Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What will happen when someone attempts to initiate an SSH connection to an interface with a deny rule applied?

1. SSH access will be established

2. SSH access will be denied

3. Connections will be logged for review

4. SSH access will be limited to a specific IP

The correct answer is: SSH access will be denied

When someone attempts to initiate an SSH connection to an interface that has a deny rule applied, SSH access will be denied. This is because deny rules are explicitly configured to block access to certain services or types of traffic. In this case, the deny rule specifically prevents the establishment of an SSH session, which operates over TCP on port 22. The functionality of firewall rules dictates that packets matching a deny condition will not be allowed to pass through the interface. Thus, any requests trying to establish a connection via SSH will not get through to the intended device, resulting in the termination of the connection attempt at the firewall level. This is a fundamental aspect of network security management, where access control policies are established to restrict unauthorized or unwanted traffic. Other options describe potential scenarios that are not applicable in this case. Establishing SSH access, logging connections for review, or limiting access to specific IP addresses would not transpire under a deny rule, as the primary action of this type of rule is to completely block the designated traffic.