What does Palo Alto Networks Traps do first when an endpoint is asked to run an executable?

Question

Options

• Asend the executable to WildFire
• Brun a static analysis
• Crun a dynamic analysis
• Dcheck its execution policy

• B
  4% (1)
• C
  4% (1)
• D
  93% (25)

Explanation

When Traps intercepts an execution request, it first consults its local execution policy (D) to determine whether the file is already known-good, known-bad, or requires further inspection. This policy check is the fastest gate - it can block or allow instantly without sending anything anywhere or running analysis engines.

Why the distractors are wrong:

• A (send to WildFire): WildFire cloud submission happens after local checks fail to reach a verdict - it's a fallback, not the first step.
• B (static analysis): Static analysis (examining the file's structure/hash) is triggered only when the policy check doesn't already have a verdict; it comes second in the chain.
• C (dynamic analysis): Dynamic (behavioral/sandbox) analysis is the most resource-intensive step and happens last, when neither policy nor static analysis resolves the verdict.

Memory tip: Think of it as a bouncer at a club - the bouncer first checks the list (policy) before doing anything else. Only unknowns get the full ID check (static) or a deeper background search (dynamic/WildFire).

No community discussion yet for this question.