Exam NetSec-Analyst Topic 1 Question 61 Discussion

Option C is the most robust and accurate solution. 1. User-ID Integration: Specifying 'Source User (User-ID for 'Finance-Admins')' directly integrates with Active Directory for group-based access control. 2. Application Identification: While 'web-browsing' can be a base, for a custom web application, creating a 'Custom Application' based on its unique characteristics (e.g., specific URLs, response patterns) is best practice for accurate App-ID. 3. Custom HTTP Header Validation: The critical part. Palo Alto Networks allows 'Custom Application' signatures to include pattern matching (like regular expressions) for HTTP headers and their values. This means the firewall can directly inspect for 'X-App- Auth: ' within the HTTP stream as part of the application identification itself. If the header is missing or incorrect, the custom application won't match, and the policy (if it only allows this specific custom application) will implicitly block the traffic. 4. SSL Decryption: Crucial for inspecting HTTPS traffic, as the custom HTTP header would be encrypted without it. Option A and D are incorrect as URL filtering and Vulnerability Protection profiles are not designed for deep, conditional HTTP header inspection for application authentication. Option B's 'Application Override' is for reclassifying an application, not for enforcing header presence or dynamically injecting headers. Option E's 'Data Filtering' is primarily for sensitive data content, not for validating specific HTTP header presence for application access control.