An engineer is configuring a Protection profile to defend specific endpoints and resources against malicious activity. The profile is configured to…

A DoS Protection profile is the correct choice because it is applied within a security policy rule, which allows for highly granular protection of specific resources. This aligns with the requirement to defend "specific critical systems." The profile can be configured with classified policies to set precise thresholds for various flood attacks (SYN, UDP, ICMP, etc.) against individual destination IP addresses. This provides the "granular defense against targeted flood attacks" mentioned in the scenario, distinguishing it from broader, zone-level protections.

A. Packet Buffer Protection: This protects the firewall's own packet buffer memory from exhaustion, not specific downstream endpoints or resources from targeted attacks.

B. Zone Protection: This profile applies broadly to all traffic entering an entire zone, lacking the granular, per-system targeting required for "specific critical systems."

C. Vulnerability Protection: This profile defends against known software exploits and vulnerability signatures, not the volume-based flood attacks characteristic of a DoS attack.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"DoS Protection": "DoS Protection policy rules and profiles allow you to protect specific

critical resources from attack... A DoS Protection profile is a set of thresholds for SYN

UDP

ICMP

and other IP packet floods. You apply a DoS Protection profile to a DoS Protection policy rule

which you can configure to protect one or more specific destination hosts (classified)..." This directly supports the use of DoS Protection for specific

critical systems.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"Zone Protection Profiles": "A Zone Protection profile provides broad protection for the entire zone against common flood

reconnaissance

and other packet-based attacks." This highlights its lack of granularity compared to a DoS Protection profile.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"Packet Buffer Protection": "Packet Buffer Protection defends the firewall against single-session DoS attacks that can overwhelm its packet buffer." This confirms its purpose is to protect the firewall itself.

4. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"Vulnerability Protection Profiles": "Vulnerability Protection profiles stop attempts to exploit system flaws or gain unauthorized access to systems." This clarifies its function is to prevent exploits

not volumetric floods.