Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 80

An administrator wishes to follow best practices for logging traffic that traverses the firewall.
Which log setting is correct?

Answer options

• A. Enable Log at Session Start
• B. Disable all logging
• C. Enable Log at both Session Start and End
• D. Enable Log at Session End

Correct answer: D

Explanation

Enabling logging at the Session End (option D) is considered a best practice as it captures the complete session details, allowing for more comprehensive analysis. Options A and C do not provide complete information since they log only at the start or both ends, which may miss crucial events. Option B is incorrect as disabling all logging does not align with any best practices.