Given the following snippet of a WildFire submission log, did the end-user get access to the requested information and why or why not?

Question

Exhibit

Options

• AYes, because the action is set to "allow''
• BNo, because WildFire categorized a file with the verdict "malicious"
• CYes, because the action is set to "alert"
• DNo, because WildFire classified the seventy as "high."

• A
  8% (4)
• B
  4% (2)
• C
  86% (44)
• D
  2% (1)

Explanation

The correct answer is (C): Yes, because the action is set to 'alert'. In PAN-OS, a WildFire submission log entry with an action of 'alert' means the firewall logged the event and generated an alert, but still allowed the traffic and file transfer to proceed. The file was submitted to WildFire for analysis, but the user was not blocked from accessing the content. This is different from an action of 'block' or 'reset-both', which would prevent access. (A) is also technically true in effect but 'alert' is the precise action shown, making C the best answer. (B) is incorrect because a 'malicious' verdict from WildFire only blocks future instances after the verdict is returned - the initial session with an 'alert' action was allowed. (D) is incorrect because severity alone does not determine whether traffic is blocked; the action field does.

No community discussion yet for this question.