A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to…

Question

Options

• AAnti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole
• BFile Blocking profiles applied to outbound security policies with action set to alert
• CVulnerability Protection profiles applied to outbound security policies with action set to block
• DAntivirus profiles applied to outbound security policies with action set to alert

• A
  79% (19)
• B
  4% (1)
• C
  13% (3)
• D
  4% (1)

Explanation

Starting with PAN-OS 6.0, DNS sinkhole is an action that can be enabled in Anti-Spyware profiles. A DNS sinkhole can be used to identify infected hosts on a protected network using DNS traffic in environments where the firewall can see the DNS query to a malicious URL. The DNS sinkhole enables the Palo Alto Networks device to forge a response to a DNS query for a known malicious domain/URL and causes the malicious domain name to resolve to a definable IP address (fake IP) that is given to the client. If the client attempts to access the fake IP address and there is a security rule in place that blocks traffic to this IP, the information is recorded in the https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta-

No community discussion yet for this question.