NETSEC-PRO · Question #8
A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included
The correct answer is C. Configure DNS Security signature policy settings to sinkhole malicious DNS queries.. Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving. The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops
Question
A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included in the initial configuration of the Advanced DNS Security service?
Options
- ACreate a decryption policy rule to decrypt DNS-over-TLS / port 853 traffic.
- BCreate overrides for all company owned FQDNs.
- CConfigure DNS Security signature policy settings to sinkhole malicious DNS queries.
- DEnable Advanced Threat Prevention with default settings and only focus on high-risk traffic.
How the community answered
(29 responses)- A10% (3)
- B7% (2)
- C79% (23)
- D3% (1)
Explanation
Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving. The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains. Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing
Topics
Community Discussion
No community discussion yet for this question.