Palo Alto Networks Certified Network Security Administrator (PCNSA)Monitoring and ReportingMedium
A network administrator wants to review a summary of all security policy rule hits over the last month, specifically focusing on which rules are being used most frequently and which are not being hit at all. Which section of the Palo Alto Networks firewall GUI provides this information?
- AMonitor > Traffic
- BPolicies > Security
- CMonitor > ACC
- DMonitor > Policy Optimizer
Show answer & explanationAnswer & explanation
Correct answer: D. Monitor > Policy Optimizer
The 'Monitor > Policy Optimizer' section is specifically designed to analyze security policy rule usage. It provides insights into rule hits, unused rules, and suggestions for optimization, directly addressing the need to see which rules are most and least frequently used.
Why the other options are wrong
- A. Monitor > Traffic shows individual session logs, not a summary of policy rule hits.
- B. Policies > Security is where rules are configured, not where usage statistics are viewed.
- C. Monitor > ACC provides application and user visibility but doesn't focus on policy rule hit counts.
Policy Optimizer
The Policy Optimizer feature in Palo Alto Networks firewalls provides analytics on security policy rule usage, helping administrators identify over-permissive, under-utilized, or unused rules for optimization.
- Located under Monitor > Policy Optimizer.
- Shows hit counts for security rules.
- Helps identify unused rules, over-provisioned rules, and opportunities for 'App-ID' adoption.
Memory trick: To 'optimize' your 'policies', 'monitor' them closely!