Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

Which Zone Protection Profile action would mitigate a DoS attack that creates a flood of bogus TCP connections?

1. Rate Limiting

2. Active Blocking

3. SYN Cookies

4. Traffic Shaping

The correct answer is: SYN Cookies

The action that effectively mitigates a DoS attack generating a flood of bogus TCP connections is the implementation of SYN Cookies. This method enhances the security of the TCP handshake process against SYN flood attacks, which are a common type of DoS attack where attackers attempt to overwhelm a target with a flood of SYN requests, leading to resource exhaustion. By utilizing SYN Cookies, the firewall can create a legitimate connection establishment process while avoiding the allocation of resources for half-open connections until the handshake is completed. Essentially, when a SYN request is received, the system can respond with a TCP SYN-ACK message that includes a specially crafted sequence number. This sequence number encodes certain state information and confirms that the server is willing to establish a connection, but no resources are reserved until the final ACK is received from the client. This technique efficiently protects against DoS attacks by ensuring that the server remains responsive without consuming resources until the communication is confirmed as legitimate. Thus, employing SYN Cookies helps maintain service availability in the presence of SYN flood attacks, effectively safeguarding network resources against such flooding attacks.