session, the App-ID engine inspects the payload to identify the specific application. Once the application is identified, the security policy is re-evaluated to ensure the identified application is consistent with the matched rule. This confirms the App-ID check occurs after the initial user mapping and rule match.

A. User-ID is checked after App-ID

This is incorrect. User-ID is derived from the source IP address, which is available immediately and checked against the mapping table during the initial policy lookup, before the application can be identified from the traffic payload.

C. User-ID is ignored if App-ID matches

This is incorrect. If a security policy rule specifies criteria for both User-ID and App-ID, both conditions must be met for the rule to be enforced on the traffic.

D. Both are simultaneously ignored during first packet

This is incorrect. The firewall does not "ignore" these criteria. It immediately begins the process of identification, using the source IP to look up the user mapping and allowing the session to proceed so App-ID can identify the application.

---

1. Palo Alto Networks

"PAN-OS® Administrator’s Guide 10.2" (December 2021).

Section: Packet Flow Sequence in PAN-OS > Slow Path.

The documentation outlines the packet flow

showing that during the initial session setup (slow path)

a security policy lookup is performed. This lookup uses the source IP to query the User-ID mapping. Application identification occurs after the session is established and traffic begins to flow

which may trigger a policy re-match. This supports that App-ID is determined after the initial user mapping and rule match.

2. Palo Alto Networks

"User-ID™ Technology Overview" (2018).

Page 4

Section: "User-ID and Security Policy Enforcement".

The document states

"When a user sends traffic through the firewall

the firewall checks its IP address-to-user mapping table... The firewall then checks the security policy to see if there is a rule that matches the user and the other traffic attributes (source/destination zone

source/destination address

and application)." This confirms user mapping is part of the initial policy check.

3. Palo Alto Networks

"App-ID™ Technology Overview" (2018).

Page 3

Section: "How App-ID Works".

This resource explains that App-ID uses multiple techniques

including signature analysis of the traffic payload

which requires multiple packets. It states

"Once the application is identified

the security policy is applied." This demonstrates that the definitive App-ID check follows the initial session setup.

To enforce GDPR compliance by preventing the upload of sensitive data, you must configure a Data Filtering profile. This profile inspects traffic for specific data patterns. Palo Alto Networks provides two primary methods for this:

1. Predefined data patterns: These are built-in patterns for common sensitive information types, such as EU national identity numbers, financial data (IBANs), and other personally identifiable information (PII) covered under GDPR.

2. Custom regex expressions: For organization-specific or unique data formats not covered by predefined patterns, you can create custom data patterns using regular expressions (regex) to match and identify the specific data you need to protect.

C. IoT security profiles: IoT Security profiles are designed to identify, classify, and enforce policy on Internet of Things (IoT) devices, not to inspect file content for sensitive data.

D. Antivirus signatures: Antivirus signatures are used to detect and block malware based on known malicious code patterns, not to identify and prevent the exfiltration of sensitive personal data.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2:

Section: Objects > Security Profiles > Data Filtering

Content: This section details the configuration of Data Filtering profiles. It explicitly states

"For each data filtering profile

you can specify the action to take when the firewall detects a match. You can filter based on predefined data patterns

or you can create custom data patterns..." This directly supports the use of both predefined and custom patterns (A and B).

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2:

Section: Objects > Custom Objects > Data Patterns > Create a Custom Data Pattern Object

Content: This section explains how to create custom patterns. It states

"You can create custom data patterns using regular expressions (regex) to define patterns for sensitive information that is unique to your organization..." This confirms that custom regex expressions (B) are a core component of the data filtering feature.

3. Palo Alto Networks Datasheet: Enterprise Data Loss Prevention (DLP):

Section: Key Capabilities > Detect Sensitive Data with High Accuracy

Content: The document states

"Enterprise DLP comes with a comprehensive library of predefined data patterns... For proprietary and unique data

you can easily create custom data patterns using regular expressions (regex) and validate them with the built-in regex validator." This source validates both predefined patterns (A) and custom regex (B) as the primary methods for data detection.

