Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 168

All users from the internal zone must be allowed only HTTP access to a server in the DMZ zone.

Complete the empty field in the Security policy using an application object to permit only this type of access.

Source Zone: Internal -

Destination Zone: DMZ Zone -
Application: __________

Service: application-default -
Action: allow

Answer options

• A. Application = "any"
• B. Application = "web-browsing"
• C. Application = "ssl"
• D. Application = "http"

Correct answer: B

Explanation

The correct answer is B, 'web-browsing', as it corresponds to HTTP traffic, allowing access to web services. The other options are incorrect because 'any' allows all types of traffic, 'ssl' is for encrypted traffic, and 'http' does not match the application object format required in the policy.