Question 11
A customer’s Palo Alto Networks NGFW currently has only one security policy allowing all traffic. They have identified that this is a substantial security risk and have heard that the Expedition tool can help them extract security policies from an “allow any” rule. What should the consultant say about Expedition?
- Live firewall traffic can be viewed on Expedition when connected to a firewall, and Expedition can automatically create and push policies to the firewall.
- The log flies can be viewed on Expedition, and right-clicking a log entry gives the option to create security policy from the log entry.
- By using the Machine Learning feature, Expedition can parse the traffic log files related to the policy and extract security rules for matching traffic.
- Expedition cannot parse log files and therefore cannot be used for this purpose.