If the firewall is configured for credential phishing prevention using the "Domain Credential Filter" method, which login will be detected as credential theft?

Question

Options

• AUsing the name user's corporate username and password.
• BFirst four letters of the username matching any valid corporate username.
• CMatching any valid corporate username.
• DMapping to the IP address of the logged-in user.

• A
  77% (17)
• B
  9% (2)
• C
  5% (1)
• D
  9% (2)

Explanation

The Windows-based User-ID agent is installed on a Read-Only Domain Controller (RODC). The User-ID agent collects password hashes that correspond to users for which you want to enable credential detection and sends these mappings to the firewall. The firewall then checks if the source IP address of a session matches a username and if the password submitted to the webpage belongs to that username. With this mode, the firewall blocks or alerts on the submission only when the password submitted matches a user password. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/prevent-credential- phishing/methods-to-check-for-corporate-credential-submissions

No community discussion yet for this question.