Palo Alto Networks SD-WAN (Prisma SD-WAN) improves the performance of SaaS applications like Office 365 by using application-aware routing. It continuously monitors the performance metrics of all available network paths, including latency, jitter, and packet loss. Based on predefined application policies (App-SLAs), the SD-WAN solution dynamically steers traffic for a specific application onto the path that currently offers the best performance. This ensures a consistent and high-quality user experience by avoiding network congestion and suboptimal routing, which is critical for latency-sensitive SaaS applications.

A. Encrypts all SaaS traffic: SaaS traffic is typically already encrypted by the application provider using TLS/SSL. While SD-WAN encrypts its overlay tunnels, this is not its unique or primary benefit for SaaS.

C. Blocks malicious domains automatically: This is a function of a security service, such as DNS Security or a Next-Generation Firewall (NGFW), not a core networking capability of SD-WAN itself.

D. Reduces the need for antivirus scanning: SD-WAN is a network routing and optimization technology. It does not perform file inspection and therefore does not replace or reduce the need for antivirus solutions.

---

1. Palo Alto Networks. (2023). Prisma SD-WAN Datasheet.

Page 2

"Key Features

" Section: "Application-defined SD-WAN policies": "Prisma SD-WAN enables you to create application-based policies that consider application performance

security

and link cost. This allows you to steer traffic to the preferred path to meet application SLAs." This directly supports the concept of routing based on application performance metrics.

2. Palo Alto Networks. (2022). Prisma SD-WAN At-a-Glance.

Page 1

Section: "Improve End-User Experience": "Improve end-user experience for cloud and SaaS applications by leveraging application-defined policies that steer traffic based on real-time link performance." This statement explicitly links SD-WAN's performance-based routing to the benefit for SaaS applications.

3. Palo Alto Networks. (2023). Prisma SD-WAN Design Guide.

Section: "Application Path and QoS Policy

" Subsection: "Path Selection": The guide details how policies are configured to measure path quality (MOS-v

latency

jitter

loss) and select the best-performing path for specific applications to ensure the application performance requirements are met. This technical detail underpins the functionality described in the correct answer.

Palo Alto Networks PAN-OS provides robust decryption capabilities to inspect encrypted traffic for threats. The two primary modes for handling SSL/TLS traffic are SSL Forward Proxy and SSL Inbound Inspection.

SSL Forward Proxy decrypts outbound traffic from internal clients to external web servers. The firewall acts as a trusted man-in-the-middle, allowing inspection of user traffic for malware, command-and-control, and data exfiltration.

SSL Inbound Inspection decrypts inbound traffic destined for an organization's internal servers (e.g., web servers). This allows the firewall to inspect traffic for attacks or malware before it reaches the protected server.

These two methods provide comprehensive visibility and control over encrypted traffic entering and leaving the network.

C. GRE Decryption:

GRE is a tunneling protocol, not an encryption protocol. PAN-OS inspects traffic within GRE tunnels but does not perform "GRE decryption."

D. SSH Proxy:

While PAN-OS does support SSH Proxy to decrypt and inspect SSH traffic, SSL Forward Proxy and Inbound Inspection are the two fundamental modes for the more prevalent SSL/TLS protocol.

1. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Decryption Concepts". This section explicitly lists and describes SSL Forward Proxy and SSL Inbound Inspection as key decryption deployment modes.

2. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSL Forward Proxy". This chapter details the configuration and use case for decrypting outbound client traffic.

3. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSL Inbound Inspection". This chapter details the configuration for decrypting traffic destined for an internal server.

4. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide

Version 10.2. "Configure SSH Proxy". This section confirms SSH Proxy is a supported feature

distinct from the primary SSL/TLS decryption modes.

