PCCET · Question #123
What is the order in which the endpoint checks if a new program is safe?
The correct answer is C. WildFire query, then local analysis, then behavioral threat protection. An endpoint security solution typically checks new programs by first querying a cloud-based threat intelligence service, then performing local static analysis, and finally monitoring for malicious behavior during execution.
Question
What is the order in which the endpoint checks if a new program is safe?
Options
- Abehavioral threat protection, then local analysis, then WildFire query
- Blocal analysis, then behavioral threat protection, then WildFire query
- CWildFire query, then local analysis, then behavioral threat protection
- Dlocal analysis, then WildFire query, then behavioral threat protection
How the community answered
(42 responses)- A7% (3)
- B2% (1)
- C88% (37)
- D2% (1)
Why each option
An endpoint security solution typically checks new programs by first querying a cloud-based threat intelligence service, then performing local static analysis, and finally monitoring for malicious behavior during execution.
Behavioral analysis is a runtime detection method, which occurs after initial static checks or cloud queries.
Local analysis and behavioral threat protection generally follow an initial WildFire query for rapid verdict retrieval.
When a new program is encountered, the endpoint first queries a global threat intelligence cloud service like WildFire for known verdicts, then performs local static analysis if needed, and finally applies behavioral threat protection if the program is allowed to execute.
While local analysis is a key step, it typically follows an immediate cloud lookup (WildFire query) and precedes runtime behavioral monitoring.
Concept tested: Endpoint Malware Analysis Workflow (Palo Alto)
Source: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-9/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/cortex-xdr-pro-overview/malware-and-exploit-protection.html
Topics
Community Discussion
No community discussion yet for this question.