A client has attempted communication with a known command-and-control server and it has reached the configured threat level threshold. Which feed will the clients IP address be automatically added…

The correct answer is D. the infected host cloud feed. Infected hosts are internal hosts that have been compromised by malware and are communicating with external C&C servers3. Juniper ATP Cloud provides infected host feeds that list internal IP addresses or subnets of infected hosts along with a threat level3. Once the Juniper ATP…

Juniper Advanced Threat Prevention (ATP)

Question

A client has attempted communication with a known command-and-control server and it has reached the configured threat level threshold. Which feed will the clients IP address be automatically added to in this situation?

Options

Athe command-and-control cloud feed
Bthe allowlist and blocklist feed
Cthe custom cloud feed
Dthe infected host cloud feed

How the community answered

(21 responses)

A
10% (2)
B
5% (1)
D
86% (18)

Explanation

Infected hosts are internal hosts that have been compromised by malware and are communicating with external C&C servers3. Juniper ATP Cloud provides infected host feeds that list internal IP addresses or subnets of infected hosts along with a threat level3. Once the Juniper ATP Cloud global threshold for an infected host is met, that host is added to the infected host feed and assigned a threat level of 10 by the cloud4. You can also configure your SRX Series device to block traffic from these IP addresses using security policies4.

Topics

#command-and-control#infected host feed#threat level threshold#ATP Cloud

Community Discussion

No community discussion yet for this question.

Full JN0-336 Practice