A DoS Protection Profile is the specific Palo Alto Networks feature designed to mitigate denial-of-service attacks, including volumetric floods. This profile protects network resources by monitoring the rate of new sessions for various protocols (e.g., TCP-SYN, UDP, ICMP). When traffic rates exceed a configured threshold, indicating a potential flood attack, the firewall can take protective actions such as dropping packets. This directly addresses the requirement to protect a public web server from being overwhelmed by high-volume, malicious traffic.

B. Data Filtering Profile: This profile is used for Data Loss Prevention (DLP) to prevent sensitive information, such as credit card numbers or social security numbers, from leaving the network.

C. Antivirus Profile: This profile inspects traffic for known malware, viruses, and spyware within file transfers and application content. It does not protect against network-layer flood attacks.

D. SD-WAN Policy: This is used for traffic engineering and path selection across multiple WAN links to optimize application performance and availability, not for mitigating security attacks like DoS floods.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "DoS Protection." In the "DoS Protection Overview" section

it states: "DoS protection defends your network against flooding of new sessions that can overwhelm your server’s ability to respond to new connection requests... Flood protection helps protect your network from SYN

UDP

ICMP

and other IP-based flooding attacks."

2. Palo Alto Networks. (2023). Technical Documentation: DoS Protection Profiles. "Flood Protection" section. This document details the mechanism: "Flood protection detects and prevents traffic that floods the firewall or specific hosts... The firewall measures traffic in connections-per-second (CPS) and drops connections that exceed the configured Activate Rate threshold."

3. Palo Alto Networks. (2021). Palo Alto Networks Certified Network Security Analyst (PCNSA) Study Guide. "Module 5: Securing Traffic with Security Profiles." This official study guide describes DoS Protection as the feature to "protect against common flood attacks." It contrasts this with other profiles like Antivirus (for malware) and Data Filtering (for DLP).

SYN Cookies are a stateless mechanism used to mitigate TCP SYN flood attacks. When a server or firewall receives a SYN request, instead of allocating memory for a new connection (which is what a SYN flood exploits), it sends back a SYN-ACK packet with a specially crafted sequence number (the "cookie"). This cookie contains encoded information about the initial SYN request. The firewall then discards the SYN request state. If a legitimate client responds with an ACK, the firewall can validate the cookie from the ACK packet and establish the connection, all without having to maintain a large state table of half-open connections, thus preventing server resource exhaustion.

B. Application Override: This feature is used to force traffic classification to a specific application, bypassing App-ID. It does not mitigate network-layer DoS attacks.

C. Antivirus Signature Matching: This security profile inspects traffic for known malware signatures. A SYN flood attack does not involve malware and is not detected by this mechanism.

D. File Blocking: This security profile prevents the transfer of specific file types. It operates at the application layer and is irrelevant to TCP handshake-level attacks.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on DoS Protection

it states

"For a SYN Flood attack

the firewall can use SYN cookies to validate that a client is legitimate before it allows a session to be established." This directly confirms the use of SYN cookies to handle SYN floods.

Reference: Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. "DoS Protection Concepts

" section "SYN Flood Protection."

2. Internet Engineering Task Force (IETF) RFC 4987: This document provides a detailed technical explanation of SYN flood attacks and mitigation techniques. It describes SYN cookies as a primary defense.

Reference: Eddy

W. (2007). TCP SYN Flooding Attacks and Common Mitigations. RFC 4987. Section 3.2

"SYN Cookies." DOI: 10.17487/RFC4987.

3. Stanford University CS 155 Courseware: University-level network security courses cover SYN floods and SYN cookies as fundamental concepts.

Reference: Boneh

D. (n.d.). CS 155: Computer and Network Security. Stanford University. Lecture notes on "Network Security

" section on "Denial of Service Attacks." (Specific course materials often detail how SYN cookies create a stateless initial handshake to prevent resource depletion).

