PCNSA WildFire and Malware Analysis 2

Question 1

In a WildFire Analysis profile, what does setting the action to 'forward' accomplish?

Accepted Answer

Files matching the criteria are submitted to WildFire for sandbox analysis

Answer

Files are forwarded to the Panorama management server for review

Answer

Traffic is forwarded to the next-hop router without inspection

Answer

Logs are forwarded to a configured syslog server

Question 2

Which of the following file types is NOT natively supported for WildFire analysis?

Accepted Answer

MP3 audio files

Answer

PE (Windows portable executable) files

Answer

PDF documents

Answer

Android APK files

Question 3

Where in the PAN-OS web interface can an administrator view WildFire analysis reports for submitted files?

Accepted Answer

Monitor > WildFire Submissions

Answer

Device > WildFire > Analysis Reports

Answer

Objects > WildFire > Reports

Answer

Policies > WildFire > Logs

Question 4

What happens to WildFire signature updates when a firewall does NOT have an active WildFire subscription?

Accepted Answer

WildFire-derived signatures are bundled into daily Antivirus content updates

Answer

File forwarding to WildFire is completely disabled

Answer

Files are analyzed but results are returned with a 48-hour delay

Answer

The firewall falls back to using only IPS signatures for threat detection

Question 5

What is the purpose of the WildFire Inline ML feature available in PAN-OS?

Accepted Answer

To use on-device machine learning models to classify threats locally without cloud submission

Answer

To replace all signature-based detection with cloud AI analysis

Answer

To analyze encrypted SSL/TLS traffic streams for embedded malware

Answer

To correlate WildFire results with third-party SIEM platforms in real time

Question 6

Which description best defines the WildFire 'phishing' verdict?

Accepted Answer

A URL or file designed to deceive users into disclosing credentials or sensitive information

Answer

A file containing ransomware encryption routines

Answer

A file that installs a keylogger for credential harvesting

Answer

A network scanning tool disguised as a legitimate application

Question 7

In a WildFire hybrid deployment, what is the correct order of file analysis?

Accepted Answer

Files are analyzed by the WF-500 appliance first; unsupported file types are then sent to the public cloud

Answer

Files are sent only to the public WildFire cloud

Answer

Files are sent only to the on-premises WF-500 appliance

Answer

Files are sent simultaneously to both the WF-500 appliance and the public cloud