PCNSA Threat Prevention Flashcards

What is the purpose of the 'sinkhole' action in Palo Alto Networks Anti-Spyware profiles?

Answer: Redirecting C2 DNS responses to a known sinkhole IP to identify compromised hosts

DNS sinkholing redirects malicious DNS responses to a controlled IP so the firewall can identify internal hosts communicating with C2 servers.

Which Palo Alto Networks feature provides inline cloud-based analysis of suspicious files to prevent patient-zero infections?

Answer: Inline WildFire ML

Inline WildFire ML uses machine learning models deployed directly on the firewall to block malicious files before they reach the endpoint.

When configuring a Vulnerability Protection profile, what does the 'brute force' protection setting help mitigate?

Answer: Repeated login attempts to gain unauthorized access

Brute force protection in Vulnerability Protection profiles detects and blocks repeated failed authentication attempts against network services.

What log type should an administrator review to see threat events blocked by security profiles?

Answer: Threat log

The Threat log records all events detected and acted upon by security profiles, including blocked malware, exploits, and spyware.

In Palo Alto Networks, which action in a Vulnerability Protection profile blocks the packet and closes the session without sending a reset?

Answer: Drop

The Drop action silently discards the offending packet and terminates the session without notifying either endpoint.

Which Palo Alto Networks update subscription delivers the latest antivirus and anti-spyware threat signatures automatically?

Answer: Threat Prevention content updates

Threat Prevention content updates deliver daily or more frequent signature updates for antivirus, anti-spyware, and vulnerability protection.