The Palo Alto Networks User-ID feature can obtain user-to-IP address mappings from several sources to enforce user-based policies.

GlobalProtect: When a user authenticates to a GlobalProtect portal or gateway, the firewall directly learns the user's identity and the IP address assigned to their endpoint, creating a mapping.

Syslog Parsing: The firewall or User-ID agent can act as a syslog listener. When AAA servers (like RADIUS) send syslog messages containing successful user authentication events, the firewall parses these messages to extract the username and associated IP address.

XML API: The User-ID XML API allows external systems, such as third-party identity providers or custom scripts, to directly push user mapping information to the firewall. This is a direct and programmatic method for creating mappings.

C. URL Filtering logs: These logs are a consumer of User-ID information, not a source. They record user and IP data for traffic that has already been identified using a pre-existing mapping.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "User-ID Concepts > Methods for Mapping Users to IP Addresses". This section explicitly lists GlobalProtect

Syslog

and the XML API as distinct methods the firewall uses to map users to IP addresses.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Configure User-ID to Monitor a Syslog Sender for User Mappings". This chapter details the configuration for using syslog messages from external devices like AAA servers as a source for user mappings.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Send User Mappings to the Firewall Using the XML API". This section provides the technical details for how external systems can use the XML API to directly submit user-to-IP address mappings to the firewall.

4. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "GlobalProtect". The documentation explains that upon successful user authentication

GlobalProtect registers the user and their assigned IP address with the firewall for policy enforcement.

A Security Profile Group is a feature in PAN-OS that bundles multiple Security Profiles into a single object for streamlined application to Security policy rules. The profiles that can be included are Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis. This grouping simplifies administration by allowing a single, consistent set of security inspections to be applied to traffic matching a policy rule, rather than attaching each profile individually. Antivirus and Anti-Spyware are both standard Security Profiles that can be included in such a group.

B. Application Override: This is a distinct policy type, configured separately from Security Profiles, used to reclassify traffic to a specific application.

D. Authentication Policy: This is a separate policy type used to enforce user authentication for accessing network resources, not a security inspection profile.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "Objects > Security Profile Groups". The documentation states

"A Security Profile Group is a set of Security Profiles that you can apply to a Security policy rule... The group can include one of each type of security profile: Antivirus

Anti-Spyware

Vulnerability Protection

URL Filtering

File Blocking

and WildFire Analysis." This explicitly includes Antivirus and Anti-Spyware and excludes other policy types.

Security Profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) are enforced by the Content-ID engine. The firewall's packet processing logic, often called the "Life of a Packet," dictates that Content-ID inspection occurs only after a session has been created, a security policy rule has been matched, and the application has been identified by App-ID. The firewall must first identify the application to understand the context of the data stream before it can apply the appropriate content inspection profiles to scan for threats within that specific application's payload.

A. After routing decision: The routing decision is made early in the packet flow to determine the egress interface, well before the application is fully identified and its content is inspected for threats.

B. Before session creation: Security Profile inspection is performed on an established session's traffic. A session must be created and matched to a security policy before any content inspection can occur.

D. During NAT translation: Network Address Translation (NAT) is a separate process that modifies IP addresses and ports. It occurs at different stages of the packet flow but is distinct from the content inspection stage where security profiles are applied.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0.

Section: Networking > Packet Flow Sequence in PAN-OS

The official documentation provides a detailed diagram and description of the packet flow. It explicitly shows that after the "Security Policy Lookup" and "Application Identification (App-ID)" stages

the "Content Inspection" stage occurs. This stage is where Security Profiles are applied to the traffic.

2. Palo Alto Networks Knowledge Base. (2023). Life of a Packet.

Document ID: 212223

This article details the two primary processing paths: slow path (session setup) and fast path (forwarding). In the slow path description

it clearly places "Content-ID" (which includes Security Profile enforcement) after "App-ID" has successfully identified the application and the security policy has allowed the session.

