A firewall administrator is investigating high packet buffer utilization in the company firewall. After looking at the threat logs and seeing many…

Packet buffer protection must be explicitly enabled for the zones where it is needed, in addition to the global setting. The global setting (under Device > Setup > Session) acts as a master switch, but the protection is not active on any specific zone until it is configured for that zone. This is accomplished by configuring packet buffer protection within a Zone Protection Profile and applying that profile to the ingress zone(s) receiving the attack traffic. The administrator's action of enabling it globally was insufficient because the protection was not yet applied to the specific, affected zone.

A. Apply DOS profile to security rules allow traffic from outside. This is incorrect because DoS Protection profiles apply to traffic that is already allowed by a Security policy rule. Zone-based protections are more efficient as they act earlier in the packet flow.
B. Add the default Vulnerability Protection profile to all security rules that allow traffic from outside. This is incorrect because Vulnerability Protection profiles are designed to stop known exploits and vulnerability-based attacks, not to mitigate volumetric flood attacks that exhaust packet buffers.
D. Add a Zone Protection profile to the affected zones. This is less precise than option C. While adding a profile is the mechanism, the fundamental missing step is enabling the protection for the zone. A profile might already exist on the zone, requiring modification rather than addition.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2, "Zone Protection Profiles": "To protect a zone from flood, reconnaissance, and other packet-based attacks, you create a Zone Protection profile and apply it to the zone."

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2, "Configure Packet Buffer Protection": "To use packet buffer protection, you must enable it for each zone where you want to apply protection and then attach the Zone Protection profile to the zone." This reference directly supports that protection must be enabled for the specific zone, which is the action described in the correct answer.

3. Palo Alto Networks PAN-OS® Administrator's Guide 10.2, "Packet Buffer Protection": "You can enable packet buffer protection globally for all zones or for individual zones... When you enable packet buffer protection, you can also set thresholds for two types of protection: RED and packet buffer block. The firewall applies the thresholds on a per-zone basis." This confirms that even with a global setting, the application is per-zone.