A customer is looking for an analytics tool that uses the logs on the firewall to detect actionable events on the network. They require something to automatically process a series of related threat events that, when combined, indicate a likely compromised host on their network or some other higher level conclusion. They need to pinpoint the area of risk, such as compromised hosts on the network, allows you to assess the risk and take action to prevent exploitation of network resources.

Which feature of PAN-OS can you talk about to address their requirement to optimize their business outcomes?

A. The Automated Correlation Engine

B. Cortex XDR and Cortex Data Lake

C. WildFire with API calls for automation

D. 3rd Party SIEM which can ingest NGFW logs and perform event correlation

Which two email links, contained in SMTP and POP3, can be submitted from WildFire analysis with a WildFire subscription? (Choose two.)

A. FTP

B. HTTPS

C. RTP

D. HTTP

Which two configuration elements can be used to prevent abuse of stolen credentials? (Choose two.)

A. WildFire analysis

B. Dynamic user groups (DUGs)

C. Multi-factor authentication (MFA)

D. URL Filtering Profiles

A customer with a legacy firewall architecture is focused on port and protocol level security, and has heard that next generation firewalls open all ports by default. What is the appropriate rebuttal that positions the value of a NGFW over a legacy firewall?

A. Palo Alto Networks keep ports closed by default, only opening ports after understanding the application request, and then opening only the application-specified ports.

B. Palo Alto Networks does not consider port information, instead relying on App-ID signatures that do not reference ports.

C. Default policies block all interzone traffic. Palo Alto Networks empowers you to control applications by default ports or a configurable list of approved ports on a per-policy basis.

D. Palo Alto Networks NGFW protects all applications on all ports while leaving all ports opened by default.

An endpoint, inside an organization, is infected with known malware that attempts to make a command-and-control connection to a C2 server via the destination IP address

Which mechanism prevents this connection from succeeding?

A. DNS Sinkholing

B. DNS Proxy

C. Anti-Spyware Signatures

D. Wildfire Analysis