PCNSA PCNSA Threat Prevention 3

Question 1

What is the purpose of the 'sinkhole' action in Palo Alto Networks Anti-Spyware profiles?

Accepted Answer

Redirecting C2 DNS responses to a known sinkhole IP to identify compromised hosts

Answer

DNS sinkholing redirects malicious DNS responses to a controlled IP so the firewall can identify internal hosts communicating with C2 servers.

Question 2

Which Palo Alto Networks feature provides inline cloud-based analysis of suspicious files to prevent patient-zero infections?

Accepted Answer

Inline WildFire ML

Answer

Inline WildFire ML uses machine learning models deployed directly on the firewall to block malicious files before they reach the endpoint.

Question 3

When configuring a Vulnerability Protection profile, what does the 'brute force' protection setting help mitigate?

Accepted Answer

Repeated login attempts to gain unauthorized access

Answer

Brute force protection in Vulnerability Protection profiles detects and blocks repeated failed authentication attempts against network services.

Question 4

What log type should an administrator review to see threat events blocked by security profiles?

Accepted Answer

Threat log

Answer

The Threat log records all events detected and acted upon by security profiles, including blocked malware, exploits, and spyware.

Question 5

In Palo Alto Networks, which action in a Vulnerability Protection profile blocks the packet and closes the session without sending a reset?

Accepted Answer

Drop

Answer

The Drop action silently discards the offending packet and terminates the session without notifying either endpoint.

PCNSA - Palo Alto Networks Certified Network Security Administrator Practice Test