Palo Alto Networks Certified Network Security Administrator (PCNSA)Monitoring and ReportingHard
A network administrator is creating a custom report to show all sessions where the 'bytes_sent' value exceeds 1 GB for any single session within the last week. The report needs to display the source IP, destination IP, application, and the total bytes sent for these large sessions. Which attribute should be used in the filter criteria for this custom report?
- A(bytes_sent gt 1073741824)
- B(bytes_received gt 1000000000)
- C(bytes_total gt 1000000000)
- D(bytes_sent gt 1000000000)
Show answer & explanationAnswer & explanation
Correct answer: A. (bytes_sent gt 1073741824)
1 GB (Gigabyte) is precisely 1024 MB, or 1024 * 1024 KB, or 1024 * 1024 * 1024 bytes. This equals 1,073,741,824 bytes. Therefore, filtering for 'bytes_sent gt 1073741824' accurately captures sessions where bytes sent exceed 1 GB.
Why the other options are wrong
- B. This uses 'bytes_received' instead of 'bytes_sent' and uses 1 billion (10^9) bytes, which is not a true Gigabyte.
- C. This uses 'bytes_total' (sent + received) and 1 billion bytes, neither of which matches the requirement.
- D. This uses 'bytes_sent' but incorrectly equates 1 GB to 1,000,000,000 bytes instead of 1,073,741,824 bytes.
Byte Conversion for Filters
When filtering logs by byte values (e.g., bytes_sent, bytes_received), it's critical to use the precise binary conversion for KB, MB, GB (powers of 1024) rather than decimal approximations (powers of 1000).
- 1 KB = 1024 bytes
- 1 MB = 1024 KB = 1,048,576 bytes
- 1 GB = 1024 MB = 1,073,741,824 bytes
- Using decimal approximations (e.g., 1,000,000,000 for 1 GB) will result in inaccurate filtering.
Memory trick: For 'bytes_sent', remember '1024' is your 'byte' of truth, not 1000!