PCNSA WildFire and Malware Analysis 2 — Questions and Answers
Question 1: In a WildFire Analysis profile, what does setting the action to 'forward' accomplish?
- Files are forwarded to the Panorama management server for review
- Files matching the criteria are submitted to WildFire for sandbox analysis (Correct answer)
- Traffic is forwarded to the next-hop router without inspection
- Logs are forwarded to a configured syslog server
Correct answer: Files matching the criteria are submitted to WildFire for sandbox analysis
In a WildFire Analysis profile, the 'forward' action causes files matching the specified application and file type to be submitted to the WildFire cloud for analysis.
Question 2: Which of the following file types is NOT natively supported for WildFire analysis?
- PE (Windows portable executable) files
- PDF documents
- MP3 audio files (Correct answer)
- Android APK files
Correct answer: MP3 audio files
WildFire analyzes file types that can contain executable code or malicious content such as PE/DLL, PDF, Office documents, and APKs, but not audio files like MP3.
Question 3: Where in the PAN-OS web interface can an administrator view WildFire analysis reports for submitted files?
- Monitor > WildFire Submissions (Correct answer)
- Device > WildFire > Analysis Reports
- Objects > WildFire > Reports
- Policies > WildFire > Logs
Correct answer: Monitor > WildFire Submissions
WildFire submission logs and detailed analysis reports are accessible under Monitor > WildFire Submissions in the PAN-OS management interface.
Question 4: What happens to WildFire signature updates when a firewall does NOT have an active WildFire subscription?
- File forwarding to WildFire is completely disabled
- Files are analyzed but results are returned with a 48-hour delay
- WildFire-derived signatures are bundled into daily Antivirus content updates (Correct answer)
- The firewall falls back to using only IPS signatures for threat detection
Correct answer: WildFire-derived signatures are bundled into daily Antivirus content updates
Without a WildFire subscription, WildFire-generated signatures are only received as part of the daily Antivirus content update package rather than every 5 minutes.
Question 5: What is the purpose of the WildFire Inline ML feature available in PAN-OS?
- To use on-device machine learning models to classify threats locally without cloud submission (Correct answer)
- To replace all signature-based detection with cloud AI analysis
- To analyze encrypted SSL/TLS traffic streams for embedded malware
- To correlate WildFire results with third-party SIEM platforms in real time
Correct answer: To use on-device machine learning models to classify threats locally without cloud submission
WildFire Inline ML uses locally-running machine learning models on the firewall to classify certain file types as malicious in real time without requiring cloud submission.
Question 6: Which description best defines the WildFire 'phishing' verdict?
- A file containing ransomware encryption routines
- A URL or file designed to deceive users into disclosing credentials or sensitive information (Correct answer)
- A file that installs a keylogger for credential harvesting
- A network scanning tool disguised as a legitimate application
Correct answer: A URL or file designed to deceive users into disclosing credentials or sensitive information
The phishing verdict is assigned to URLs and files that are specifically crafted to trick users into providing credentials or other sensitive information.
Question 7: In a WildFire hybrid deployment, what is the correct order of file analysis?
- Files are sent only to the public WildFire cloud
- Files are sent only to the on-premises WF-500 appliance
- Files are analyzed by the WF-500 appliance first; unsupported file types are then sent to the public cloud (Correct answer)
- Files are sent simultaneously to both the WF-500 appliance and the public cloud
Correct answer: Files are analyzed by the WF-500 appliance first; unsupported file types are then sent to the public cloud
In a hybrid deployment, the WF-500 handles local analysis for supported file types, and any file types it cannot process are forwarded to the public WildFire cloud.
PCNSA WildFire and Malware Analysis 2
In a WildFire Analysis profile, what does setting the action to 'forward' accomplish?