What does WildFire block on a next-generation firewall (NGFW) that already has Advanced Threat Prevention (ATP) enabled?

Question

Options

• ABrute-force attacks
• BMalicious unknown files
• CPort scans
• DBenign unknown files

• A
  7% (3)
• B
  78% (36)
• C
  2% (1)
• D
  13% (6)

Explanation

WildFire's core function is cloud-based sandbox analysis of files with unknown disposition - files that existing signature databases cannot classify as safe or malicious. When ATP is already enabled, known threats and exploits are already blocked, so WildFire fills the gap by analyzing those remaining unknown files and blocking the ones found to be malicious (B).

Why the distractors are wrong:

• A (Brute-force attacks): These are mitigated by Zone Protection profiles and Authentication policy, not WildFire.
• C (Port scans): Also handled by Zone Protection, which detects reconnaissance activity at the network level.
• D (Benign unknown files): WildFire analyzes unknown files but does not block benign ones - it only blocks those determined to be malicious after sandbox analysis.

Memory tip: Think of ATP and WildFire as a two-layer net - ATP catches known bad (signatures, exploits, C2), while WildFire catches unknown bad (zero-days, novel malware). The key phrase to remember is "unknown → sandbox → block if malicious."

No community discussion yet for this question.