URL Filtering and Application Control Flashcards

What is WildFire in Palo Alto Networks?

Answer: A cloud-based malware analysis service that detonates unknown files to identify threats

WildFire is Palo Alto's cloud-based sandbox that analyzes unknown files and URLs by executing them in a controlled environment to identify zero-day and unknown malware.

What file actions can be configured in a File Blocking profile on a Palo Alto firewall?

Answer: Alert, Block, and Continue

File Blocking profiles support Alert (log the file transfer), Block (prevent the transfer), and Continue (notify the user but allow transfer after confirmation) actions.

Which Palo Alto Networks security feature analyzes DNS queries to block connections to malicious domains, including C2 servers?

Answer: DNS Security

DNS Security uses threat intelligence to analyze DNS queries and block requests to known malicious domains, disrupting command-and-control communications and malware distribution.

What is the purpose of an Anti-Spyware profile in a Palo Alto security policy?

Answer: To detect and block command-and-control traffic and spyware phone-home communications

Anti-Spyware profiles detect and block spyware and malware that has already been installed on endpoints from communicating with external command-and-control infrastructure.

Which Palo Alto feature provides real-time URL categorization for sites not yet in the local PAN-DB cache?

Answer: PAN-DB Cloud Lookup

When a URL is not found in the local PAN-DB cache, the firewall performs a real-time cloud lookup against PAN-DB to retrieve the current category.

What does setting a URL Filtering profile action to 'block' do when a user attempts to visit a matched category?

Answer: Prevents the connection and displays a block page to the user

The 'block' action in a URL Filtering profile prevents the HTTP/HTTPS connection and returns a block page to the user's browser, clearly indicating the site is not permitted.