3. Palo Alto Networks. (2021). Palo Alto Networks Certified Network Security Analyst (PCNSA) Study Guide.

Chapter: 2

The Anatomy of a Cyberattack

Section: Content-ID

The official study guide explains

"After the application is identified

the firewall can apply the security profile... The firewall uses the security profiles to scan the allowed applications for threats." This confirms that App-ID is a prerequisite for applying Security Profiles via Content-ID.

The Data Filtering profile is the specific security feature within Palo Alto Networks firewalls designed for Data Loss Prevention (DLP). It inspects network traffic for sensitive data patterns, such as credit card numbers, social security numbers, and custom-defined patterns. When a match is found in unencrypted traffic, the profile can be configured to block the transmission, thereby preventing the exfiltration of sensitive information in clear text. This directly addresses the requirement of the question.

A. Antivirus Profile: This profile is designed to detect and block malware, such as viruses, worms, and trojans. It does not inspect traffic for sensitive data patterns.

C. Decryption Profile: This profile enables the firewall to inspect encrypted (SSL/TLS) traffic. While necessary for data filtering to work on encrypted flows, it does not perform the data inspection itself.

D. File Blocking Profile: This profile blocks the transfer of files based on their type (e.g., .exe, .pdf) or name, not on the specific sensitive content within the files.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Data Filtering." In the section "Data Filtering Overview

" it states: "Data filtering profiles scan for sensitive data

such as credit card and social security numbers

and custom data patterns in traffic... When the firewall detects a match

it can block the data."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Security Profiles." This chapter provides an overview of all security profiles. The description for Data Filtering confirms its role in preventing sensitive data loss

contrasting it with the roles of Antivirus (malware prevention) and File Blocking (file type control).

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Decryption." In the section "Decryption Overview

" it is explained that decryption is a prerequisite for content inspection: "To gain visibility into and control over applications

users

and content

you must first decrypt the traffic." This clarifies that the Decryption Profile enables inspection but does not perform it.

Palo Alto Networks IoT Security is a cloud-based service designed to provide comprehensive visibility and threat prevention for IoT devices. Its primary functions are to first discover and identify all connected IoT, IoMT, and OT devices, including unmanaged ones, providing a complete inventory. Secondly, it analyzes device behavior to create a baseline and then recommends and enforces security policies. An IoT Security profile, when applied to a security policy rule, leverages this intelligence to block anomalous and malicious traffic, preventing threats and unauthorized activities specific to the identified IoT devices.

C. Encrypting IoT traffic: IoT Security profiles focus on device identification and threat prevention, not on encrypting data-in-transit. Encryption is typically managed by other features like VPNs (IPsec/SSL).

D. Providing IoT patch management: While the service identifies vulnerabilities that require patching, it does not deploy patches. It prevents exploitation of these vulnerabilities, but the patching process itself is an external function.

1. Palo Alto Networks IoT Security Administrator's Guide. In the "What is IoT Security?" section

it states

"Palo Alto Networks IoT Security is a cloud-based security service for the Next-Generation Firewall that discovers and assesses the risk of all Internet of Things (IoT)... devices on your network." This directly supports the identification of devices (A).

2. Palo Alto Networks IoT Security Administrator's Guide. The "Security Policy Rule Recommendations for IoT Devices" section details how the service recommends policies. It states

"When you enforce the recommended policy

the firewall blocks all anomalous and malicious behaviors

preventing threats and protecting your devices and network." This supports the blocking of malicious traffic (B).

3. Palo Alto Networks Live Community

"Getting Started: IoT Security." This resource outlines the workflow: "Step 1: Activate IoT Security

" "Step 2: Discover IoT Devices

" and "Step 3: View IoT Devices and Vulnerabilities

" followed by policy creation. This confirms the primary roles are discovery (A) and subsequent threat prevention through policy (B)

not encryption or patching.

