Palo Alto Networks Certified Network Security Engineer (PCNSE)Core ConceptsMedium
A company is experiencing slow application performance when users access cloud-based applications. The network team suspects that the firewall's security processing might be contributing to the latency. They have implemented a security policy that includes Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire analysis for all outbound traffic. Which of these security profiles is most likely to introduce significant latency due to its nature of operation?
- AAnti-Spyware
- BWildFire Analysis
- CVulnerability Protection
- DAntivirus
Show answer & explanationAnswer & explanation
Correct answer: B. WildFire Analysis
WildFire analysis involves sending unknown files to a cloud-based sandbox for detonation and analysis, which inherently introduces a delay while the file is processed and a verdict is returned. This process is more latency-sensitive than real-time signature-based scanning.
Why the other options are wrong
- A. Anti-Spyware uses signatures and heuristics, processed in real-time with minimal latency.
- C. Vulnerability Protection uses signatures to detect exploits, processed in real-time with minimal latency.
- D. Antivirus uses signatures, processed in real-time with minimal latency.
WildFire Analysis
A cloud-based service that identifies and prevents unknown threats by executing suspicious files in a virtual sandbox environment to observe their behavior.
- Identifies unknown malware
- Uses cloud-based sandbox for analysis
- Can introduce latency due to analysis time
Memory trick: Some shields are quick, others need to think for a while.