PSE-Strata Practice Questions

The three tabs available in the Detailed Device Health on Panorama for hardware-based firewalls are:

Environments: This tab provides information about the environmental conditions of the firewall, such as temperature and power status.

Interfaces: This tab displays the status and statistics of the network interfaces on the firewall.

Sessions: This tab shows session information, including session counts and details about active sessions.

These tabs allow administrators to monitor the health and performance of their firewalls effectively, ensuring optimal operation and quick identification of issues.

Palo Alto Networks' Threat Intelligence Cloud sources malware sample data from various significant inputs:

Next-generation firewalls deployed with WildFire Analysis Security Profiles: These firewalls are equipped with WildFire Analysis Security Profiles, which analyze unknown files and email links to detect zero-day threats and malware. This provides a rich source of real-time threat data.

WF-500 configured as private clouds for privacy concerns: The WF-500 appliance is used by organizations that prefer to maintain privacy and have stringent data control requirements. It serves as a private cloud for malware analysis, adding another layer of data collection.

Third-party data feeds: Partnerships with organizations like ProofPoint and the Cyber Threat Alliance enable Palo Alto Networks to integrate additional threat intelligence feeds. These third-party collaborations expand the breadth and depth of threat data available for analysis and defense​ (Palo Alto Networks)​​ (Palo Alto Networks)​​ (Palo Alto Networks)​.

When a client chooses not to block uncategorized websites, additional measures are necessary to maintain a level of protection.

A URL filtering profile with the action set to continue for unknown URL categories: By setting the action to continue, users will be prompted before accessing uncategorized websites, which provides an extra layer of caution and awareness, helping to mitigate risks associated with unknown sites.

A file blocking profile attached to security policy rules: This helps to reduce the risk of drive-by downloads by blocking potentially harmful file types from being downloaded when users visit uncategorized websites. This additional layer of security ensures that even if users access risky sites, the likelihood of malicious file downloads is minimized.

Before deploying a firewall evaluation unit in a customer environment, it is essential to take certain preparatory actions to ensure a smooth evaluation process and accurate results.

Upgrade the evaluation unit to the most current recommended firmware, unless a demo of the upgrade process is planned (Option C):

Ensures that the evaluation unit is running the latest and most secure firmware, providing the best performance and security features available.

Dynamic user groups (DUGs) provide flexibility in managing user access and security policies.

Tagging Users via Panorama or Web UI (Option B):

Administrators can manually add or remove users from DUGs using the graphical interface provided by Panorama or the firewall’s Web UI.

WildFire, Palo Alto Networks' advanced threat analysis service, has expanded its capabilities to analyze the following new script types:

VBScript: A scripting language commonly used in Windows environments for automation and administrative tasks, which can be exploited for malicious purposes.

JScript: A Microsoft implementation of JavaScript, used in various applications and often targeted by attackers for script-based exploits.

PowerShell Script: A powerful scripting language used for task automation and configuration management in Windows, which has become a common target for advanced attacks due to its capabilities.

By analyzing these script types, WildFire enhances its ability to detect and prevent sophisticated attacks that leverage scripting languages.

References:

Palo Alto Networks WildFire Datasheet

Palo Alto Networks WildFire Administration Guide