An administrator has configured a Security policy where the matching condition includes a single application and the action is deny If the…

The deny action in a Palo Alto Networks Security policy is an active response that terminates a session. The specific method of termination is determined by the application's properties within the App-ID database. In this scenario, the policy action is deny, and the identified application's default deny action is reset-both. Therefore, the firewall will honor the application's specific setting and actively terminate the connection by sending a TCP reset packet to both the client-side and server-side devices. This is distinct from the drop action, which would silently discard the traffic regardless of the application's default settings.

B. It silently drops the traffic and sends an ICMP unreachable code: This is incorrect because silently dropping and sending a notification are contradictory actions. The deny action is not silent.

C. It silently drops the traffic: This describes the drop action. The policy is configured for the deny action, which actively terminates the session rather than silently discarding packets.

D. It sends a TCP reset to the server-side device: This describes the reset-server action. The question specifies the application's default is reset-both, so both sides of the connection will be reset.

---

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

Chapter: Policies

Section: Security Policy

Subsection: "Security Policy Actions". The guide explains that the Deny action "sends a TCP reset to the host or server" for TCP-based applications. The specific target (client

server

or both) is determined by the application's defined characteristics.

2. Palo Alto Networks Knowledge Base

Article ID: 233

"Difference Between Deny and Drop Actions". This document clarifies: "The Deny action will send a TCP-RST packet to the host/server to gracefully close the TCP connection... The Drop action will silently drop the traffic and will not send any notification to the host/server." This confirms that deny is an active reset based on the session context.