Exam PCNSA All QuestionsBrowse all questions from this exam
Question 197

An administrator needs to add capability to perform real time signature lookups to block or sinkhole all known malware domains.

Which type of single, unified engine will get this result?

    Correct Answer: A

    To add capability to perform real-time signature lookups to block or sinkhole all known malware domains, the appropriate single, unified engine is the Content ID. This engine combines real-time threat prevention with URL database and application identification elements to detect and block various threats, including malware, through signature matching.

Discussion
mushi4kaOption: A

Content-IDTM combines a real-time threat prevention engine with a comprehensive URL database and elements of application identification to limit unauthorized data and file transfers and detect and block a wide range of exploits, malware, dangerous web surfing as well as targeted and unknown threats. https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/tech-briefs/techbrief-content-id.pdf

OhEmGeeOption: A

Security Processing doesn't have signature matching feature which is asked in the question. https://www.paloaltonetworks.com/resources/pa-series-next-generation-firewalls-hardware-architectures. There's Network Processor, Security Processor, Offload/Signature Matching Processor, and Management Processor. The Security Processing Engine has APP-ID | User-ID | URL match | policy match app decoding | SSL/IPSec | decompression functions. The Signature Matching Processor has Exploits | Virus | Spyware | CC# | SSN functions.

cjaceOption: A

The capability to perform real-time signature lookups to block or sinkhole all known malware domains is provided by the Content ID engine12345. Content ID is a threat prevention engine that uses multiple methods to detect and prevent threats at all points of the attack lifecycle1. It includes capabilities such as WildFire, which performs real-time signature lookups12345. Therefore, the correct answer is A. Content ID.

markeloff23Option: A

A is correct