Palo Alto Networks firewalls provide two primary mechanisms for configuring SYN flood protection thresholds. A Zone Protection profile is applied to an entire ingress zone to protect it from various flood attacks, including SYN floods. It uses thresholds (Alarm, Activate, Maximum) based on connections per second (CPS) to trigger mitigation actions.

For more granular protection of specific, critical resources (like a web server), a DoS Protection profile is used. This profile, applied via a DoS Protection policy rule, also contains configurable SYN flood thresholds to protect specific destination IP addresses or subnets from being overwhelmed. Both profiles are where the actual rate-limiting thresholds are defined.

A. QoS profile: This is incorrect. Quality of Service (QoS) profiles are used for bandwidth management and traffic prioritization, not for configuring security thresholds for DoS attacks.

D. DoS Protection policy: This is incorrect. The DoS Protection policy is a rule that applies a DoS Protection profile to specific traffic; the thresholds themselves are configured within the profile, not the policy.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Zone Protection and DoS Protection

" Section: "Configure Flood Protection." This section details the configuration of SYN flood protection within a Zone Protection Profile

stating

"For SYN

UDP

ICMP

ICMPv6

and Other IP floods

you can set thresholds for the rate of new sessions from a source or to a destination." It shows the fields for Alarm Rate

Activate Rate

and Maximum Rate.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policies

" Chapter: "DoS Protection

" Section: "DoS Protection Profiles and Policy Rules." This document explains

"A DoS Protection profile is a set of options that protects a group of targeted devices... from session-based DoS attacks." It further details configuring the profile: "For SYN Flood

select the Flood Protection tab... and specify the Alarm Rate

Activate Rate

and Maximum Rate..."

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policies

" Chapter: "DoS Protection

" Section: "DoS Protection Profiles and Policy Rules." This source clarifies the relationship between the policy and profile: "A DoS Protection policy rule specifies the traffic that the DoS Protection profile protects... The policy rule does not define what to protect against; the profile does." This confirms that the thresholds are in the profile (B)

not the policy (D).