Exam PCNSA topic 1 question 38 discussion

Actual exam question from Palo Alto Networks's PCNSA

Question #: 38
Topic #: 1

The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.
Which security profile feature could have been used to prevent the communication with the CnC server?

A. Create an anti-spyware profile and enable DNS Sinkhole
B. Create an antivirus profile and enable DNS Sinkhole
C. Create a URL filtering profile and block the DNS Sinkhole category
D. Create a security policy and enable DNS Sinkhole

Show Suggested Answer

Suggested Answer: A 🗳️

by rodobrian at May 12, 2020, 12:32 a.m.

Comments

Submit Cancel

Oteslar

4 months ago

A is correct

upvoted 1 times

...

kewokil120

9 months, 3 weeks ago

Selected Answer: A

A is correct

upvoted 3 times

...

javim

1 year ago

Yes, the correct answer is A. DNS Sinkhole is not a Category of URL Filtering.

upvoted 2 times

...

Jheax

1 year ago

DNS sinkhole can only be configured on the antispyware security profile. Answer is A.

upvoted 3 times

...

rodobrian

2 years, 9 months ago

Because they mention 'known C2 server' I think that URL filtering & DNS sinkhole is also a legitimate answer here. Known URLs that are associated with C2 are blocked via Pan-DB

upvoted 3 times

PaloGuy

2 years, 9 months ago

Answer C is saying block DNS Sinkhole which is incorrect The answer is A

upvoted 11 times

...

Exam PCNSA All Questions

View all questions & answers for the PCNSA exam

Exam PCNSA topic 1 question 38 discussion

Comments

Oteslar

kewokil120

javim

Jheax

rodobrian

PaloGuy

SY0-701