TCP is the protocol of which layer of the OSI model?
Correct Answer: A
TCP stands for Transmission Control Protocol, and it is one of the main protocols used in the internet. TCP provides reliable, ordered, and error-free delivery of data between applications 1. In terms of the OSI model, TCP is a transport-layer protocol. The transport layer is the fourth layer of the OSI model, and it is responsible for establishing end-to-end connections, segmenting data into packets, and ensuring reliable and efficient data transfer 2. The transport layer also provides flow control, congestion control, and error detection and correction mechanisms 2. TCP is not the only transport-layer protocol; another common one is UDP (User Datagram Protocol), which is faster but less reliable than TCP 3. References: 1: TCP/IP TCP, UDP, and IP protocols - IBM 2: Transport Layer | Layer 4 | The OSI-Model 3: TCP/IP Model vs. OSI Model | Similarities and Differences - Fortinet
Question 37
What are two limitations of signature-based anti-malware software? (Choose two.)
Correct Answer: A,C
Signature-based systems struggle with polymorphic or obfuscated malware, which changes its code to avoid detection. Signature-based detection relies on static databases of known threat signatures, limiting its ability to identify new or unknown threats.
Question 38
In addition to local analysis, what can send unknown files to WildFire for discovery and deeper analysis to rapidly detect potentially unknown malware?
Correct Answer: A
In addition to local analysis, Cortex XDR can send unknown files to WildFire for discovery and deeper analysis to rapidly detect.
Question 39
Why is it important to protect East-West traffic within a private cloud?
Correct Answer: A
East-West traffic is the lateral movement of data packets between servers within a data center, or across private and public clouds1. This type of traffic has grown substantially with the proliferation of data centers and cloud adoption, and it now surpasses the conventional North-South traffic that goes in or out of the network2. Therefore, it is important to protect East-West traffic from potential malicious actors and breaches, as threats can arise internally and move laterally without ever touching the traditional network perimeter12. By inspecting and monitoring all East-West traffic, organizations can effectively block the lateral movement of threat actors, increase network visibility, protect vital applications and data, and lower costs and risks for distributed operations23. References: * East-West Traffic: Everything You Need to Know | Gigamon Blog * What is East-West Security? | VMware Glossary * How to Harness East-West Visibility for a Stronger Defensive Security ...
Question 40
Which endpoint tool or agent can enact behavior-based protection?
Correct Answer: B
Cortex XDR is an endpoint tool or agent that can enact behavior-based protection. Behavior-based protection is a method of detecting and blocking malicious activities based on the actions or potential actions of an object, such as a file, a process, or a network connection. Behavior-based protection can identify and stop threats that are unknown or evade traditional signature-based detection, by analyzing the object's behavior for suspicious or abnormal patterns. Cortex XDR is a comprehensive solution that provides behavior-based protection for endpoints, networks, and cloud environments. Cortex XDR uses artificial intelligence and machine learning to continuously monitor and analyze data from multiple sources, such as logs, events, alerts, and telemetry. Cortex XDR can detect and prevent advanced attacks, such as ransomware, fileless malware, zero-day exploits, and lateral movement, by applying behavioral blocking and containment rules. Cortex XDR can also perform root cause analysis, threat hunting, and incident response, to help organizations reduce the impact and duration of security incidents. References: * Cortex XDR - Palo Alto Networks * Behavioral blocking and containment | Microsoft Learn * Behaviour Based Endpoint Protection | Signature-Based Security - Xcitium * The 12 Best Endpoint Security Software Solutions and Tools [2024]
