What happens when SaaS Security sees a new or unknown SaaS application?

Question

Options

• AIt forwards the application for WildFire analysis.
• BIt uses machine learning (ML) to classify the application.
• CIt generates alerts regarding changes in performance.
• DIt extends the branch perimeter to the closest node with high performance.

• A
  86% (37)
• B
  7% (3)
• C
  5% (2)
• D
  2% (1)

Explanation

When SaaS Security encounters a new or unknown SaaS application, it forwards that application to WildFire - Palo Alto Networks' cloud-based threat analysis service - for deep inspection and classification, making A correct. WildFire is specifically designed to analyze unknown files and applications using sandboxing and behavioral analysis, which is exactly what's needed when an application can't be identified by existing signatures.

Why the distractors are wrong:

• B (ML classification) - While Palo Alto's App-ID does use ML to identify known applications, unknown/new apps that can't be classified are escalated to WildFire, not handled by ML alone.
• C (performance alerts) - Generating performance-change alerts is a monitoring/observability function, unrelated to the handling of unknown applications.
• D (extending branch perimeter) - This describes a network topology/SD-WAN concept, not an application classification process.

Memory tip: Think of WildFire as the "unknown specimens lab" - when SaaS Security finds something it doesn't recognize, it ships the sample off to the lab (WildFire) for analysis, just like a doctor sends an unidentified sample to pathology.

No community discussion yet for this question.