PCNSE Advanced Threat Prevention Flashcards

Which Vulnerability Protection profile action drops the packet and resets both the client and server connections when a threat is detected?

Answer: Reset Both

'Reset Both' sends TCP resets to both the client and server, immediately terminating the connection when an exploit signature matches.

What is the purpose of the 'Passive DNS Monitoring' feature in an Anti-Spyware profile?

Answer: It captures DNS query data and sends it to Palo Alto Networks for threat intelligence

Passive DNS Monitoring forwards DNS query logs to Palo Alto Networks to enhance threat intelligence without blocking or redirecting queries.

An administrator configures an Anti-Spyware profile and enables the 'single-session' option for command-and-control (C2) detection. What does this setting do?

Answer: Limits C2 signatures to trigger only once per firewall session

The 'single-session' option causes the firewall to generate only one threat log entry per session for a matching C2 signature, reducing log noise.

Which file type does WildFire NOT analyze by default on the public cloud?

Answer: Encrypted ZIP files

WildFire cannot analyze password-protected or encrypted ZIP files because the content is inaccessible without the decryption key.

What must be licensed on a Palo Alto Networks firewall for it to receive real-time WildFire signature updates every 5 minutes?

Answer: WildFire subscription in addition to Threat Prevention

A WildFire subscription enables 5-minute signature update intervals; without it, updates arrive only with the daily content updates.

In a Threat Prevention deployment, what role does 'Inline Cloud Analysis' play in Advanced Threat Prevention (ATP)?

Answer: It performs machine learning-based inspection of traffic in the data plane without sending files to the cloud

Inline Cloud Analysis uses cloud-delivered ML models executed in the firewall's data plane to detect unknown threats without a round-trip file submission.

A security profile is configured with a custom threat exception that changes the action for a specific vulnerability signature to 'Allow.' What is a key risk of this configuration?

Answer: Legitimate traffic matching the exception will not be inspected for that specific exploit

A threat exception with 'Allow' action bypasses the specific signature for all matching traffic, potentially allowing the exploit to pass undetected.