Palo Alto Networks NGFW-Engineer Exam - Topic 2 Question 11 Discussion

Actual exam question for Palo Alto Networks's NGFW-Engineer exam

Question #: 11
Topic #: 2

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

AFlood Protection

BProtocol Protection

CPacket-Based Attack Protection

DReconnaissance Protection

Show Suggested Answer

Suggested Answer: B

In the context of a Zone Protection profile, Protocol Protection is the section used to configure protections against activities such as spoofed IP addresses and split handshake session establishment attempts. These types of attacks typically involve manipulating protocol behaviors, such as IP address spoofing or session hijacking, and are mitigated by the Protocol Protection settings.

by Raylene at Jul 31, 2025, 09:18 AM

Limited Time Offer

25%

Off

Get Premium NGFW-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gabriele

6 months ago

Split handshake? Really? That sounds a bit far-fetched.

upvoted 0 times

...

Gayla

6 months ago

100% agree with B, it's all about those protocols!

upvoted 0 times

...

Winfred

6 months ago

Wait, are we sure it's not C? Sounds like packet stuff too.

upvoted 0 times

...

Catalina

6 months ago

Definitely B, Protocol Protection is the way to go.

upvoted 0 times

...

Ira

7 months ago

I thought it was A at first, but B makes more sense.

upvoted 0 times

...

Albina

7 months ago

I thought Reconnaissance Protection was more about scanning and probing, so I don't think that's it, but I could be wrong.

upvoted 0 times

...

Stefanie

7 months ago

I feel like Packet-Based Attack Protection could be the answer, but I can't recall if that specifically covers those types of attacks.

upvoted 0 times

...

Kris

8 months ago

I remember practicing a similar question, and I think spoofed IPs are often related to Flood Protection, but that doesn't seem right for split handshake.

upvoted 0 times

...

Afton

8 months ago

I think it might be Protocol Protection since it deals with session establishment issues, but I'm not entirely sure.

upvoted 0 times

...

Giovanna

8 months ago

I've seen questions like this before, and from what I remember, Packet-Based Attack Protection is the right place to configure defenses against spoofing and session-level attacks. So I'm pretty confident C is the answer here.

upvoted 0 times

...

Elise

8 months ago

I'm a little confused by the wording of this question. Is there a difference between "Packet-Based Attack Protection" and "Protocol Protection"? I'm not sure which one would be the right answer here.

upvoted 0 times

...

Katie

8 months ago

Okay, let me think this through. Spoofed IPs and session establishment attempts sound like they'd be covered under Packet-Based Attack Protection, so I'm going to go with C on this one.

upvoted 0 times

...

Galen

8 months ago

Hmm, I'm not totally sure about this one. I'm thinking it might be B - Protocol Protection, since that's where you'd configure stuff related to protocol-level attacks. But I'm not 100% confident on that.

upvoted 0 times

...

Genevive

9 months ago

This one seems pretty straightforward. I think the answer is C - Packet-Based Attack Protection, since that's where you'd configure options to protect against spoofed IPs and session establishment attempts.

upvoted 0 times

...

Troy

9 months ago

Ah, the age-old question of where to configure NGFW protection against IP shenanigans. I'd go with C. Packet-Based Attack Protection, but I'm still waiting for an option that says 'Protect against the zombie apocalypse' just in case.

upvoted 0 times

Bo

5 months ago

Haha, zombie apocalypse protection would be epic! But I’d stick with B.

upvoted 0 times

...

Lashandra

5 months ago

A is what I’d pick. Flood Protection seems relevant too.

upvoted 0 times

...

Truman

6 months ago

I think B is the right choice. Protocol Protection covers those issues.

upvoted 0 times

...

Helga

7 months ago

I agree with Truman. Protocol Protection is key for spoofing.

upvoted 0 times

...

Antione

9 months ago

That's a good point, Jaime. But I still think C) Packet-Based Attack Protection makes more sense in this scenario.

upvoted 0 times

...

Jaime

10 months ago

I'm not sure, but I think it could also be A) Flood Protection, since it deals with excessive traffic.

upvoted 0 times

...

Karl

10 months ago

I'm pretty sure it's C. Packet-Based Attack Protection. Protecting against those sneaky IP spoofing tricks is crucial.

upvoted 0 times

...

Blair

10 months ago

I agree with Antione, because protecting against spoofed IP addresses and split handshake attempts sounds like packet-based attacks.

upvoted 0 times

...

Arlette

10 months ago

Definitely C. Packet-Based Attack Protection. Gotta keep those pesky hackers out, am I right? *wink wink*

upvoted 0 times

...

Helene

11 months ago

Hmm, I think the answer is C. Packet-Based Attack Protection, that's where you'd configure options to defend against spoofed IPs and split handshake attempts.

upvoted 0 times

...

Antione

11 months ago

I think the answer is C) Packet-Based Attack Protection.

upvoted 0 times

...