Palo Alto Networks Exam PCNSE Topic 2 Question 96 Discussion

Actual exam question for Palo Alto Networks's PCNSE exam

Question #: 96
Topic #: 2

A firewall administrator is changing a packet capture filter to troubleshoot a specific traffic flow Upon opening the newly created packet capture, the administrator still sees traffic for the previous fitter What can the administrator do to limit the captured traffic to the newly configured filter?

ACommand line > debug dataplane packet-diag clear filter-marked-session all

BIn the GLH under Monitor > Packet Capture > Manage Filters under Ingress Interface select an interface

CCommand line> debug dataplane packet-diag clear filter all

DIn the GUI under Monitor > Packet Capture > Manage Filters under the Non-IP field, select 'exclude'

Show Suggested Answer

Suggested Answer: C

by Latia at Sep 11, 2024, 06:27 AM

Limited Time Offer

25%

Off

Get Premium PCNSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Laurel

9 months ago

As a firewall admin, I'd choose Option B. Selecting the specific interface in the GUI is the most logical step here.

upvoted 0 times

...

Sheridan

9 months ago

Option A looks interesting, but I'm not sure about clearing all the filter-marked sessions. Seems a bit overkill for this problem.

upvoted 0 times

Detra

9 months ago

Let's go with option B then. It seems like the most appropriate solution for limiting the captured traffic.

upvoted 0 times

...

Wade

9 months ago

I agree, clearing all filter-marked sessions with option A seems excessive. Option B seems more targeted.

upvoted 0 times

...

Jesusita

9 months ago

I think option B might be a better choice. Selecting the interface could help narrow down the captured traffic.

upvoted 0 times

...

Stephen

9 months ago

Haha, clearing all the filters? That's like using a sledgehammer to crack a nut! Option C is definitely not the way to go.

upvoted 0 times

Luis

8 months ago

User 3: Let's go with option B, it seems like a more targeted approach.

upvoted 0 times

...

Leah

9 months ago

I agree, we should try option A or B instead.

upvoted 0 times

...

Cora

9 months ago

Yeah, option C seems a bit extreme.

upvoted 0 times

...

Kimbery

10 months ago

I'm not sure, but I think A could also be a valid option, as clearing the filter-marked sessions may help limit the captured traffic.

upvoted 0 times

...

Douglass

10 months ago

I'd go with Option D. Excluding non-IP traffic sounds like a smart way to narrow down the capture.

upvoted 0 times

...

Denna

10 months ago

Option B seems like the way to go. Selecting the Ingress Interface in the GUI is the most straightforward approach.

upvoted 0 times

Nieves

9 months ago

Thanks for the advice, I'll give it a try next time I need to troubleshoot a specific traffic flow.

upvoted 0 times

...

Katina

9 months ago

I've used that method before and it worked perfectly for me.

upvoted 0 times

...

Deane

9 months ago

I agree, that's the best way to limit the captured traffic to the newly configured filter.

upvoted 0 times

...

Kasandra

10 months ago

Option B seems like the way to go. Selecting the Ingress Interface in the GUI is the most straightforward approach.

upvoted 0 times

...

Gilbert

11 months ago

I disagree, I believe the correct answer is D, because selecting 'exclude' in the Non-IP field will filter out unwanted traffic.

upvoted 0 times

...

Joseph

11 months ago

I think the answer is B, because you need to select the interface where the traffic is coming from.

upvoted 0 times

...