PCNSE Advanced Threat Prevention Flashcards

Which feature in Advanced Threat Prevention provides protection against evasive C2 traffic that uses encrypted or obfuscated channels?

Answer: Advanced C2 Prevention using ML models via Inline Cloud Analysis

Advanced C2 Prevention uses ML-based Inline Cloud Analysis to detect encrypted or obfuscated command-and-control channels that evade signature-based detection.

What happens when a firewall running WildFire receives a 'Phishing' verdict for a submitted URL?

Answer: A phishing signature is generated and distributed to WildFire subscribers

A Phishing verdict causes WildFire to generate and distribute a new anti-phishing signature to all WildFire-subscribed firewalls.

An administrator notices that a Vulnerability Protection profile is consuming high CPU on the firewall. Which action can reduce resource usage without eliminating protection?

Answer: Enable only 'critical' and 'high' severity signatures in the profile

Limiting active signatures to critical and high severity reduces the number of patterns inspected per session, lowering CPU overhead while maintaining coverage for the most dangerous threats.

Which PAN-OS feature allows administrators to view the behavioral activity of a malware sample analyzed by WildFire, such as file system changes and network connections?

Answer: WildFire Analysis Report

The WildFire Analysis Report provides a detailed behavioral breakdown of a submitted sample, including process activity, registry changes, and network communication.

A company's compliance policy prohibits sending any internal files to the cloud. Which WildFire deployment mode meets this requirement?

Answer: WildFire private cloud using a WF-500 appliance

The WF-500 private cloud appliance performs all sandboxing on-premises so no file content leaves the organization's network.

When applying a Security Profile Group to a security policy rule, which profiles are typically bundled together for complete threat prevention coverage?

Answer: Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis

A complete Threat Prevention profile group combines Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire Analysis for layered coverage.

What is the function of 'Data Filtering' profiles in the context of Threat Prevention on PAN-OS?

Answer: They detect and control the transmission of sensitive data patterns such as credit card numbers or SSNs

Data Filtering profiles inspect content for predefined or custom data patterns (e.g., PII) and can alert or block transfers containing sensitive information.