A Log Forwarding Profile is the specific PAN-OS feature used to export log data from a Palo Alto Networks firewall to an external logging system. Administrators configure these profiles to specify which log types (e.g., traffic, threat, URL filtering) and severity levels are sent to designated destinations. For integration with a Security Information and Event Management (SIEM) solution, logs are typically forwarded using a Syslog server profile, which is then referenced within the Log Forwarding Profile. This profile is subsequently attached to security policy rules to enable log export for matching traffic.

B. Decryption Profile: This profile is used to configure the parameters for decrypting and inspecting SSL/TLS encrypted traffic, not for forwarding logs.

C. Data Filtering Profile: This security profile is designed to detect and prevent the transfer of sensitive information, such as credit card numbers or custom data patterns.

D. Custom Object: This is a generic term. While a Log Forwarding Profile is a type of object, it is not the specific feature name for this function.

1. Palo Alto Networks PAN-OS® Administrator’s Guide (Version 10.2): In the section "Monitor > Log Forwarding

" the guide states

"To export logs from the firewall or Panorama

you must configure log forwarding. Log forwarding is the process of creating a filter that specifies the logs you want to export and the destination to which you want to send them... You can forward logs to a SIEM..."

2. Palo Alto Networks TechDocs - Objects > Log Forwarding: This document defines the object: "A log forwarding profile is a configuration that you can apply to a security policy rule to send the logs that the rule generates to an external server." It details the process of creating the profile and linking it to server profiles (like Syslog for SIEMs).

3. Palo Alto Networks TechDocs - Configure Log Forwarding: This guide outlines the workflow: "Create a server profile for each external service to which you want to forward logs... Create a Log Forwarding profile... Assign the Log Forwarding profile to security rules..." This explicitly links the profile to the action of sending logs to external services like a SIEM.

Palo Alto Networks IoT Security is a cloud-delivered subscription service that integrates directly with the Device-ID feature on PAN-OS firewalls. Device-ID is responsible for discovering and identifying devices on the network by collecting their attributes from network traffic. The IoT Security service enhances this process by applying machine learning to the collected telemetry, providing highly accurate device classification, risk assessment, and behavioral analysis. The resulting enriched device information is synchronized back to the firewall's Device-ID database. IoT Security profiles, configured within security policies, then leverage this detailed Device-ID context to enforce granular security rules and control access for all connected IoT, IoMT, and OT devices.

A. App-ID identifies and classifies network traffic based on the application, not the device itself. It is used in policy rules but is distinct from device classification.

C. GlobalProtect is a secure remote access solution that extends firewall policies to mobile users and endpoints, not a service for classifying headless IoT devices on the internal network.

D. Cortex Data Lake is a cloud-based logging repository. While it stores logs generated by IoT Security, it is the destination for data, not the classification service itself.

1. Palo Alto Networks IoT Security Administrator's Guide: In the "IoT Security Overview" section

it states

"IoT Security is a cloud-based security service that works with your next-generation firewalls and Device-ID to discover and secure all the unmanaged internet of things (IoT)

internet of medical things (IoMT)

and operational technology (OT) devices on your network." This establishes the fundamental link between IoT Security and Device-ID for discovery and classification.

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: The "Device-ID Overview" section explains

"Device-ID enables the firewall to identify and classify devices... When you have an IoT Security license

the firewall forwards device information to the IoT Security portal for analysis... The portal then sends enriched device details back to the firewall and populates the local Device-ID cache." This confirms that Device-ID is the on-firewall component that IoT Security integrates with and enhances.

3. Palo Alto Networks

"Solution Brief: Palo Alto Networks IoT Security": This document outlines the architecture

stating

"The IoT Security subscription leverages and enhances our App-ID™ and Device-ID™ technologies on our Next-Generation Firewalls (NGFWs) to provide you with the industry’s most comprehensive IoT security solution." It explicitly names Device-ID as a core technology leveraged for its functionality.