An organization wants to protect its internal network from previously unknown malware that does not match any existing signatures. Which NGFW feature BEST addresses this requirement?

The correct answer is D. Sandbox / Advanced Threat Protection. Signature-based detection (used by traditional IPS and antivirus) can only identify threats it has seen before. Zero-day or novel malware has no existing signature, so it evades these controls. Sandbox / Advanced Threat Protection addresses this by executing suspicious files in a

NGFW Threat Prevention

Question

Options

AStateful inspection
BIntrusion Prevention System (IPS)
CURL filtering
DSandbox / Advanced Threat Protection

How the community answered

(39 responses)

A
3% (1)
B
3% (1)
C
5% (2)
D
90% (35)

Explanation

Signature-based detection (used by traditional IPS and antivirus) can only identify threats it has seen before. Zero-day or novel malware has no existing signature, so it evades these controls. Sandbox / Advanced Threat Protection addresses this by executing suspicious files in an isolated virtual environment (sandbox) and observing their actual behavior - file system changes, network calls, process creation, etc. - to determine if they are malicious, regardless of whether a signature exists. This behavioral analysis is specifically designed for unknown threats. Stateful inspection (A) tracks connection state but does not analyze file payloads. IPS (B) relies primarily on known signatures. URL filtering (C) blocks known malicious URLs but does not analyze unknown malware behavior.

Topics

#Advanced Threat Protection#Malware Protection#Sandbox#Zero-day threats

Community Discussion

No community discussion yet for this question.

Full NGFW-ENGINEER Practice