PCNSE · Question #80
The automated Correlation Engine uses correlation objects to analyze the logs for patterns. When a match occurs:
The correct answer is B. The Correlation Engine generates a correlation event. When the automated Correlation Engine identifies patterns in logs that match predefined correlation objects, it generates a correlation event to signal a potential security incident.
Question
The automated Correlation Engine uses correlation objects to analyze the logs for patterns. When a match occurs:
Options
- AThe Correlation Engine blocks the connection
- BThe Correlation Engine generates a correlation event
- CThe Correlation Engine displays a warning message to the end user
- DThe Correlation Engine dumps the alarm log
How the community answered
(31 responses)- A3% (1)
- B87% (27)
- C3% (1)
- D6% (2)
Why each option
When the automated Correlation Engine identifies patterns in logs that match predefined correlation objects, it generates a correlation event to signal a potential security incident.
The Correlation Engine is a monitoring and alerting tool and does not directly block connections, as blocking actions are handled by enforcement points like firewall policies.
The purpose of a Correlation Engine is to identify specific patterns or sequences of events in log data; when these patterns match configured correlation objects, the engine generates a correlation event for further action or investigation.
The Correlation Engine operates at the backend log analysis level and does not display warning messages directly to end-users.
The Correlation Engine generates specific *events* based on matches, it does not merely 'dump the alarm log,' which is a broader log output.
Concept tested: Security correlation engine function
Source: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/acc-and-reports/use-the-correlation-engine.html
Topics
Community Discussion
No community discussion yet for this question.