PSE-Strata-Pro-24 Exam Questions Tutorials

The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic isAdvanced DNS Security. Here’s why:

Advanced DNS Securityprotects against DNS-based threats, including domain generation algorithms (DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It leverages machine learning to detect and block DNS traffic associated with command-and-control servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP address is likely indicative of a DNS-based attack or malware activity, making this the most suitable service.

Option A:Advanced Threat Prevention (ATP) focuses on identifying and blocking sophisticated threats in network traffic, such as exploits and evasive malware. While it complements DNS Security, it does not specialize in analyzing DNS-specific traffic patterns.

Option B:Advanced WildFire focuses on detecting and preventing file-based threats, such as malware delivered via email attachments or web downloads. It does not provide specific protection for DNS-related anomalies.

Option C:Advanced URL Filtering is designed to prevent access to malicious or inappropriate websites based on their URLs. While DNS may be indirectly involved in resolving malicious websites, this service does not directly inspect DNS traffic patterns for threats.

Option D (Correct):Advanced DNS Security specifically addresses DNS-based threats. By enabling this service, the customer can detect and block DNS queries to malicious domains and investigate anomalous DNS behavior like the high traffic observed in this scenario.

How to Enable Advanced DNS Security:

Ensure the firewall has a valid Advanced DNS Security license.

Navigate toObjects > Security Profiles > Anti-Spyware.

Enable DNS Security under the "DNS Signatures" section.

Apply the Anti-Spyware profile to the relevant Security Policy to enforce DNS Security.

References:

Palo Alto Networks Advanced DNS Security Overview:

Best Practices for DNS Security Configuration.

Panorama is Palo Alto Networks’ centralized management solution for managing multiple firewalls. It supports multiple deployment options to suit different infrastructure needs. The valid deployment options are as follows:

Why "As a virtual machine (ESXi, Hyper-V, KVM)" (Correct Answer A)?Panorama can be deployed as a virtual machine on hypervisors like VMware ESXi, Microsoft Hyper-V, and KVM. This is a common option for organizations that already utilize virtualized infrastructure.

Why "With a cloud service provider (AWS, Azure, GCP)" (Correct Answer B)?Panorama is available for deployment in the public cloud on platforms like AWS, Microsoft Azure, and Google Cloud Platform. This allows organizations to centrally manage firewalls deployed in cloud environments.

Why "As a dedicated hardware appliance (M-100, M-200, M-500, M-600)" (Correct Answer E)?Panorama is available as a dedicated hardware appliance with different models (M-100, M-200, M-500, M-600) to cater to various performance and scalability requirements. This is ideal for organizations that prefer physical appliances.

Why not "As a container (Docker, Kubernetes, OpenShift)" (Option C)?Panorama is not currently supported as a containerized deployment. Containers are more commonly used for lightweight and ephemeral services, whereas Panorama requires a robust and persistent deployment model.

Why not "On a Raspberry Pi (Model 4, Model 400, Model 5)" (Option D)?Panorama cannot be deployed on low-powered hardware like Raspberry Pi. The system requirements for Panorama far exceed the capabilities of Raspberry Pi hardware.