PCNSE · Question #76
Select all the platform components that Wildfire automatically updates after finding malicious activity in previously unknown files, URLs and APKs?
The correct answer is C. Anti-Virus (Threat) D. Content/Web Filtering (Pan-DB) G. Anti Command & Control signatures (Threat). WildFire automatically updates Anti-Virus, Content/Web Filtering (PAN-DB), and Anti Command & Control signatures on the platform components after discovering malicious activity.
Question
Select all the platform components that Wildfire automatically updates after finding malicious activity in previously unknown files, URLs and APKs?
Options
- ADecrypt (Port-Mirroring)
- BMobile (Global Protect)
- CAnti-Virus (Threat)
- DContent/Web Filtering (Pan-DB)
- EAnti-Malware signatures (WildFire)
- FManagement (Panorama)
- GAnti Command & Control signatures (Threat)
How the community answered
(24 responses)- A4% (1)
- C79% (19)
- E13% (3)
- F4% (1)
Why each option
WildFire automatically updates Anti-Virus, Content/Web Filtering (PAN-DB), and Anti Command & Control signatures on the platform components after discovering malicious activity.
Decrypt (Port-Mirroring) is a traffic analysis method, not a component updated by WildFire for threat intelligence.
Mobile (GlobalProtect) is a remote access VPN solution; while GlobalProtect can utilize WildFire intelligence, it's not a platform component directly updated by WildFire with signatures.
WildFire automatically generates and distributes Anti-Virus signatures (part of the Threat Prevention subscription) to detect newly identified malware, ensuring firewalls can block these threats.
WildFire updates the Content/Web Filtering database (PAN-DB) with newly categorized malicious URLs, enabling the firewall to block access to command-and-control sites or phishing pages.
Anti-Malware signatures (WildFire) is what WildFire generates, but the *delivery* mechanism to the firewall's protection capabilities is via services like Anti-Virus (Threat), making C the more precise component that receives the update.
Management (Panorama) manages firewalls and policies, but WildFire does not directly update Panorama with threat intelligence; Panorama distributes the updates to firewalls.
WildFire identifies and generates Anti Command & Control signatures (also part of the Threat Prevention subscription) to detect and prevent communication with malicious C2 servers identified through behavioral analysis.
Concept tested: WildFire integration and threat intelligence distribution
Source: https://docs.paloaltonetworks.com/wildfire/10-2/wildfire-admin/wildfire-overview/wildfire-capabilities.html
Topics
Community Discussion
No community discussion yet for this question.