PCNSE PCNSE Advanced Threat Prevention 3 — Questions and Answers
Question 1: Which Vulnerability Protection profile action drops the packet and resets both the client and server connections when a threat is detected?
- Alert
- Drop
- Reset Both (Correct answer)
- Block IP
Correct answer: Reset Both
'Reset Both' sends TCP resets to both the client and server, immediately terminating the connection when an exploit signature matches.
Question 2: What is the purpose of the 'Passive DNS Monitoring' feature in an Anti-Spyware profile?
- It blocks all DNS queries to external resolvers
- It captures DNS query data and sends it to Palo Alto Networks for threat intelligence (Correct answer)
- It replaces the DNS server with a sinkhole IP
- It rate-limits DNS traffic to prevent amplification attacks
Correct answer: It captures DNS query data and sends it to Palo Alto Networks for threat intelligence
Passive DNS Monitoring forwards DNS query logs to Palo Alto Networks to enhance threat intelligence without blocking or redirecting queries.
Question 3: An administrator configures an Anti-Spyware profile and enables the 'single-session' option for command-and-control (C2) detection. What does this setting do?
- Limits C2 signatures to trigger only once per firewall session (Correct answer)
- Sends only one packet to WildFire per session
- Applies C2 signatures to the first packet of each new flow only
- Forces C2 traffic into a single TCP session for inspection
Correct answer: Limits C2 signatures to trigger only once per firewall session
The 'single-session' option causes the firewall to generate only one threat log entry per session for a matching C2 signature, reducing log noise.
Question 4: Which file type does WildFire NOT analyze by default on the public cloud?
- PE (Portable Executable)
- Encrypted ZIP files (Correct answer)
- Microsoft Office documents
Correct answer: Encrypted ZIP files
WildFire cannot analyze password-protected or encrypted ZIP files because the content is inaccessible without the decryption key.
Question 5: What must be licensed on a Palo Alto Networks firewall for it to receive real-time WildFire signature updates every 5 minutes?
- Threat Prevention subscription only
- WildFire subscription in addition to Threat Prevention (Correct answer)
- Advanced URL Filtering
- AutoFocus
Correct answer: WildFire subscription in addition to Threat Prevention
A WildFire subscription enables 5-minute signature update intervals; without it, updates arrive only with the daily content updates.
Question 6: In a Threat Prevention deployment, what role does 'Inline Cloud Analysis' play in Advanced Threat Prevention (ATP)?
- It sends threat logs to Panorama in real time
- It performs machine learning-based inspection of traffic in the data plane without sending files to the cloud (Correct answer)
- It replaces WildFire sandboxing for all file types
- It applies URL filtering inline before decryption
Correct answer: It performs machine learning-based inspection of traffic in the data plane without sending files to the cloud
Inline Cloud Analysis uses cloud-delivered ML models executed in the firewall's data plane to detect unknown threats without a round-trip file submission.
Question 7: A security profile is configured with a custom threat exception that changes the action for a specific vulnerability signature to 'Allow.' What is a key risk of this configuration?
- It disables the entire Vulnerability Protection profile
- It permanently whitelists the source IP from all threat scanning
- Legitimate traffic matching the exception will not be inspected for that specific exploit (Correct answer)
- It prevents WildFire from analyzing associated files
Correct answer: Legitimate traffic matching the exception will not be inspected for that specific exploit
A threat exception with 'Allow' action bypasses the specific signature for all matching traffic, potentially allowing the exploit to pass undetected.
PCNSE PCNSE Advanced Threat Prevention 3
Which Vulnerability Protection profile action drops the packet and resets both the client and server connections when a threat is detected?