A network security engineer has created a Security policy in Prisma Access that includes a negated region in the source address. Which configuration…

A negated source address in a Security policy rule (e.g., !Region-A) instructs the firewall to apply the rule to traffic from every region except Region-A. Traffic originating from the excluded Region-A will not match this rule. It will then be evaluated against subsequent rules. If no other specific allow rule exists for Region-A, the traffic will match the implicit, default deny rules at the end of the policy rulebase, causing a loss of connectivity. To prevent this, a separate Security policy must be created to explicitly define the desired action (e.g., allow) for traffic originating from the negated region.

A. Set the service to be application-default. This option relates to port and protocol handling for an application; it does not address the source address matching logic that is causing the connectivity issue.

C. Add a Dynamic Application Group to the Security policy. This modifies the application criteria of the rule. It is irrelevant to solving a problem caused by source address negation and rulebase evaluation order.

D. Add all regions that contain private IP addresses to the source address. This modifies the existing rule's source criteria but fails to create the necessary separate rule to handle traffic from the explicitly excluded (negated) region.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 11.0

"Objects > Regions". The guide explains how regions are defined and used in policies. The logic of policy evaluation is central to understanding this question.

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 11.0

"Policies > Security > Security Policy > Use Negation in a Security Policy Rule". This section explicitly states: "When you use negation

you must also create a separate rule to explicitly allow the traffic that you negated in the first rule. Otherwise

the firewall will deny the traffic that you negated because it will match the default security rule." This directly validates the correct answer.

3. Palo Alto Networks

Prisma Access Administrator’s Guide

"Get Started with Prisma Access > Security Policy". This documentation describes how Security policies in Prisma Access are evaluated top-down and how traffic that does not match any rule is denied by default

reinforcing the need for an explicit policy for the negated traffic.