Palo Alto Networks NGFW Engineer — Question 71

An organization's Security policy states that for all outbound web traffic, the TCP session to the external web server must be established by the firewall, not the user's workstation. This requires configuring user web browsers to point to the firewall. Authentication is also required.

Which solution on a PA-Series firewall meets these specific needs?

Answer options

• A. Transparent proxy
• B. Explicit proxy
• C. GlobalProtect with User-ID
• D. Decryption policy with Authentication Portal

Correct answer: B

Explanation

The correct option is B, Explicit proxy, because it allows the firewall to establish TCP sessions for outbound web traffic, fulfilling the organization's requirements. Option A, Transparent proxy, does not require user browser configuration to point to the firewall. Options C and D do not specifically address the need for browser configuration and session initiation by the firewall.