Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone. Complete the security policy to ensure only Telnet is…

To ensure only Telnet traffic is permitted, the security policy must use the Palo Alto Networks App-ID engine to identify the application. By specifying Application = 'telnet', the firewall will inspect traffic at Layer 7 to positively identify it as Telnet, regardless of the port used. The service = "application-default" setting complements this by restricting the identified Telnet application to its standard port (TCP/23). This combination creates a specific, least-privilege rule that precisely matches the stated requirement, which is a core principle of a Zero Trust architecture.

A. Destination IP: 192.168.1.123/24: This is a malformed entry (a host address with a network mask) and, more importantly, it defines where traffic goes, not what kind of traffic is allowed.

C. Log Forwarding: This setting determines where to send logs generated by this policy. It does not influence the traffic-matching or filtering logic of the rule itself.

D. USER-ID = ‘Allow users in Trusted’: This component restricts the policy based on user identity. It defines who can send the traffic but does not restrict the application being used.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0.

Section: Security Policy > Security Policy Rule Components.

Content: The guide states

"Applications—(Required) The App-ID or application group that the security policy rule will match." It also explains the application-default service setting: "Specifies that the firewall will use the standard ports for the application specified in the security policy rule." This confirms that defining the application is the primary method for controlling traffic type.

2. Palo Alto Networks. (n.d.). What is App-ID?. Palo Alto Networks TechDocs.

Section: App-ID Overview.

Content: "App-ID enables you to see the applications on your network and learn how they work... This application knowledge allows you to create and enforce security policies for all traffic

not just for a subset of applications on standard ports." This document establishes App-ID as the fundamental technology for creating application-aware security policies.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0.

Section: Security Policy > Create a Security Policy Rule.

Content: The procedural steps for creating a security policy rule list the "Application" tab as a mandatory step for defining the traffic to be matched. This reinforces that specifying the application is a core requirement for a functional and specific policy.