A client has a sensitive internet-facing application server in Microsoft Azure and is concerned about resource exhaustion because of distributed denial-of-service attacks What can be configured on the VM-Series firewall to specifically protect this server against this type of attack?

A Denial-of-Service (DoS) Protection Profile, applied through a DoS Protection Policy, is the specific mechanism on a VM-Series firewall designed to protect downstream resources like an application server from session-based exhaustion attacks. This feature allows an administrator to define thresholds for the rate of new sessions (e.g., TCP SYN, UDP) destined for a specific IP address. When an attack causes traffic to exceed these thresholds, the firewall can take protective actions, such as dropping excess packets. This directly mitigates the risk of the server's resources being consumed by a flood of connection requests, which is the core of the client's concern.

A. Custom threat signature: This is designed to identify specific malicious payloads or patterns within traffic, such as exploits or malware, not to mitigate high-volume session flood attacks.
B. Zone Protection Profile: This feature is designed to protect the firewall's own resources (control and data planes) from being overwhelmed, not to provide granular protection for a specific server behind it.
C. QoS Profile to limit incoming requests: Quality of Service (QoS) is a traffic-shaping tool used to prioritize applications and manage bandwidth, not a security feature for detecting and mitigating DoS attacks.

1. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "DoS Protection" section: "DoS protection policies allow you to control the number of sessions to a specific destination IP address... A DoS protection profile is a set of rules that specifies the thresholds for SYN, UDP, and other IP packet floods. You apply a DoS protection profile to a DoS protection policy rule, and the rule applies the profile to traffic that is destined for a specific destination zone or a specific group of destination IP addresses."

2. Palo Alto Networks TechDocs, "DoS Protection and Zone Protection": This document explicitly differentiates the two features: "DoS Protection protects specific, critical systems behind the firewall from attack by limiting the connections-per-second (CPS) to those systems... Zone Protection protects the firewall and the entire zone from attack by limiting the CPS to a zone." This confirms that for protecting a specific server, DoS Protection is the correct choice over Zone Protection.

3. Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2, "Zone Protection Profiles" section: "A Zone Protection profile defends the firewall against floods, reconnaissance, and other packet-based attacks on a zone." This reinforces that its primary purpose is to protect the firewall itself and the network segment, not an individual host.