PCNSE PCNSE Advanced Threat Prevention 3

Question 1

Which Vulnerability Protection profile action drops the packet and resets both the client and server connections when a threat is detected?

Accepted Answer

Reset Both

Answer

'Reset Both' sends TCP resets to both the client and server, immediately terminating the connection when an exploit signature matches.

Question 2

What is the purpose of the 'Passive DNS Monitoring' feature in an Anti-Spyware profile?

Accepted Answer

It captures DNS query data and sends it to Palo Alto Networks for threat intelligence

Answer

Passive DNS Monitoring forwards DNS query logs to Palo Alto Networks to enhance threat intelligence without blocking or redirecting queries.

Question 3

An administrator configures an Anti-Spyware profile and enables the 'single-session' option for command-and-control (C2) detection. What does this setting do?

Accepted Answer

Limits C2 signatures to trigger only once per firewall session

Answer

The 'single-session' option causes the firewall to generate only one threat log entry per session for a matching C2 signature, reducing log noise.

Question 4

Which file type does WildFire NOT analyze by default on the public cloud?

Accepted Answer

Encrypted ZIP files

Answer

WildFire cannot analyze password-protected or encrypted ZIP files because the content is inaccessible without the decryption key.

Question 5

What must be licensed on a Palo Alto Networks firewall for it to receive real-time WildFire signature updates every 5 minutes?

Accepted Answer

WildFire subscription in addition to Threat Prevention

Answer

A WildFire subscription enables 5-minute signature update intervals; without it, updates arrive only with the daily content updates.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE PCNSE Advanced Threat Prevention 3