Infrastructure Management And CDSS practice questions

debug wildfire connectivity

Why wrong: This is a debug command, not the primary command for checking registration status.

show jobs id wildfire-sync

Why wrong: This command shows job history, not service availability.

test wildfire cloud-reachability

Why wrong: This command does not exist in the standard PAN-OS CLI.

Configure a URL Filtering profile to block the top-level domain.

Why wrong: URL Filtering operates at the HTTP/HTTPS layer and does not control DNS query resolution.

Enable DNS Security and rely on the default 'Command and Control' category block.

Why wrong: Default categories are not designed for specific subdomain granularity.

Add the full domain to the DNS sinkhole whitelist.

Why wrong: Whitelisting does not provide the granularity needed to block specific subdomains while allowing others.

Disable SSL decryption for the proxy traffic.

Why wrong: This would prevent the firewall from seeing the actual threats.

Create a specific 'Proxy' zone and apply an App-ID policy.

Why wrong: This does not help with identifying the end host or content.

Configure the proxy as a 'Trusted' source in the Device > Setup menu.

Why wrong: This does not enable deep packet inspection of the proxied traffic.

Global Find

Why wrong: Global Find is for locating objects, not auditing policy attributes.

ACC (Application Command Center)

Why wrong: ACC is for traffic analysis, not policy configuration auditing.

Threat Log viewer

Why wrong: The log viewer shows results of existing policies, not their configuration status.

Enable 'WildFire' in the Antivirus profile.

Why wrong: WildFire forwarding is a separate setting in the File Blocking profile.

Add the server's IP to the 'WildFire Analysis' whitelist.

Why wrong: Whitelisting prevents analysis.

Configure a 'Log Forwarding' profile for WildFire.

Why wrong: Log forwarding handles existing logs, not file submission.

Enable 'Alert' as the only action.

Why wrong: Alert does not block or upload the file.

Disable 'Session Log' in the Security Profile.

Why wrong: Session logs should be enabled for auditability.

Block

Why wrong: Standard action to stop the threat.

Allow

Why wrong: 'Allow' is not an action in a threat profile, as threats are by definition blocked.

Monitor

Why wrong: 'Monitor' is not a valid action in the standard Vulnerability Protection profile.

To encrypt DNS traffic between the firewall and the ISP.

Why wrong: This is the function of DoH (DNS over HTTPS) or DNS over TLS.

To allow a firewall to act as a DNS server for internal clients.

Why wrong: This is the function of the DNS Proxy feature.

To cache DNS queries to improve network performance.

Why wrong: This is the function of a standard DNS cache, not a sinkhole.

Move the security policy to the top of the policy list.

Why wrong: Policy order does not bypass the category filtering configured within the profile.

Add the site to the 'Blocked' list in the URL Filtering profile.

Why wrong: This would reinforce the block rather than allow it.

Create a new URL category and add the domain to it, then block that category.

Why wrong: This would not provide access to the user.

Lower the threat prevention action from block to alert for all executables.

Why wrong: This lowers security posture for all files, not just proprietary ones.

Disable WildFire on the specific security policy rule.

Why wrong: This would remove protection entirely rather than minimizing false positives.

Change the WildFire forwarding location to a local WildFire appliance.

Why wrong: Local appliances still perform the same analysis logic and will not solve false positives caused by file characteristics.

By manually downloading the threat signature database from the Customer Support Portal.

Why wrong: While possible, it is not the standard delivery mechanism for CDSS.

Through the daily WildFire update package.

Why wrong: WildFire updates contain signatures for malicious files, not general exploits.

By enabling the 'Automatic Update' feature in the Device > Software menu.

Why wrong: This updates the PAN-OS software, not the threat signatures.

Enable 'Packet Capture' for all security policies.

Why wrong: This increases log volume but does not speed up WildFire analysis.

Increase the WildFire cloud region to the nearest geographic site.

Why wrong: While helpful for latency, it does not change the analysis mode.

Set the WildFire forwarding to 'Legacy' mode.

Why wrong: Legacy mode does not support real-time analysis.

It analyzes the URL to determine if it is a known malicious site.

Why wrong: While categorization helps, the feature specifically inspects POST traffic.

It requires an agent installed on the endpoint to monitor browser activity.

Why wrong: This is a network-based feature that does not require endpoint agents.

It monitors all inbound traffic for known phishing signatures.

Why wrong: Credential phishing protection focuses on outbound submission of credentials.

It allows the firewall to bypass SSL decryption for certain categories.

Why wrong: This is a standard feature of URL Filtering.

It includes an integrated VPN client for remote workers.

Why wrong: URL Filtering is not related to VPN client services.

It allows for more custom URL categories.

Why wrong: Both versions support custom categories.

Objects > Security Profiles > DNS Security

Why wrong: This is where the profile is defined, not where it is enabled on traffic.

Network > Zones > [Zone Name]

Why wrong: Zones define traffic boundaries but do not contain security service profiles.

Device > Setup > Services > DNS

Why wrong: This is for configuring the firewall's own DNS settings.

Only apply groups to traffic destined for the Internet.

Why wrong: Internal traffic also requires security profiling.

Avoid using groups and always apply individual profiles to rules.

Why wrong: Individual profiles are harder to manage at scale.

Create a unique group for every single security policy rule.

Why wrong: This creates administrative overhead and is not a best practice.

It triggers an alert but does not interfere with the traffic flow.

Why wrong: This describes the 'Alert' action.

It blocks the source IP address for a specified duration.

Why wrong: This is the function of the 'Block IP' setting in a DoS profile.

It drops the packet but allows the TCP session to continue.

Why wrong: This describes the 'Drop' action.

The 'Threats' dynamic update is not scheduled.

Why wrong: Missing updates would prevent detection, but the logging framework would still function.

The firewall is in 'Evaluation Mode'.

Why wrong: Evaluation mode still permits logging of threats.

The log forwarding profile is missing the 'Global' setting.

Why wrong: This affects external logging, not the local log database.

Monitor > Logs > WildFire Submissions

Why wrong: This shows file analysis results, not URL blocks.

Monitor > Logs > Traffic

Why wrong: Traffic logs show session end reasons but not policy-based URL category blocks.

Monitor > Logs > Threat

Why wrong: Threat logs show exploits, malware, and viruses, not URL filter blocks.

To organize firewall administrators by department.

Why wrong: This is managed via Admin Roles.

To collect all logs from a specific security zone.

Why wrong: This is done with Log Forwarding profiles.

To group firewall interfaces for load balancing.

Why wrong: This is done with Aggregate Ethernet interfaces.