Palo Alto Networks (PANW) System Engineer (PSE) Practice Exam

What native cloud security service manages access of IP addresses and ports to a subnet?

1. Security group

2. Internet gateway

3. VM-Series firewall

4. Network Access Control List

The correct answer is: Network Access Control List

The native cloud security service that manages access of IP addresses and ports to a subnet is the Network Access Control List (NACL). NACLs provide a way to control inbound and outbound traffic at the subnet level in cloud environments. They function as a virtual firewall for controlling network traffic flow based on defined rules for specific IP addresses and ports. NACLs are stateless, meaning that they must contain rules for both incoming and outgoing traffic. This gives cloud administrators the flexibility to specify which external IP addresses can access their subnets and to set up rules that define the permissible traffic types. By allowing or denying traffic through a set of rules, NACLs help in enhancing the security posture of the virtual networks. Other options like security groups, internet gateways, and VM-Series firewalls serve different purposes. Security groups are stateful and typically operate at the instance level rather than at the subnet level, while internet gateways manage connectivity between the cloud network and the external internet. The VM-Series firewall is a more advanced appliance that provides comprehensive security features, but it does not directly handle the basic access control at the subnet level in the same way that NACLs do.