Palo Alto Networks Certified Network Security Engineer (PCNSE) — Question 13

A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.
Which option will protect the individual servers?

Answer options

• A. Enable packet buffer protection on the Zone Protection Profile.
• B. Apply an Anti-Spyware Profile with DNS sinkholing.
• C. Use the DNS App-ID with application-default.
• D. Apply a classified DoS Protection Profile.

Correct answer: D

Explanation

The correct answer is D because a classified DoS Protection Profile specifically targets and mitigates denial-of-service attacks, directly addressing resource exhaustion. The other options may offer some level of protection, but they do not focus primarily on preventing resource depletion from DoS attacks on the individual servers.