2.6 Compare and Contrast WildFire, Unit 42 Intelligence, and VirusTotal SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is reviewing a WildFire report for a file that was submitted from the firewall. The report shows the file attempted to connect to a known malicious IP address and modified several system registry keys to establish persistence. Based on this behavior, which WildFire verdict should the analyst expect?

   • AMalware
   • BGrayware
   • CPhishing
   • DBenign
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which type of analysis does WildFire primarily perform to determine if a file is malicious?

   • ASignature matching against known malware patterns
   • BDynamic analysis by executing the file in a sandbox
   • CStatic analysis of the file's source code
   • DMachine learning classification based on file metadata only
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How do community contributions enhance VirusTotal?

   • AThey provide additional analysis by allowing users to comment and vote on files
   • BThey enable automatic firewall rule updates
   • CThey allow users to execute files in a sandbox
   • DThey provide access to Unit 42 research reports
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team wants to proactively block traffic to command-and-control (C2) domains and IP addresses that were recently identified in a Unit 42 threat brief about a new botnet. The team uses Palo Alto Networks firewalls and wants to implement this intelligence as quickly as possible. What is the most efficient way to operationalize this Unit 42 intelligence?

   • AManually create custom URL filtering and security policy rules for each IOC.
   • BSubmit the IOCs to VirusTotal to generate a blocklist.
   • CUpload the IOCs to WildFire for sandbox analysis.
   • DUse the firewall's built-in threat prevention and URL filtering signatures, which are updated by Unit 42 intelligence.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How is Unit 42 intelligence integrated into Palo Alto Networks products?

   • AIt is automatically applied to firewall security policies to block known threats
   • BIt is only available as a standalone subscription service
   • CIt is used exclusively for WildFire sandbox analysis
   • DIt is only accessible through the Unit 42 website
   Reveal Solution Discussion Select an answer first