Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 251

An administrator would like to follow the best-practice approach to log the traffic that traverses the firewall.

What action should they take?

Answer options

• A. Enable both Log at Session Start and Log at Session End.
• B. Enable Log at Session End.
• C. Enable Log at Session Start.
• D. Disable all logging options.

Correct answer: B

Explanation

Enabling Log at Session End captures the complete information about the session, which is essential for effective traffic logging. While logging at both the start and end can provide additional details, it may result in unnecessary data and performance impacts. Logging only at the session start would miss crucial information about session termination.