PCNSE Advanced Threat Prevention Flashcards

Which WildFire verdict type indicates a file has been analyzed and found to contain malicious behavior?

Answer: Malicious

WildFire assigns a 'Malicious' verdict when dynamic or static analysis confirms the file contains harmful code or behavior.

In a PAN-OS Antivirus security profile, what does the 'Wildfire Analysis' action do when set to 'Send' for unknown files?

Answer: Forwards the file to WildFire for analysis while allowing the session to continue

The 'Send' action uploads unknown files to WildFire for cloud-based analysis without blocking the in-progress session.

What is the default WildFire public cloud update interval for signatures after a malicious verdict is issued?

Answer: Every 15 minutes

WildFire pushes updated antivirus signatures to subscribers every 15 minutes by default after issuing a malicious verdict.

An administrator wants to use DNS Sinkholing. What must be configured on the firewall to enable this feature?

Answer: An Anti-Spyware security profile with DNS Sinkhole enabled

DNS Sinkholing is configured within an Anti-Spyware security profile, where you specify the sinkhole IP address for malicious DNS queries.

Which log type shows WildFire submission and verdict information on a Palo Alto Networks firewall?

Answer: WildFire Submissions log

The WildFire Submissions log records file submissions, file types, verdicts, and associated session details.

A company needs to prevent credential phishing but cannot decrypt HTTPS traffic. Which Threat Prevention feature can still help identify phishing sites?

Answer: URL Filtering with PAN-DB phishing category

URL Filtering using PAN-DB can block or alert on known phishing URLs based on category, even without SSL/TLS decryption.

When configuring WildFire in a private cloud deployment, which component receives file submissions from the firewall?

Answer: WF-500 appliance

The WF-500 is the on-premises WildFire private cloud appliance that receives and analyzes file submissions locally.