Palo Alto Networks Certified Network Security Administrator (PCNSA)Palo Alto Networks Security PlatformEasy
A security analyst is investigating a potential data exfiltration incident. To gain visibility into all network traffic, including internal server-to-server communications, without impacting performance or altering the network topology, the analyst decides to deploy a Palo Alto Networks firewall as a passive monitoring device. Which deployment mode should be used?
- ATap Mode
- BLayer 3 Mode
- CNAT Mode
- DVirtual Wire Mode
Show answer & explanationAnswer & explanation
Correct answer: A. Tap Mode
Tap mode allows the firewall to passively monitor network traffic without being in the data path, ensuring no impact on performance or network topology changes. It's ideal for gaining visibility and analysis.
Why the other options are wrong
- B. Layer 3 mode actively routes traffic and requires IP configuration, impacting the network.
- C. NAT mode is a Layer 3 function and not suitable for passive monitoring.
- D. Virtual Wire mode is in the data path and actively enforces policies, potentially impacting performance.
Tap Mode
Tap mode allows a Palo Alto Networks firewall to passively monitor network traffic by receiving a mirrored copy of data, providing visibility for analysis without actively enforcing policies or affecting network performance.
- Passive monitoring only
- No impact on network performance or topology
- Ideal for traffic visibility, analysis, and forensics
- Does not actively block or modify traffic
Memory trick: Tap into the stream, just to watch, not to block.