Exam NetSec-Analyst Topic 1 Question 128 Discussion

Actual exam question for Palo Alto Networks's NetSec-Analyst exam
Question #: 128
Topic #: 1

A financial institution requires an SD-WAN deployment where all transactions over a custom application 'Financial_Tx' must utilize the MPLS link if available, but strict data sovereignty laws dictate that this traffic must never traverse a public internet link. Other applications have more flexible routing. How would you configure the SD-WAN profile and associated elements to enforce this stringent requirement, minimizing the risk of 'Financial_Tx' ever using the internet path, while allowing dynamic failover within the MPLS realm?

A. Create an SD-WAN policy rule for 'Financial_Tx' with 'Performance-Based' path selection. Define a 'Path Quality' profile for MPLS with aggressive SLA thresholds. For the internet link, configure a 'Path Monitoring' profile that always reports 'Bad' quality for the internet link when 'Financial_Tx' is detected. B. Implement an SD-WAN profile with a policy rule for 'Financial_Tx'. In the 'Path Selection' section, use 'Preferred Path' and explicitly add only the MPLS SD-WAN link(s). Do not add any internet-based SD-WAN links to this rule's 'Applicable Paths' or 'Preferred Path' list. C. Use a PBF (Policy Based Forwarding) rule for 'Financial_Tx' to explicitly forward traffic out the MPLS interface. Use an SLA monitoring profile for the MPLS link to trigger a 'Deny' PBF rule if the MPLS link goes down, effectively dropping 'Financial_Tx' traffic rather than sending it over the internet. D. Define two SD-WAN profiles: one for 'Financial_Tx' with only MPLS links configured as active SD-WAN members, and another profile for other traffic including both MPLS and Internet links. Assign the 'Financial_Tx' profile to a separate virtual router only handling this traffic. E. Configure an SD-WAN policy rule for 'Financial_Tx'. Use 'Active/Backup' path selection, with the MPLS link as 'Active' and the internet link as 'Backup'. Additionally, create a security policy rule above this SD-WAN rule to block 'Financial_Tx' traffic if its egress interface is the internet-facing one.

Suggested Answer: B Vote an answer

Option B is the most direct and robust solution. By explicitly adding only MPLS SD-WAN link(s) to the 'Preferred Path' (or simply 'Applicable Paths') within the 'Financial_Tx' SD-WAN policy rule and not including any internet-based links, you guarantee that this traffic will never consider the internet path. This is a fundamental control within SD-WAN policy rules. Option A's 'always reports Bad' is an indirect and brittle hack. Option C relies on PBF and a deny rule, which is a workaround and less integrated with dynamic SD-WAN principles. Option D creates unnecessary complexity with separate SD-WAN profiles and virtual routers; the policy rule should be sufficient. Option E is flawed because 'Active/Backup' with an internet link as backup explicitly allows it, and relying on a security policy to block after the fact is reactive, not preventative, and increases risk.

by Harry at Sep 18, 2025, 07:46 AM

Limited Time Offer

15%

Off

Get Premium NetSec-Analyst Questions as Interactive Self Test Engine or PDF

Comments

Here are all the actual test exam dumps for IT exams. Most people prepare for the actual exams with our test dumps to pass their exams. So it's critical to choose and actual test pdf to succeed.

RECENT DISCUSSIONS

Useful Links

Contact Us

Our Working Time: ( GMT 0:00-15:00 )
From Monday to Saturday

Support: Contact now

If you have any question please leave me your email address, we will reply and send email to you in 12 hours.

Disclaimer:
Actual4test doesn't offer Real SANS and GIAC Exam Questions.
Oracle and Java are registered trademarks of Oracle and/or its affiliates
Actual4test material do not contain actual actual Oracle Exam Questions or material.
Actual4test doesn't offer Real Microsoft Exam Questions.
Microsoft®, Azure®, Windows®, Windows Vista®, and the Windows logo are registered trademarks of Microsoft Corporation
Actual4test Materials do not contain actual questions and answers from Cisco's Certification Exams. The brand Cisco is a registered trademark of CISCO, Inc
CFA Institute does not endorse, promote or warrant the accuracy or quality of these questions. CFA® and Chartered Financial Analyst® are registered trademarks owned by CFA Institute.
Actual4test does not offer exam dumps or questions from actual exams. We offer learning material and practice tests created by subject matter experts to assist and help learners prepare for those exams. All certification brands used on the website are owned by the respective brand owners. Actual4test does not own or claim any ownership on any of the brands.