Select Two (Multi-Select) Questions

Simplifies IAM role maintenance by leveraging organization-level trust relationships

Using an organization-level IAM role or service principal streamlines credential management.

Eliminates the need to manually configure permissions and onboard each new account individually

Automated organizational onboarding ensures newly created accounts are discovered and protected automatically.

Provides a unified consolidated view of posture and compliance across all business units

Centralization aggregates findings into a single pane of glass for security analysts.

Secret detection to prevent credentials from being hardcoded in serverless source code

Serverless scanning identifies embedded secrets in function code.

Vulnerability scanning of serverless function deployment packages and dependencies

Compute scans serverless zip files and container images used in FaaS for known CVEs.

Runtime protection and function hardening against injection and malicious execution

App-Embedded defenders protect serverless functions at runtime.

Continuous cloud resource configuration auditing against security benchmarks

CSPM continuously evaluates cloud resource configurations against CIS and other standards.

Multi-cloud asset inventory discovery and visibility

CSPM discovers and maintains an inventory of assets across AWS, Azure, GCP, and other providers.

Scanning Terraform, AWS CloudFormation, and Kubernetes YAML templates for misconfigurations

IaC scanning analyzes configuration templates in repositories prior to deployment.

Scanning open source package dependencies (SCA) for known vulnerabilities in IDEs and repositories

Software Composition Analysis (SCA) identifies vulnerable dependencies in application code repositories.

Detecting hardcoded secrets, API keys, and passwords embedded in source code repositories

Secret scanning identifies exposed credentials in code files.

Conducting regular vulnerability assessments and penetration testing to identify security gaps.

Vulnerability testing identifies gaps before attackers exploit them.

Monitoring and integrating Indicators of Compromise (IOCs) from trusted threat intelligence feeds.

IOC monitoring provides early warning of emerging threat campaigns.

Performing threat modeling during application design to anticipate attack vectors.

Threat modeling helps architect secure applications from inception.

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.

Correct. Comprehensive inspection and logging provide necessary visibility for zero trust.

Segment the network into granular micro-perimeters using zones and virtual routers.

Correct. Micro-segmentation limits lateral movement during a security incident.

Enforce strict least-privilege access control based on user identity, application, and content.

Correct. Least privilege ensures users and devices only access resources required for their role.

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.

Inline ML stops zero-day threats instantly without waiting for sandbox detonation.

DNS Security service to automatically detect and block malicious domain lookups and command-and-control communication.

DNS Security uses machine learning to block newly registered and malicious domains.

WildFire cloud-based analysis profile configured to automatically inspect and detonate unknown executable files and documents.

WildFire detonates unknown files in a sandbox to detect zero-day malware.

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.

Data Filtering profiles inspect payloads for sensitive data patterns.

SSL Decryption policies to ensure visibility into encrypted HTTPS uploads to cloud storage.

Decryption ensures data exfiltration hiding inside encrypted sessions is visible to data filtering engines.

File Blocking profiles configured to restrict the egress of sensitive or unauthorized file extensions.

File blocking stops unauthorized file types from leaving the network.

Next-hop (IP address or interface)

The next-hop specifies where the firewall should forward matching traffic.

Destination subnet (IP prefix)

The destination prefix defines the network to which the route applies.

Route Name

Every static route must have a unique descriptive name within the virtual router.

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.

Correct. Limiting management access to known administrative subnets reduces the attack surface significantly.

Enable Authentication Profile settings to enforce multi-factor authentication (MFA) for all administrative logins.

Correct. Enforcing MFA mitigates credential theft risks for administrative accounts.

Performing initial triage and alert categorization of incoming security events.

Tier-1 analysts handle the high volume of incoming alerts to separate false positives from true threats.

Executing standardized runbooks for known alert types and escalating complex incidents.

Tier-1 follows documented procedures and escalates when an incident requires deeper investigation.

Provides a standardized industry terminology for describing adversary tactics and techniques.

MITRE ATT&CK establishes a common language for threat analysis.

Assists in identifying security control gaps by revealing which ATT&CK techniques lack detection coverage.

Technique mapping highlights areas where detection or prevention needs improvement.

Helps analysts map alerts to specific stages of the cyber kill chain and attack lifecycle.

Mapping helps identify whether an attack is in reconnaissance, execution, or exfiltration.

Hello and Dead timer intervals

Hello and dead timers must match exactly for neighbors to maintain adjacency.

Authentication type and password

Authentication settings must match on both routers if authentication is enabled.

Area ID

Both OSPF neighbors must belong to the same Area ID.

Layer 3

Layer 3 interfaces route packets between different subnets and zones.

Virtual Wire

Virtual Wire interfaces transparently inspect traffic between two ports without requiring IP addresses.

Static IP

Static IP translation provides a permanent 1:1 mapping between an internal IP and a translated IP.

Dynamic IP and Port (DIPP)

DIPP translates multiple private IPs to a smaller pool of public IPs using unique source ports.

Dynamic IP

Dynamic IP translation maps internal IPs to a pool of public IPs on a 1:1 basis without port translation.

SAML

SAML authentication is supported for modern IdP integration.

RADIUS

RADIUS is natively supported via Authentication Profiles.

Reset the user password in Active Directory via integration command.

Resetting the password prevents further unauthorized authentication using the compromised account.

Send a notification email to the user or security team.

Notifying stakeholders ensures awareness and verification of the incident.

Terminate active user sessions across firewalls or VPN gateways.

Revoking active sessions immediately terminates ongoing attacker access.

A Decryption policy rule configured with the 'Forward Proxy' action.

Decryption policy rules dictate which sessions trigger decryption.

A Forward Trust Certificate signed by an enterprise certificate authority (CA) trusted by endpoints.

The firewall signs re-issued certificates with this CA to prevent browser warnings.

A Decryption Profile attached to the decryption rule.

Decryption profiles define error handling and certificate validation settings.

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.

App-ID continuously inspects payloads and updates identification as more packet context is gathered.

Decryption policies allow the firewall to inspect TLS handshakes, transitioning 'unknown-tcp' to 'ssl'.

Once visibility is gained via decryption or handshake analysis, the exact application is identified.

Process execution events

Process creations and command-line arguments are vital for endpoint behavior analysis.

Network connection events

Socket creations and connection destinations track lateral movement and C2 communication.

File modification and creation events

Tracking dropped files and modifications helps identify ransomware and malware staging.