A security architect is evaluating a first-generation ZTNA (ZTNA 1.0) deployment. Which limitation of ZTNA 1.0 would most directly allow a compromised endpoint to maintain a persistent foothold after its initial connection is authorized?
Explanation
there is no monitoring of changes in user, application or device behavior, and it can't detect or prevent malware or lateral movement across connections
once access is granted in ZTNA 1.0 solutions, the connection is implicitly trusted forever, allowing a handy exploit route for sophisticated threats
A SOC team is concerned about targeted command-and-control (C2) attacks and evasive tools such as Cobalt Strike being missed by traditional offline analysis. Which PAN-OS 10.2 Nebula capability was specifically introduced to detect these threats by moving analysis inline?
Explanation
Advanced Threat Prevention: A new best-in-class intrusion prevention system (IPS), which brings security analysis from "offline" to "inline" using cloud compute
Advanced Threat Prevention can detect many unknown and targeted command and control (C2) attacks as well as evasive attacks from tools such as Cobalt Strike
Locked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to review