Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 401

An administrator is investigating a log entry for a session that is allowed and has the end reason of aged-out.
Which two fields could help in determining if this is normal? (Choose two.)

Answer options

• A. IP Protocol
• B. Packets sent/received
• C. Decrypted
• D. Action

Correct answer: A, B

Explanation

The correct answers are A and B because the IP Protocol can indicate the type of traffic and whether it is expected, while Packets sent/received can show the volume of data transferred, helping to determine if the session was active enough to age out. The other options, Decrypted and Action, do not provide direct insights into the normality of the session's duration or behavior.