An administrator would like to block access to a web server, while also preserving resources and minimizing half-open sockets. What are two security policy actions the administrator can select? (Choose two.)

The objective is to block access while preserving resources and minimizing half-open sockets. These goals can be addressed with different strategies. The Drop action provides maximum resource preservation for the firewall itself. It silently discards packets with the lowest possible processing overhead, which is critical during high-traffic events or denial-of-service attacks. The Reset server action specifically preserves the web server's resources. By sending a TCP RST packet only to the server, the firewall instructs the server to immediately terminate the connection. This prevents the server's sockets and memory from being tied up by unwanted connection attempts, thus minimizing half-open sockets on the server side. Together, these two actions represent valid, distinct choices for an administrator prioritizing either firewall or server resource preservation.

B. Reset both: While this cleanly closes the session on both ends, it requires the firewall to generate two reset packets, consuming more firewall resources than the other blocking actions.
D. Deny: In the context of a Palo Alto Networks security policy, the Deny action is functionally identical to the Drop action, resulting in a silent packet discard.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide Release 10.2. "Security Policy Actions" section.

On Drop: "drop—Silently drops the traffic; it does not send a TCP reset to the source or destination... A drop is the default action for the predefined interzone-default rule." This confirms its low-overhead nature as it performs a simple discard.

On Reset server: "reset-server—For TCP

sends a TCP reset to the server... The firewall does not send a reset to the client

so the client is not aware that the connection was terminated and the client’s resources will be tied up until the session times out." This highlights its specific function in protecting the server's resources and closing its socket.