A customer sees unusually high DNS traffic to an unfamiliar IP address. Which Palo Alto Networks Cloud-Delivered Security Services (CDSS) subscription should be enabled to further inspect this…

Question

Options

• AAdvanced Threat Prevention
• BAdvanced WildFire
• CAdvanced URL Filtering
• DAdvanced DNS Security

• A
  2% (1)
• B
  5% (2)
• C
  2% (1)
• D
  91% (39)

Explanation

The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic is Advanced Advanced DNS Security protects against DNS-based threats, including domain generation algorithms (DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It leverages machine learning to detect and block DNS traffic associated with command- and-control servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP address is likely indicative of a DNS-based attack or malware activity, making this the most suitable service. Option D (Correct): Advanced DNS Security specifically addresses DNS-based threats. By enabling this service, the customer can detect and block DNS queries to malicious domains and investigate anomalous DNS behavior like the high traffic observed in this scenario.

No community discussion yet for this question.